files-backend.c · matheusbsbs/matheus-bagliano

bisect

bisect jch maint master next seen test todo

c 4,058 lines 112 KB

Raw

1	#define USE_THE_REPOSITORY_VARIABLE
2	#define DISABLE_SIGN_COMPARE_WARNINGS
3
4	#include "../git-compat-util.h"
5	#include "../abspath.h"
6	#include "../config.h"
7	#include "../copy.h"
8	#include "../environment.h"
9	#include "../gettext.h"
10	#include "../hash.h"
11	#include "../hex.h"
12	#include "../fsck.h"
13	#include "../refs.h"
14	#include "../repo-settings.h"
15	#include "refs-internal.h"
16	#include "ref-cache.h"
17	#include "packed-backend.h"
18	#include "../ident.h"
19	#include "../iterator.h"
20	#include "../dir-iterator.h"
21	#include "../lockfile.h"
22	#include "../path.h"
23	#include "../dir.h"
24	#include "../chdir-notify.h"
25	#include "../setup.h"
26	#include "../worktree.h"
27	#include "../wrapper.h"
28	#include "../write-or-die.h"
29	#include "../revision.h"
30	#include <wildmatch.h>
31
32	/*
33	* This backend uses the following flags in `ref_update::flags` for
34	* internal bookkeeping purposes. Their numerical values must not
35	* conflict with REF_NO_DEREF, REF_FORCE_CREATE_REFLOG, REF_HAVE_NEW,
36	* or REF_HAVE_OLD, which are also stored in `ref_update::flags`.
37	*/
38
39	/*
40	* Used as a flag in ref_update::flags when a loose ref is being
41	* pruned. This flag must only be used when REF_NO_DEREF is set.
42	*/
43	#define REF_IS_PRUNING (1 << 4)
44
45	/*
46	* Flag passed to lock_ref_sha1_basic() telling it to tolerate broken
47	* refs (i.e., because the reference is about to be deleted anyway).
48	*/
49	#define REF_DELETING (1 << 5)
50
51	/*
52	* Used as a flag in ref_update::flags when the lockfile needs to be
53	* committed.
54	*/
55	#define REF_NEEDS_COMMIT (1 << 6)
56
57	/*
58	* Used as a flag in ref_update::flags when the ref_update was via an
59	* update to HEAD.
60	*/
61	#define REF_UPDATE_VIA_HEAD (1 << 8)
62
63	/*
64	* Used as a flag in ref_update::flags when a reference has been
65	* deleted and the ref's parent directories may need cleanup.
66	*/
67	#define REF_DELETED_RMDIR (1 << 9)
68
69	/*
70	* Used to indicate that the reflog-only update has been created via
71	* `split_head_update()`.
72	*/
73	#define REF_LOG_VIA_SPLIT (1 << 14)
74
75	struct ref_lock {
76	char *ref_name;
77	struct lock_file lk;
78	struct object_id old_oid;
79	unsigned int count; /* track users of the lock (ref update + reflog updates) */
80	};
81
82	struct files_ref_store {
83	struct ref_store base;
84	unsigned int store_flags;
85
86	char *gitcommondir;
87	enum log_refs_config log_all_ref_updates;
88	int prefer_symlink_refs;
89
90	struct ref_cache *loose;
91
92	struct ref_store *packed_ref_store;
93	};
94
95	static void clear_loose_ref_cache(struct files_ref_store *refs)
96	{
97	if (refs->loose) {
98	free_ref_cache(refs->loose);
99	refs->loose = NULL;
100	}
101	}
102
103	/*
104	* Create a new submodule ref cache and add it to the internal
105	* set of caches.
106	*/
107	static struct ref_store files_ref_store_init(struct repository repo,
108	const char *payload,
109	const char *gitdir,
110	const struct ref_store_init_options *opts)
111	{
112	struct files_ref_store refs = xcalloc(1, sizeof(refs));
113	struct ref_store ref_store = (struct ref_store )refs;
114	struct strbuf ref_common_dir = STRBUF_INIT;
115	struct strbuf refdir = STRBUF_INIT;
116	bool is_worktree;
117
118	refs_compute_filesystem_location(gitdir, payload, &is_worktree, &refdir,
119	&ref_common_dir);
120
121	base_ref_store_init(ref_store, repo, refdir.buf, &refs_be_files);
122
123	refs->gitcommondir = strbuf_detach(&ref_common_dir, NULL);
124	refs->packed_ref_store =
125	packed_ref_store_init(repo, NULL, refs->gitcommondir, opts);
126	refs->store_flags = opts->access_flags;
127	refs->log_all_ref_updates = opts->log_all_ref_updates;
128
129	repo_config_get_bool(repo, "core.prefersymlinkrefs", &refs->prefer_symlink_refs);
130
131	chdir_notify_reparent("files-backend $GIT_DIR", &refs->base.gitdir);
132	chdir_notify_reparent("files-backend $GIT_COMMONDIR",
133	&refs->gitcommondir);
134
135	strbuf_release(&refdir);
136
137	return ref_store;
138	}
139
140	/*
141	* Die if refs is not the main ref store. caller is used in any
142	* necessary error messages.
143	*/
144	static void files_assert_main_repository(struct files_ref_store *refs,
145	const char *caller)
146	{
147	if (refs->store_flags & REF_STORE_MAIN)
148	return;
149
150	BUG("operation %s only allowed for main ref store", caller);
151	}
152
153	/*
154	* Downcast ref_store to files_ref_store. Die if ref_store is not a
155	* files_ref_store. required_flags is compared with ref_store's
156	* store_flags to ensure the ref_store has all required capabilities.
157	* "caller" is used in any necessary error messages.
158	*/
159	static struct files_ref_store files_downcast(struct ref_store ref_store,
160	unsigned int required_flags,
161	const char *caller)
162	{
163	struct files_ref_store *refs;
164
165	if (ref_store->be != &refs_be_files)
166	BUG("ref_store is type \"%s\" not \"files\" in %s",
167	ref_store->be->name, caller);
168
169	refs = (struct files_ref_store *)ref_store;
170
171	if ((refs->store_flags & required_flags) != required_flags)
172	BUG("operation %s requires abilities 0x%x, but only have 0x%x",
173	caller, required_flags, refs->store_flags);
174
175	return refs;
176	}
177
178	static void files_ref_store_release(struct ref_store *ref_store)
179	{
180	struct files_ref_store *refs = files_downcast(ref_store, 0, "release");
181	free_ref_cache(refs->loose);
182	free(refs->gitcommondir);
183	ref_store_release(refs->packed_ref_store);
184	free(refs->packed_ref_store);
185	}
186
187	static void files_reflog_path(struct files_ref_store *refs,
188	struct strbuf *sb,
189	const char *refname)
190	{
191	const char *bare_refname;
192	const char *wtname;
193	int wtname_len;
194	enum ref_worktree_type wt_type = parse_worktree_ref(
195	refname, &wtname, &wtname_len, &bare_refname);
196
197	switch (wt_type) {
198	case REF_WORKTREE_CURRENT:
199	strbuf_addf(sb, "%s/logs/%s", refs->base.gitdir, refname);
200	break;
201	case REF_WORKTREE_SHARED:
202	case REF_WORKTREE_MAIN:
203	strbuf_addf(sb, "%s/logs/%s", refs->gitcommondir, bare_refname);
204	break;
205	case REF_WORKTREE_OTHER:
206	strbuf_addf(sb, "%s/worktrees/%.*s/logs/%s", refs->gitcommondir,
207	wtname_len, wtname, bare_refname);
208	break;
209	default:
210	BUG("unknown ref type %d of ref %s", wt_type, refname);
211	}
212	}
213
214	static void files_ref_path(struct files_ref_store *refs,
215	struct strbuf *sb,
216	const char *refname)
217	{
218	const char *bare_refname;
219	const char *wtname;
220	int wtname_len;
221	enum ref_worktree_type wt_type = parse_worktree_ref(
222	refname, &wtname, &wtname_len, &bare_refname);
223	switch (wt_type) {
224	case REF_WORKTREE_CURRENT:
225	strbuf_addf(sb, "%s/%s", refs->base.gitdir, refname);
226	break;
227	case REF_WORKTREE_OTHER:
228	strbuf_addf(sb, "%s/worktrees/%.*s/%s", refs->gitcommondir,
229	wtname_len, wtname, bare_refname);
230	break;
231	case REF_WORKTREE_SHARED:
232	case REF_WORKTREE_MAIN:
233	strbuf_addf(sb, "%s/%s", refs->gitcommondir, bare_refname);
234	break;
235	default:
236	BUG("unknown ref type %d of ref %s", wt_type, refname);
237	}
238	}
239
240	/*
241	* Manually add refs/bisect, refs/rewritten and refs/worktree, which, being
242	* per-worktree, might not appear in the directory listing for
243	* refs/ in the main repo.
244	*/
245	static void add_per_worktree_entries_to_dir(struct ref_dir dir, const char dirname)
246	{
247	const char *prefixes[] = { "refs/bisect/", "refs/worktree/", "refs/rewritten/" };
248	int ip;
249
250	if (strcmp(dirname, "refs/"))
251	return;
252
253	for (ip = 0; ip < ARRAY_SIZE(prefixes); ip++) {
254	const char *prefix = prefixes[ip];
255	int prefix_len = strlen(prefix);
256	struct ref_entry *child_entry;
257	int pos;
258
259	pos = search_ref_dir(dir, prefix, prefix_len);
260	if (pos >= 0)
261	continue;
262	child_entry = create_dir_entry(dir->cache, prefix, prefix_len);
263	add_entry_to_dir(dir, child_entry);
264	}
265	}
266
267	static void loose_fill_ref_dir_regular_file(struct files_ref_store *refs,
268	const char *refname,
269	struct ref_dir *dir)
270	{
271	struct object_id oid;
272	int flag;
273	const char *referent = refs_resolve_ref_unsafe(&refs->base,
274	refname,
275	RESOLVE_REF_READING,
276	&oid, &flag);
277
278	if (!referent) {
279	oidclr(&oid, refs->base.repo->hash_algo);
280	flag \|= REF_ISBROKEN;
281	} else if (is_null_oid(&oid)) {
282	/*
283	* It is so astronomically unlikely
284	* that null_oid is the OID of an
285	* actual object that we consider its
286	* appearance in a loose reference
287	* file to be repo corruption
288	* (probably due to a software bug).
289	*/
290	flag \|= REF_ISBROKEN;
291	}
292
293	if (check_refname_format(refname, REFNAME_ALLOW_ONELEVEL)) {
294	if (!refname_is_safe(refname))
295	die("loose refname is dangerous: %s", refname);
296	oidclr(&oid, refs->base.repo->hash_algo);
297	flag \|= REF_BAD_NAME \| REF_ISBROKEN;
298	}
299
300	if (!(flag & REF_ISSYMREF))
301	referent = NULL;
302
303	add_entry_to_dir(dir, create_ref_entry(refname, referent, &oid, flag));
304	}
305
306	/*
307	* Read the loose references from the namespace dirname into dir
308	* (without recursing). dirname must end with '/'. dir must be the
309	* directory entry corresponding to dirname.
310	*/
311	static void loose_fill_ref_dir(struct ref_store *ref_store,
312	struct ref_dir dir, const char dirname)
313	{
314	struct files_ref_store *refs =
315	files_downcast(ref_store, REF_STORE_READ, "fill_ref_dir");
316	DIR *d;
317	struct dirent *de;
318	int dirnamelen = strlen(dirname);
319	struct strbuf refname;
320	struct strbuf path = STRBUF_INIT;
321
322	files_ref_path(refs, &path, dirname);
323
324	d = opendir(path.buf);
325	if (!d) {
326	strbuf_release(&path);
327	return;
328	}
329
330	strbuf_init(&refname, dirnamelen + 257);
331	strbuf_add(&refname, dirname, dirnamelen);
332
333	while ((de = readdir(d)) != NULL) {
334	unsigned char dtype;
335
336	if (de->d_name[0] == '.')
337	continue;
338	if (ends_with(de->d_name, ".lock"))
339	continue;
340	strbuf_addstr(&refname, de->d_name);
341
342	dtype = get_dtype(de, &path, 1);
343	if (dtype == DT_DIR) {
344	strbuf_addch(&refname, '/');
345	add_entry_to_dir(dir,
346	create_dir_entry(dir->cache, refname.buf,
347	refname.len));
348	} else if (dtype == DT_REG) {
349	loose_fill_ref_dir_regular_file(refs, refname.buf, dir);
350	}
351	strbuf_setlen(&refname, dirnamelen);
352	}
353	strbuf_release(&refname);
354	strbuf_release(&path);
355	closedir(d);
356
357	add_per_worktree_entries_to_dir(dir, dirname);
358	}
359
360	static int for_each_root_ref(struct files_ref_store *refs,
361	int (cb)(const char refname, void *cb_data),
362	void *cb_data)
363	{
364	struct strbuf path = STRBUF_INIT, refname = STRBUF_INIT;
365	struct dirent *de;
366	int ret;
367	DIR *d;
368
369	files_ref_path(refs, &path, "");
370
371	d = opendir(path.buf);
372	if (!d) {
373	strbuf_release(&path);
374	return -1;
375	}
376
377	while ((de = readdir(d)) != NULL) {
378	unsigned char dtype;
379
380	if (de->d_name[0] == '.')
381	continue;
382	if (ends_with(de->d_name, ".lock"))
383	continue;
384
385	strbuf_reset(&refname);
386	strbuf_addstr(&refname, de->d_name);
387
388	dtype = get_dtype(de, &path, 1);
389	if (dtype == DT_REG && is_root_ref(de->d_name)) {
390	ret = cb(refname.buf, cb_data);
391	if (ret)
392	goto done;
393	}
394	}
395
396	ret = 0;
397
398	done:
399	strbuf_release(&refname);
400	strbuf_release(&path);
401	closedir(d);
402	return ret;
403	}
404
405	struct fill_root_ref_data {
406	struct files_ref_store *refs;
407	struct ref_dir *dir;
408	};
409
410	static int fill_root_ref(const char refname, void cb_data)
411	{
412	struct fill_root_ref_data *data = cb_data;
413	loose_fill_ref_dir_regular_file(data->refs, refname, data->dir);
414	return 0;
415	}
416
417	/*
418	* Add root refs to the ref dir by parsing the directory for any files which
419	* follow the root ref syntax.
420	*/
421	static void add_root_refs(struct files_ref_store *refs,
422	struct ref_dir *dir)
423	{
424	struct fill_root_ref_data data = {
425	.refs = refs,
426	.dir = dir,
427	};
428
429	for_each_root_ref(refs, fill_root_ref, &data);
430	}
431
432	static struct ref_cache get_loose_ref_cache(struct files_ref_store refs,
433	unsigned int flags)
434	{
435	if (!refs->loose) {
436	struct ref_dir *dir;
437
438	/*
439	* Mark the top-level directory complete because we
440	* are about to read the only subdirectory that can
441	* hold references:
442	*/
443	refs->loose = create_ref_cache(&refs->base, loose_fill_ref_dir);
444
445	/* We're going to fill the top level ourselves: */
446	refs->loose->root->flag &= ~REF_INCOMPLETE;
447
448	dir = get_ref_dir(refs->loose->root);
449
450	if (flags & REFS_FOR_EACH_INCLUDE_ROOT_REFS)
451	add_root_refs(refs, dir);
452
453	/*
454	* Add an incomplete entry for "refs/" (to be filled
455	* lazily):
456	*/
457	add_entry_to_dir(dir, create_dir_entry(refs->loose, "refs/", 5));
458	}
459	return refs->loose;
460	}
461
462	static int read_ref_internal(struct ref_store ref_store, const char refname,
463	struct object_id oid, struct strbuf referent,
464	unsigned int type, int failure_errno, int skip_packed_refs)
465	{
466	struct files_ref_store *refs =
467	files_downcast(ref_store, REF_STORE_READ, "read_raw_ref");
468	struct strbuf sb_contents = STRBUF_INIT;
469	struct strbuf sb_path = STRBUF_INIT;
470	const char *path;
471	const char *buf;
472	struct stat st;
473	int fd;
474	int ret = -1;
475	int remaining_retries = 3;
476	int myerr = 0;
477
478	*type = 0;
479	strbuf_reset(&sb_path);
480
481	files_ref_path(refs, &sb_path, refname);
482
483	path = sb_path.buf;
484
485	stat_ref:
486	/*
487	* We might have to loop back here to avoid a race
488	* condition: first we lstat() the file, then we try
489	* to read it as a link or as a file. But if somebody
490	* changes the type of the file (file <-> directory
491	* <-> symlink) between the lstat() and reading, then
492	* we don't want to report that as an error but rather
493	* try again starting with the lstat().
494	*
495	* We'll keep a count of the retries, though, just to avoid
496	* any confusing situation sending us into an infinite loop.
497	*/
498
499	if (remaining_retries-- <= 0)
500	goto out;
501
502	if (lstat(path, &st) < 0) {
503	int ignore_errno;
504	myerr = errno;
505	if (myerr != ENOENT \|\| skip_packed_refs)
506	goto out;
507	if (refs_read_raw_ref(refs->packed_ref_store, refname, oid,
508	referent, type, &ignore_errno)) {
509	myerr = ENOENT;
510	goto out;
511	}
512	ret = 0;
513	goto out;
514	}
515
516	/* Follow "normalized" - ie "refs/.." symlinks by hand */
517	if (S_ISLNK(st.st_mode)) {
518	strbuf_reset(&sb_contents);
519	if (strbuf_readlink(&sb_contents, path, st.st_size) < 0) {
520	myerr = errno;
521	if (myerr == ENOENT \|\| myerr == EINVAL)
522	/* inconsistent with lstat; retry */
523	goto stat_ref;
524	else
525	goto out;
526	}
527	if (starts_with(sb_contents.buf, "refs/") &&
528	!check_refname_format(sb_contents.buf, 0)) {
529	strbuf_swap(&sb_contents, referent);
530	*type \|= REF_ISSYMREF;
531	ret = 0;
532	goto out;
533	}
534	/*
535	* It doesn't look like a refname; fall through to just
536	* treating it like a non-symlink, and reading whatever it
537	* points to.
538	*/
539	}
540
541	/* Is it a directory? */
542	if (S_ISDIR(st.st_mode)) {
543	int ignore_errno;
544	/*
545	* Even though there is a directory where the loose
546	* ref is supposed to be, there could still be a
547	* packed ref:
548	*/
549	if (skip_packed_refs \|\|
550	refs_read_raw_ref(refs->packed_ref_store, refname, oid,
551	referent, type, &ignore_errno)) {
552	myerr = EISDIR;
553	goto out;
554	}
555	ret = 0;
556	goto out;
557	}
558
559	/*
560	* Anything else, just open it and try to use it as
561	* a ref
562	*/
563	fd = open(path, O_RDONLY);
564	if (fd < 0) {
565	myerr = errno;
566	if (myerr == ENOENT && !S_ISLNK(st.st_mode))
567	/* inconsistent with lstat; retry */
568	goto stat_ref;
569	else
570	goto out;
571	}
572	strbuf_reset(&sb_contents);
573	if (strbuf_read(&sb_contents, fd, 256) < 0) {
574	myerr = errno;
575	close(fd);
576	goto out;
577	}
578	close(fd);
579	strbuf_rtrim(&sb_contents);
580	buf = sb_contents.buf;
581
582	ret = parse_loose_ref_contents(ref_store->repo->hash_algo, buf,
583	oid, referent, type, NULL, &myerr);
584
585	out:
586	if (ret && !myerr)
587	BUG("returning non-zero %d, should have set myerr!", ret);
588	*failure_errno = myerr;
589
590	strbuf_release(&sb_path);
591	strbuf_release(&sb_contents);
592	errno = 0;
593	return ret;
594	}
595
596	static int files_read_raw_ref(struct ref_store ref_store, const char refname,
597	struct object_id oid, struct strbuf referent,
598	unsigned int type, int failure_errno)
599	{
600	return read_ref_internal(ref_store, refname, oid, referent, type, failure_errno, 0);
601	}
602
603	static int files_read_symbolic_ref(struct ref_store ref_store, const char refname,
604	struct strbuf *referent)
605	{
606	struct object_id oid;
607	int failure_errno, ret;
608	unsigned int type;
609
610	ret = read_ref_internal(ref_store, refname, &oid, referent, &type, &failure_errno, 1);
611	if (!ret && !(type & REF_ISSYMREF))
612	return NOT_A_SYMREF;
613	return ret;
614	}
615
616	int parse_loose_ref_contents(const struct git_hash_algo *algop,
617	const char buf, struct object_id oid,
618	struct strbuf referent, unsigned int type,
619	const char *trailing, int failure_errno)
620	{
621	const char *p;
622	if (skip_prefix(buf, "ref:", &buf)) {
623	while (isspace(*buf))
624	buf++;
625
626	strbuf_reset(referent);
627	strbuf_addstr(referent, buf);
628	*type \|= REF_ISSYMREF;
629	return 0;
630	}
631
632	/*
633	* FETCH_HEAD has additional data after the sha.
634	*/
635	if (parse_oid_hex_algop(buf, oid, &p, algop) \|\|
636	(p != '\0' && !isspace(p))) {
637	*type \|= REF_ISBROKEN;
638	*failure_errno = EINVAL;
639	return -1;
640	}
641
642	if (trailing)
643	*trailing = p;
644
645	return 0;
646	}
647
648	static void unlock_ref(struct ref_lock *lock)
649	{
650	lock->count--;
651	if (!lock->count) {
652	rollback_lock_file(&lock->lk);
653	free(lock->ref_name);
654	free(lock);
655	}
656	}
657
658	/*
659	* Check if the transaction has another update with a case-insensitive refname
660	* match.
661	*
662	* If the update is part of the transaction, we only check up to that index.
663	* Further updates are expected to call this function to match previous indices.
664	*/
665	static bool transaction_has_case_conflicting_update(struct ref_transaction *transaction,
666	struct ref_update *update)
667	{
668	for (size_t i = 0; i < transaction->nr; i++) {
669	if (transaction->updates[i] == update)
670	break;
671
672	if (!strcasecmp(transaction->updates[i]->refname, update->refname))
673	return true;
674	}
675	return false;
676	}
677
678	/*
679	* Lock refname, without following symrefs, and set *lock_p to point
680	* at a newly-allocated lock object. Fill in lock->old_oid, referent,
681	* and type similarly to read_raw_ref().
682	*
683	* The caller must verify that refname is a "safe" reference name (in
684	* the sense of refname_is_safe()) before calling this function.
685	*
686	* If the reference doesn't already exist, verify that refname doesn't
687	* have a D/F conflict with any existing references. extras and skip
688	* are passed to refs_verify_refname_available() for this check.
689	*
690	* If mustexist is not set and the reference is not found or is
691	* broken, lock the reference anyway but clear old_oid.
692	*
693	* Return 0 on success. On failure, write an error message to err and
694	* return REF_TRANSACTION_ERROR_NAME_CONFLICT or REF_TRANSACTION_ERROR_GENERIC.
695	*
696	* Implementation note: This function is basically
697	*
698	* lock reference
699	* read_raw_ref()
700	*
701	* but it includes a lot more code to
702	* - Deal with possible races with other processes
703	* - Avoid calling refs_verify_refname_available() when it can be
704	* avoided, namely if we were successfully able to read the ref
705	* - Generate informative error messages in the case of failure
706	*/
707	static enum ref_transaction_error lock_raw_ref(struct files_ref_store *refs,
708	struct ref_transaction *transaction,
709	size_t update_idx,
710	int mustexist,
711	struct string_list *refnames_to_check,
712	struct ref_lock **lock_p,
713	struct strbuf *referent,
714	struct strbuf *err)
715	{
716	enum ref_transaction_error ret = REF_TRANSACTION_ERROR_GENERIC;
717	struct ref_update *update = transaction->updates[update_idx];
718	const struct string_list *extras = &transaction->refnames;
719	const char *refname = update->refname;
720	unsigned int *type = &update->type;
721	struct ref_lock *lock;
722	struct strbuf ref_file = STRBUF_INIT;
723	int attempts_remaining = 3;
724	int failure_errno;
725
726	assert(err);
727	files_assert_main_repository(refs, "lock_raw_ref");
728
729	*type = 0;
730
731	/* First lock the file so it can't change out from under us. */
732
733	*lock_p = CALLOC_ARRAY(lock, 1);
734
735	lock->ref_name = xstrdup(refname);
736	lock->count = 1;
737	files_ref_path(refs, &ref_file, refname);
738
739	retry:
740	switch (safe_create_leading_directories(the_repository, ref_file.buf)) {
741	case SCLD_OK:
742	break; /* success */
743	case SCLD_EXISTS:
744	/*
745	* Suppose refname is "refs/foo/bar". We just failed
746	* to create the containing directory, "refs/foo",
747	* because there was a non-directory in the way. This
748	* indicates a D/F conflict, probably because of
749	* another reference such as "refs/foo". There is no
750	* reason to expect this error to be transitory.
751	*/
752	if (refs_verify_refname_available(&refs->base, refname,
753	extras, NULL, 0, err)) {
754	if (mustexist) {
755	/*
756	* To the user the relevant error is
757	* that the "mustexist" reference is
758	* missing:
759	*/
760	strbuf_reset(err);
761	strbuf_addf(err, "unable to resolve reference '%s'",
762	refname);
763	ret = REF_TRANSACTION_ERROR_NONEXISTENT_REF;
764	} else {
765	/*
766	* The error message set by
767	* refs_verify_refname_available() is
768	* OK.
769	*/
770	ret = REF_TRANSACTION_ERROR_NAME_CONFLICT;
771	}
772	} else {
773	/*
774	* The file that is in the way isn't a loose
775	* reference. Report it as a low-level
776	* failure.
777	*/
778	strbuf_addf(err, "unable to create lock file %s.lock; "
779	"non-directory in the way",
780	ref_file.buf);
781	}
782	goto error_return;
783	case SCLD_VANISHED:
784	/* Maybe another process was tidying up. Try again. */
785	if (--attempts_remaining > 0)
786	goto retry;
787	/* fall through */
788	default:
789	strbuf_addf(err, "unable to create directory for %s",
790	ref_file.buf);
791	goto error_return;
792	}
793
794	if (hold_lock_file_for_update_timeout(
795	&lock->lk, ref_file.buf, LOCK_NO_DEREF,
796	get_files_ref_lock_timeout_ms(transaction->ref_store->repo)) < 0) {
797	int myerr = errno;
798	errno = 0;
799	if (myerr == ENOENT && --attempts_remaining > 0) {
800	/*
801	* Maybe somebody just deleted one of the
802	* directories leading to ref_file. Try
803	* again:
804	*/
805	goto retry;
806	} else {
807	unable_to_lock_message(ref_file.buf, myerr, err);
808	if (myerr == EEXIST) {
809	if (ignore_case &&
810	transaction_has_case_conflicting_update(transaction, update)) {
811	/*
812	* In case-insensitive filesystems, ensure that conflicts within a
813	* given transaction are handled. Pre-existing refs on a
814	* case-insensitive system will be overridden without any issue.
815	*/
816	ret = REF_TRANSACTION_ERROR_CASE_CONFLICT;
817	} else {
818	/*
819	* Pre-existing case-conflicting reference locks should also be
820	* specially categorized to avoid failing all batched updates.
821	*/
822	ret = REF_TRANSACTION_ERROR_CREATE_EXISTS;
823	}
824	}
825
826	goto error_return;
827	}
828	}
829
830	/*
831	* Now we hold the lock and can read the reference without
832	* fear that its value will change.
833	*/
834
835	if (files_read_raw_ref(&refs->base, refname, &lock->old_oid, referent,
836	type, &failure_errno)) {
837	struct string_list_item *item;
838
839	if (failure_errno == ENOENT) {
840	if (mustexist) {
841	/* Garden variety missing reference. */
842	strbuf_addf(err, "unable to resolve reference '%s'",
843	refname);
844	ret = REF_TRANSACTION_ERROR_NONEXISTENT_REF;
845	goto error_return;
846	} else {
847	/*
848	* Reference is missing, but that's OK. We
849	* know that there is not a conflict with
850	* another loose reference because
851	* (supposing that we are trying to lock
852	* reference "refs/foo/bar"):
853	*
854	* - We were successfully able to create
855	* the lockfile refs/foo/bar.lock, so we
856	* know there cannot be a loose reference
857	* named "refs/foo".
858	*
859	* - We got ENOENT and not EISDIR, so we
860	* know that there cannot be a loose
861	* reference named "refs/foo/bar/baz".
862	*/
863	}
864	} else if (failure_errno == EISDIR) {
865	/*
866	* There is a directory in the way. It might have
867	* contained references that have been deleted. If
868	* we don't require that the reference already
869	* exists, try to remove the directory so that it
870	* doesn't cause trouble when we want to rename the
871	* lockfile into place later.
872	*/
873	if (mustexist) {
874	/* Garden variety missing reference. */
875	strbuf_addf(err, "unable to resolve reference '%s'",
876	refname);
877	ret = REF_TRANSACTION_ERROR_NONEXISTENT_REF;
878	goto error_return;
879	} else if (remove_dir_recursively(&ref_file,
880	REMOVE_DIR_EMPTY_ONLY)) {
881	ret = REF_TRANSACTION_ERROR_NAME_CONFLICT;
882	if (refs_verify_refname_available(
883	&refs->base, refname,
884	extras, NULL, 0, err)) {
885	/*
886	* The error message set by
887	* verify_refname_available() is OK.
888	*/
889	goto error_return;
890	} else {
891	/*
892	* Directory conflicts can occur if there
893	* is an existing lock file in the directory
894	* or if the filesystem is case-insensitive
895	* and the directory contains a valid reference
896	* but conflicts with the update.
897	*/
898	strbuf_addf(err, "there is a non-empty directory '%s' "
899	"blocking reference '%s'",
900	ref_file.buf, refname);
901	goto error_return;
902	}
903	}
904	} else if (failure_errno == EINVAL && (*type & REF_ISBROKEN)) {
905	strbuf_addf(err, "unable to resolve reference '%s': "
906	"reference broken", refname);
907	goto error_return;
908	} else {
909	strbuf_addf(err, "unable to resolve reference '%s': %s",
910	refname, strerror(failure_errno));
911	goto error_return;
912	}
913
914	/*
915	* If the ref did not exist and we are creating it, we have to
916	* make sure there is no existing packed ref that conflicts
917	* with refname. This check is deferred so that we can batch it.
918	*
919	* For case-insensitive filesystems, we should also check for F/D
920	* conflicts between 'foo' and 'Foo/bar'. So let's lowercase
921	* the refname.
922	*/
923	if (ignore_case) {
924	struct strbuf lower = STRBUF_INIT;
925
926	strbuf_addstr(&lower, refname);
927	strbuf_tolower(&lower);
928
929	item = string_list_append_nodup(refnames_to_check,
930	strbuf_detach(&lower, NULL));
931	} else {
932	item = string_list_append(refnames_to_check, refname);
933	}
934
935	item->util = xmalloc(sizeof(update_idx));
936	memcpy(item->util, &update_idx, sizeof(update_idx));
937	}
938
939	ret = 0;
940	goto out;
941
942	error_return:
943	unlock_ref(lock);
944	*lock_p = NULL;
945
946	out:
947	strbuf_release(&ref_file);
948	return ret;
949	}
950
951	struct files_ref_iterator {
952	struct ref_iterator base;
953
954	struct ref_iterator *iter0;
955	struct repository *repo;
956	unsigned int flags;
957	};
958
959	static int files_ref_iterator_advance(struct ref_iterator *ref_iterator)
960	{
961	struct files_ref_iterator *iter =
962	(struct files_ref_iterator *)ref_iterator;
963	int ok;
964
965	while ((ok = ref_iterator_advance(iter->iter0)) == ITER_OK) {
966	if (iter->flags & REFS_FOR_EACH_PER_WORKTREE_ONLY &&
967	parse_worktree_ref(iter->iter0->ref.name, NULL, NULL,
968	NULL) != REF_WORKTREE_CURRENT)
969	continue;
970
971	if ((iter->flags & REFS_FOR_EACH_OMIT_DANGLING_SYMREFS) &&
972	(iter->iter0->ref.flags & REF_ISSYMREF) &&
973	(iter->iter0->ref.flags & REF_ISBROKEN))
974	continue;
975
976	if (!(iter->flags & REFS_FOR_EACH_INCLUDE_BROKEN) &&
977	!ref_resolves_to_object(iter->iter0->ref.name,
978	iter->repo,
979	iter->iter0->ref.oid,
980	iter->iter0->ref.flags))
981	continue;
982
983	iter->base.ref = iter->iter0->ref;
984
985	return ITER_OK;
986	}
987
988	return ok;
989	}
990
991	static int files_ref_iterator_seek(struct ref_iterator *ref_iterator,
992	const char *refname, unsigned int flags)
993	{
994	struct files_ref_iterator *iter =
995	(struct files_ref_iterator *)ref_iterator;
996	return ref_iterator_seek(iter->iter0, refname, flags);
997	}
998
999	static void files_ref_iterator_release(struct ref_iterator *ref_iterator)
1000	{
1001	struct files_ref_iterator *iter =
1002	(struct files_ref_iterator *)ref_iterator;
1003	ref_iterator_free(iter->iter0);
1004	}
1005
1006	static struct ref_iterator_vtable files_ref_iterator_vtable = {
1007	.advance = files_ref_iterator_advance,
1008	.seek = files_ref_iterator_seek,
1009	.release = files_ref_iterator_release,
1010	};
1011
1012	static struct ref_iterator *files_ref_iterator_begin(
1013	struct ref_store *ref_store,
1014	const char prefix, const char *exclude_patterns,
1015	unsigned int flags)
1016	{
1017	struct files_ref_store *refs;
1018	struct ref_iterator loose_iter, packed_iter, *overlay_iter;
1019	struct files_ref_iterator *iter;
1020	struct ref_iterator *ref_iterator;
1021	unsigned int required_flags = REF_STORE_READ;
1022
1023	if (!(flags & REFS_FOR_EACH_INCLUDE_BROKEN))
1024	required_flags \|= REF_STORE_ODB;
1025
1026	refs = files_downcast(ref_store, required_flags, "ref_iterator_begin");
1027
1028	/*
1029	* We must make sure that all loose refs are read before
1030	* accessing the packed-refs file; this avoids a race
1031	* condition if loose refs are migrated to the packed-refs
1032	* file by a simultaneous process, but our in-memory view is
1033	* from before the migration. We ensure this as follows:
1034	* First, we call start the loose refs iteration with its
1035	* `prime_ref` argument set to true. This causes the loose
1036	* references in the subtree to be pre-read into the cache.
1037	* (If they've already been read, that's OK; we only need to
1038	* guarantee that they're read before the packed refs, not
1039	* how much before.) After that, we call
1040	* packed_ref_iterator_begin(), which internally checks
1041	* whether the packed-ref cache is up to date with what is on
1042	* disk, and re-reads it if not.
1043	*/
1044
1045	loose_iter = cache_ref_iterator_begin(get_loose_ref_cache(refs, flags),
1046	prefix, ref_store->repo, 1);
1047
1048	/*
1049	* The packed-refs file might contain broken references, for
1050	* example an old version of a reference that points at an
1051	* object that has since been garbage-collected. This is OK as
1052	* long as there is a corresponding loose reference that
1053	* overrides it, and we don't want to emit an error message in
1054	* this case. So ask the packed_ref_store for all of its
1055	* references, and (if needed) do our own check for broken
1056	* ones in files_ref_iterator_advance(), after we have merged
1057	* the packed and loose references.
1058	*/
1059	packed_iter = refs_ref_iterator_begin(
1060	refs->packed_ref_store, prefix, exclude_patterns, 0,
1061	REFS_FOR_EACH_INCLUDE_BROKEN);
1062
1063	overlay_iter = overlay_ref_iterator_begin(loose_iter, packed_iter);
1064
1065	CALLOC_ARRAY(iter, 1);
1066	ref_iterator = &iter->base;
1067	base_ref_iterator_init(ref_iterator, &files_ref_iterator_vtable);
1068	iter->iter0 = overlay_iter;
1069	iter->repo = ref_store->repo;
1070	iter->flags = flags;
1071
1072	return ref_iterator;
1073	}
1074
1075	/*
1076	* Callback function for raceproof_create_file(). This function is
1077	* expected to do something that makes dirname(path) permanent despite
1078	* the fact that other processes might be cleaning up empty
1079	* directories at the same time. Usually it will create a file named
1080	* path, but alternatively it could create another file in that
1081	* directory, or even chdir() into that directory. The function should
1082	* return 0 if the action was completed successfully. On error, it
1083	* should return a nonzero result and set errno.
1084	* raceproof_create_file() treats two errno values specially:
1085	*
1086	* - ENOENT -- dirname(path) does not exist. In this case,
1087	* raceproof_create_file() tries creating dirname(path)
1088	* (and any parent directories, if necessary) and calls
1089	* the function again.
1090	*
1091	* - EISDIR -- the file already exists and is a directory. In this
1092	* case, raceproof_create_file() removes the directory if
1093	* it is empty (and recursively any empty directories that
1094	* it contains) and calls the function again.
1095	*
1096	* Any other errno causes raceproof_create_file() to fail with the
1097	* callback's return value and errno.
1098	*
1099	* Obviously, this function should be OK with being called again if it
1100	* fails with ENOENT or EISDIR. In other scenarios it will not be
1101	* called again.
1102	*/
1103	typedef int create_file_fn(const char path, void cb);
1104
1105	/*
1106	* Create a file in dirname(path) by calling fn, creating leading
1107	* directories if necessary. Retry a few times in case we are racing
1108	* with another process that is trying to clean up the directory that
1109	* contains path. See the documentation for create_file_fn for more
1110	* details.
1111	*
1112	* Return the value and set the errno that resulted from the most
1113	* recent call of fn. fn is always called at least once, and will be
1114	* called more than once if it returns ENOENT or EISDIR.
1115	*/
1116	static int raceproof_create_file(const char path, create_file_fn fn, void cb)
1117	{
1118	/*
1119	* The number of times we will try to remove empty directories
1120	* in the way of path. This is only 1 because if another
1121	* process is racily creating directories that conflict with
1122	* us, we don't want to fight against them.
1123	*/
1124	int remove_directories_remaining = 1;
1125
1126	/*
1127	* The number of times that we will try to create the
1128	* directories containing path. We are willing to attempt this
1129	* more than once, because another process could be trying to
1130	* clean up empty directories at the same time as we are
1131	* trying to create them.
1132	*/
1133	int create_directories_remaining = 3;
1134
1135	/* A scratch copy of path, filled lazily if we need it: */
1136	struct strbuf path_copy = STRBUF_INIT;
1137
1138	int ret, save_errno;
1139
1140	/* Sanity check: */
1141	assert(*path);
1142
1143	retry_fn:
1144	ret = fn(path, cb);
1145	save_errno = errno;
1146	if (!ret)
1147	goto out;
1148
1149	if (errno == EISDIR && remove_directories_remaining-- > 0) {
1150	/*
1151	* A directory is in the way. Maybe it is empty; try
1152	* to remove it:
1153	*/
1154	if (!path_copy.len)
1155	strbuf_addstr(&path_copy, path);
1156
1157	if (!remove_dir_recursively(&path_copy, REMOVE_DIR_EMPTY_ONLY))
1158	goto retry_fn;
1159	} else if (errno == ENOENT && create_directories_remaining-- > 0) {
1160	/*
1161	* Maybe the containing directory didn't exist, or
1162	* maybe it was just deleted by a process that is
1163	* racing with us to clean up empty directories. Try
1164	* to create it:
1165	*/
1166	enum scld_error scld_result;
1167
1168	if (!path_copy.len)
1169	strbuf_addstr(&path_copy, path);
1170
1171	do {
1172	scld_result = safe_create_leading_directories(the_repository, path_copy.buf);
1173	if (scld_result == SCLD_OK)
1174	goto retry_fn;
1175	} while (scld_result == SCLD_VANISHED && create_directories_remaining-- > 0);
1176	}
1177
1178	out:
1179	strbuf_release(&path_copy);
1180	errno = save_errno;
1181	return ret;
1182	}
1183
1184	static int remove_empty_directories(struct strbuf *path)
1185	{
1186	/*
1187	* we want to create a file but there is a directory there;
1188	* if that is an empty directory (or a directory that contains
1189	* only empty directories), remove them.
1190	*/
1191	return remove_dir_recursively(path, REMOVE_DIR_EMPTY_ONLY);
1192	}
1193
1194	struct create_reflock_cb {
1195	struct lock_file *lk;
1196	struct repository *repo;
1197	};
1198
1199	static int create_reflock(const char path, void cb)
1200	{
1201	struct create_reflock_cb *data = cb;
1202	return hold_lock_file_for_update_timeout(
1203	data->lk, path, LOCK_NO_DEREF,
1204	get_files_ref_lock_timeout_ms(data->repo)) < 0 ? -1 : 0;
1205	}
1206
1207	/*
1208	* Locks a ref returning the lock on success and NULL on failure.
1209	*/
1210	static struct ref_lock lock_ref_oid_basic(struct files_ref_store refs,
1211	const char *refname,
1212	struct strbuf *err)
1213	{
1214	struct strbuf ref_file = STRBUF_INIT;
1215	struct ref_lock *lock;
1216	struct create_reflock_cb cb_data;
1217
1218	files_assert_main_repository(refs, "lock_ref_oid_basic");
1219	assert(err);
1220
1221	CALLOC_ARRAY(lock, 1);
1222
1223	files_ref_path(refs, &ref_file, refname);
1224
1225	/*
1226	* If the ref did not exist and we are creating it, make sure
1227	* there is no existing packed ref whose name begins with our
1228	* refname, nor a packed ref whose name is a proper prefix of
1229	* our refname.
1230	*/
1231	if (is_null_oid(&lock->old_oid) &&
1232	refs_verify_refname_available(refs->packed_ref_store, refname,
1233	NULL, NULL, 0, err))
1234	goto error_return;
1235
1236	lock->ref_name = xstrdup(refname);
1237	lock->count = 1;
1238	cb_data.lk = &lock->lk;
1239	cb_data.repo = refs->base.repo;
1240
1241	if (raceproof_create_file(ref_file.buf, create_reflock, &cb_data)) {
1242	unable_to_lock_message(ref_file.buf, errno, err);
1243	goto error_return;
1244	}
1245
1246	if (!refs_resolve_ref_unsafe(&refs->base, lock->ref_name, 0,
1247	&lock->old_oid, NULL))
1248	oidclr(&lock->old_oid, refs->base.repo->hash_algo);
1249	goto out;
1250
1251	error_return:
1252	unlock_ref(lock);
1253	lock = NULL;
1254
1255	out:
1256	strbuf_release(&ref_file);
1257	return lock;
1258	}
1259
1260	struct ref_to_prune {
1261	struct ref_to_prune *next;
1262	struct object_id oid;
1263	char name[FLEX_ARRAY];
1264	};
1265
1266	enum {
1267	REMOVE_EMPTY_PARENTS_REF = 0x01,
1268	REMOVE_EMPTY_PARENTS_REFLOG = 0x02
1269	};
1270
1271	/*
1272	* Remove empty parent directories associated with the specified
1273	* reference and/or its reflog, but spare [logs/]refs/ and immediate
1274	* subdirs. flags is a combination of REMOVE_EMPTY_PARENTS_REF and/or
1275	* REMOVE_EMPTY_PARENTS_REFLOG.
1276	*/
1277	static void try_remove_empty_parents(struct files_ref_store *refs,
1278	const char *refname,
1279	unsigned int flags)
1280	{
1281	struct strbuf buf = STRBUF_INIT;
1282	struct strbuf sb = STRBUF_INIT;
1283	char p, q;
1284	int i;
1285
1286	strbuf_addstr(&buf, refname);
1287	p = buf.buf;
1288	for (i = 0; i < 2; i++) { /* refs/{heads,tags,...}/ */
1289	while (p && p != '/')
1290	p++;
1291	/* tolerate duplicate slashes; see check_refname_format() */
1292	while (*p == '/')
1293	p++;
1294	}
1295	q = buf.buf + buf.len;
1296	while (flags & (REMOVE_EMPTY_PARENTS_REF \| REMOVE_EMPTY_PARENTS_REFLOG)) {
1297	while (q > p && *q != '/')
1298	q--;
1299	while (q > p && *(q-1) == '/')
1300	q--;
1301	if (q == p)
1302	break;
1303	strbuf_setlen(&buf, q - buf.buf);
1304
1305	strbuf_reset(&sb);
1306	files_ref_path(refs, &sb, buf.buf);
1307	if ((flags & REMOVE_EMPTY_PARENTS_REF) && rmdir(sb.buf))
1308	flags &= ~REMOVE_EMPTY_PARENTS_REF;
1309
1310	strbuf_reset(&sb);
1311	files_reflog_path(refs, &sb, buf.buf);
1312	if ((flags & REMOVE_EMPTY_PARENTS_REFLOG) && rmdir(sb.buf))
1313	flags &= ~REMOVE_EMPTY_PARENTS_REFLOG;
1314	}
1315	strbuf_release(&buf);
1316	strbuf_release(&sb);
1317	}
1318
1319	/* make sure nobody touched the ref, and unlink */
1320	static void prune_ref(struct files_ref_store refs, struct ref_to_prune r)
1321	{
1322	struct ref_transaction *transaction;
1323	struct strbuf err = STRBUF_INIT;
1324	int ret = -1;
1325
1326	if (check_refname_format(r->name, 0))
1327	return;
1328
1329	transaction = ref_store_transaction_begin(&refs->base, 0, &err);
1330	if (!transaction)
1331	goto cleanup;
1332	ref_transaction_add_update(
1333	transaction, r->name,
1334	REF_NO_DEREF \| REF_HAVE_NEW \| REF_HAVE_OLD \| REF_IS_PRUNING,
1335	null_oid(the_hash_algo), &r->oid, NULL, NULL, NULL,
1336	NULL, NULL);
1337	if (ref_transaction_commit(transaction, &err))
1338	goto cleanup;
1339
1340	ret = 0;
1341
1342	cleanup:
1343	if (ret)
1344	error("%s", err.buf);
1345	strbuf_release(&err);
1346	ref_transaction_free(transaction);
1347	return;
1348	}
1349
1350	/*
1351	* Prune the loose versions of the references in the linked list
1352	* `*refs_to_prune`, freeing the entries in the list as we go.
1353	*/
1354	static void prune_refs(struct files_ref_store refs, struct ref_to_prune *refs_to_prune)
1355	{
1356	while (*refs_to_prune) {
1357	struct ref_to_prune r = refs_to_prune;
1358	*refs_to_prune = r->next;
1359	prune_ref(refs, r);
1360	free(r);
1361	}
1362	}
1363
1364	/*
1365	* Return true if the specified reference should be packed.
1366	*/
1367	static int should_pack_ref(struct files_ref_store *refs,
1368	const struct reference *ref,
1369	struct refs_optimize_opts *opts)
1370	{
1371	struct string_list_item *item;
1372
1373	/* Do not pack per-worktree refs: */
1374	if (parse_worktree_ref(ref->name, NULL, NULL, NULL) !=
1375	REF_WORKTREE_SHARED)
1376	return 0;
1377
1378	/* Do not pack symbolic refs: */
1379	if (ref->flags & REF_ISSYMREF)
1380	return 0;
1381
1382	/* Do not pack broken refs: */
1383	if (!ref_resolves_to_object(ref->name, refs->base.repo, ref->oid, ref->flags))
1384	return 0;
1385
1386	if (ref_excluded(opts->exclusions, ref->name))
1387	return 0;
1388
1389	for_each_string_list_item(item, opts->includes)
1390	if (!wildmatch(item->string, ref->name, 0))
1391	return 1;
1392
1393	return 0;
1394	}
1395
1396	static int should_pack_refs(struct files_ref_store *refs,
1397	struct refs_optimize_opts *opts)
1398	{
1399	struct ref_iterator *iter;
1400	size_t packed_size;
1401	size_t refcount = 0;
1402	size_t limit;
1403	int ret;
1404
1405	if (!(opts->flags & REFS_OPTIMIZE_AUTO))
1406	return 1;
1407
1408	ret = packed_refs_size(refs->packed_ref_store, &packed_size);
1409	if (ret < 0)
1410	die("cannot determine packed-refs size");
1411
1412	/*
1413	* Packing loose references into the packed-refs file scales with the
1414	* number of references we're about to write. We thus decide whether we
1415	* repack refs by weighing the current size of the packed-refs file
1416	* against the number of loose references. This is done such that we do
1417	* not repack too often on repositories with a huge number of
1418	* references, where we can expect a lot of churn in the number of
1419	* references.
1420	*
1421	* As a heuristic, we repack if the number of loose references in the
1422	* repository exceeds `log2(nr_packed_refs) * 5`, where we estimate
1423	* `nr_packed_refs = packed_size / 100`, which scales as following:
1424	*
1425	* - 1kB ~ 10 packed refs: 16 refs
1426	* - 10kB ~ 100 packed refs: 33 refs
1427	* - 100kB ~ 1k packed refs: 49 refs
1428	* - 1MB ~ 10k packed refs: 66 refs
1429	* - 10MB ~ 100k packed refs: 82 refs
1430	* - 100MB ~ 1m packed refs: 99 refs
1431	*
1432	* We thus allow roughly 16 additional loose refs per factor of ten of
1433	* packed refs. This heuristic may be tweaked in the future, but should
1434	* serve as a sufficiently good first iteration.
1435	*/
1436	limit = log2u(packed_size / 100) * 5;
1437	if (limit < 16)
1438	limit = 16;
1439
1440	iter = cache_ref_iterator_begin(get_loose_ref_cache(refs, 0), NULL,
1441	refs->base.repo, 0);
1442	while ((ret = ref_iterator_advance(iter)) == ITER_OK) {
1443	if (should_pack_ref(refs, &iter->ref, opts))
1444	refcount++;
1445	if (refcount >= limit) {
1446	ref_iterator_free(iter);
1447	return 1;
1448	}
1449	}
1450
1451	if (ret != ITER_DONE)
1452	die("error while iterating over references");
1453
1454	ref_iterator_free(iter);
1455	return 0;
1456	}
1457
1458	static int files_optimize(struct ref_store *ref_store,
1459	struct refs_optimize_opts *opts)
1460	{
1461	struct files_ref_store *refs =
1462	files_downcast(ref_store, REF_STORE_WRITE \| REF_STORE_ODB,
1463	"pack_refs");
1464	struct ref_iterator *iter;
1465	int ok;
1466	struct ref_to_prune *refs_to_prune = NULL;
1467	struct strbuf err = STRBUF_INIT;
1468	struct ref_transaction *transaction;
1469
1470	if (!should_pack_refs(refs, opts))
1471	return 0;
1472
1473	transaction = ref_store_transaction_begin(refs->packed_ref_store,
1474	0, &err);
1475	if (!transaction)
1476	return -1;
1477
1478	packed_refs_lock(refs->packed_ref_store, LOCK_DIE_ON_ERROR, &err);
1479
1480	iter = cache_ref_iterator_begin(get_loose_ref_cache(refs, 0), NULL,
1481	refs->base.repo, 0);
1482	while ((ok = ref_iterator_advance(iter)) == ITER_OK) {
1483	/*
1484	* If the loose reference can be packed, add an entry
1485	* in the packed ref cache. If the reference should be
1486	* pruned, also add it to refs_to_prune.
1487	*/
1488	if (!should_pack_ref(refs, &iter->ref, opts))
1489	continue;
1490
1491	/*
1492	* Add a reference creation for this reference to the
1493	* packed-refs transaction:
1494	*/
1495	if (ref_transaction_update(transaction, iter->ref.name,
1496	iter->ref.oid, NULL, NULL, NULL,
1497	REF_NO_DEREF, NULL, &err))
1498	die("failure preparing to create packed reference %s: %s",
1499	iter->ref.name, err.buf);
1500
1501	/* Schedule the loose reference for pruning if requested. */
1502	if ((opts->flags & REFS_OPTIMIZE_PRUNE)) {
1503	struct ref_to_prune *n;
1504	FLEX_ALLOC_STR(n, name, iter->ref.name);
1505	oidcpy(&n->oid, iter->ref.oid);
1506	n->next = refs_to_prune;
1507	refs_to_prune = n;
1508	}
1509	}
1510	if (ok != ITER_DONE)
1511	die("error while iterating over references");
1512
1513	if (ref_transaction_commit(transaction, &err))
1514	die("unable to write new packed-refs: %s", err.buf);
1515
1516	ref_transaction_free(transaction);
1517
1518	packed_refs_unlock(refs->packed_ref_store);
1519
1520	prune_refs(refs, &refs_to_prune);
1521	ref_iterator_free(iter);
1522	strbuf_release(&err);
1523	return 0;
1524	}
1525
1526	static int files_optimize_required(struct ref_store *ref_store,
1527	struct refs_optimize_opts *opts,
1528	bool *required)
1529	{
1530	struct files_ref_store *refs = files_downcast(ref_store, REF_STORE_READ,
1531	"optimize_required");
1532	*required = should_pack_refs(refs, opts);
1533	return 0;
1534	}
1535
1536	/*
1537	* People using contrib's git-new-workdir have .git/logs/refs ->
1538	* /some/other/path/.git/logs/refs, and that may live on another device.
1539	*
1540	* IOW, to avoid cross device rename errors, the temporary renamed log must
1541	* live into logs/refs.
1542	*/
1543	#define TMP_RENAMED_LOG "refs/.tmp-renamed-log"
1544
1545	struct rename_cb {
1546	const char *tmp_renamed_log;
1547	int true_errno;
1548	};
1549
1550	static int rename_tmp_log_callback(const char path, void cb_data)
1551	{
1552	struct rename_cb *cb = cb_data;
1553
1554	if (rename(cb->tmp_renamed_log, path)) {
1555	/*
1556	* rename(a, b) when b is an existing directory ought
1557	* to result in ISDIR, but Solaris 5.8 gives ENOTDIR.
1558	* Sheesh. Record the true errno for error reporting,
1559	* but report EISDIR to raceproof_create_file() so
1560	* that it knows to retry.
1561	*/
1562	cb->true_errno = errno;
1563	if (errno == ENOTDIR)
1564	errno = EISDIR;
1565	return -1;
1566	} else {
1567	return 0;
1568	}
1569	}
1570
1571	static int rename_tmp_log(struct files_ref_store refs, const char newrefname)
1572	{
1573	struct strbuf path = STRBUF_INIT;
1574	struct strbuf tmp = STRBUF_INIT;
1575	struct rename_cb cb;
1576	int ret;
1577
1578	files_reflog_path(refs, &path, newrefname);
1579	files_reflog_path(refs, &tmp, TMP_RENAMED_LOG);
1580	cb.tmp_renamed_log = tmp.buf;
1581	ret = raceproof_create_file(path.buf, rename_tmp_log_callback, &cb);
1582	if (ret) {
1583	if (errno == EISDIR)
1584	error("directory not empty: %s", path.buf);
1585	else
1586	error("unable to move logfile %s to %s: %s",
1587	tmp.buf, path.buf,
1588	strerror(cb.true_errno));
1589	}
1590
1591	strbuf_release(&path);
1592	strbuf_release(&tmp);
1593	return ret;
1594	}
1595
1596	static enum ref_transaction_error write_ref_to_lockfile(struct files_ref_store *refs,
1597	struct ref_lock *lock,
1598	const struct object_id *oid,
1599	struct strbuf *err);
1600	static int commit_ref_update(struct files_ref_store *refs,
1601	struct ref_lock *lock,
1602	const struct object_id oid, const char logmsg,
1603	int flags,
1604	struct strbuf *err);
1605
1606	/*
1607	* Emit a better error message than lockfile.c's
1608	* unable_to_lock_message() would in case there is a D/F conflict with
1609	* another existing reference. If there would be a conflict, emit an error
1610	* message and return false; otherwise, return true.
1611	*
1612	* Note that this function is not safe against all races with other
1613	* processes, and that's not its job. We'll emit a more verbose error on D/f
1614	* conflicts if we get past it into lock_ref_oid_basic().
1615	*/
1616	static int refs_rename_ref_available(struct ref_store *refs,
1617	const char *old_refname,
1618	const char *new_refname)
1619	{
1620	struct string_list skip = STRING_LIST_INIT_NODUP;
1621	struct strbuf err = STRBUF_INIT;
1622	int ok;
1623
1624	string_list_insert(&skip, old_refname);
1625	ok = !refs_verify_refname_available(refs, new_refname,
1626	NULL, &skip, 0, &err);
1627	if (!ok)
1628	error("%s", err.buf);
1629
1630	string_list_clear(&skip, 0);
1631	strbuf_release(&err);
1632	return ok;
1633	}
1634
1635	static int files_copy_or_rename_ref(struct ref_store *ref_store,
1636	const char oldrefname, const char newrefname,
1637	const char *logmsg, int copy)
1638	{
1639	struct files_ref_store *refs =
1640	files_downcast(ref_store, REF_STORE_WRITE, "rename_ref");
1641	struct object_id orig_oid;
1642	int flag = 0, logmoved = 0;
1643	struct ref_lock *lock;
1644	struct stat loginfo;
1645	struct strbuf sb_oldref = STRBUF_INIT;
1646	struct strbuf sb_newref = STRBUF_INIT;
1647	struct strbuf tmp_renamed_log = STRBUF_INIT;
1648	int log, ret;
1649	struct strbuf err = STRBUF_INIT;
1650
1651	files_reflog_path(refs, &sb_oldref, oldrefname);
1652	files_reflog_path(refs, &sb_newref, newrefname);
1653	files_reflog_path(refs, &tmp_renamed_log, TMP_RENAMED_LOG);
1654
1655	log = !lstat(sb_oldref.buf, &loginfo);
1656	if (log && S_ISLNK(loginfo.st_mode)) {
1657	ret = error("reflog for %s is a symlink", oldrefname);
1658	goto out;
1659	}
1660
1661	if (!refs_resolve_ref_unsafe(&refs->base, oldrefname,
1662	RESOLVE_REF_READING \| RESOLVE_REF_NO_RECURSE,
1663	&orig_oid, &flag)) {
1664	ret = error("refname %s not found", oldrefname);
1665	goto out;
1666	}
1667
1668	if (flag & REF_ISSYMREF) {
1669	if (copy)
1670	ret = error("refname %s is a symbolic ref, copying it is not supported",
1671	oldrefname);
1672	else
1673	ret = error("refname %s is a symbolic ref, renaming it is not supported",
1674	oldrefname);
1675	goto out;
1676	}
1677	if (!refs_rename_ref_available(&refs->base, oldrefname, newrefname)) {
1678	ret = 1;
1679	goto out;
1680	}
1681
1682	if (!copy && log && rename(sb_oldref.buf, tmp_renamed_log.buf)) {
1683	ret = error("unable to move logfile logs/%s to logs/"TMP_RENAMED_LOG": %s",
1684	oldrefname, strerror(errno));
1685	goto out;
1686	}
1687
1688	if (copy && log && copy_file(tmp_renamed_log.buf, sb_oldref.buf, 0644)) {
1689	ret = error("unable to copy logfile logs/%s to logs/"TMP_RENAMED_LOG": %s",
1690	oldrefname, strerror(errno));
1691	goto out;
1692	}
1693
1694	if (!copy && refs_delete_ref(&refs->base, logmsg, oldrefname,
1695	&orig_oid, REF_NO_DEREF)) {
1696	error("unable to delete old %s", oldrefname);
1697	goto rollback;
1698	}
1699
1700	/*
1701	* Since we are doing a shallow lookup, oid is not the
1702	* correct value to pass to delete_ref as old_oid. But that
1703	* doesn't matter, because an old_oid check wouldn't add to
1704	* the safety anyway; we want to delete the reference whatever
1705	* its current value.
1706	*/
1707	if (!copy && refs_resolve_ref_unsafe(&refs->base, newrefname,
1708	RESOLVE_REF_READING \| RESOLVE_REF_NO_RECURSE,
1709	NULL, NULL) &&
1710	refs_delete_ref(&refs->base, NULL, newrefname,
1711	NULL, REF_NO_DEREF)) {
1712	if (errno == EISDIR) {
1713	struct strbuf path = STRBUF_INIT;
1714	int result;
1715
1716	files_ref_path(refs, &path, newrefname);
1717	result = remove_empty_directories(&path);
1718	strbuf_release(&path);
1719
1720	if (result) {
1721	error("Directory not empty: %s", newrefname);
1722	goto rollback;
1723	}
1724	} else {
1725	error("unable to delete existing %s", newrefname);
1726	goto rollback;
1727	}
1728	}
1729
1730	if (log && rename_tmp_log(refs, newrefname))
1731	goto rollback;
1732
1733	logmoved = log;
1734
1735	lock = lock_ref_oid_basic(refs, newrefname, &err);
1736	if (!lock) {
1737	if (copy)
1738	error("unable to copy '%s' to '%s': %s", oldrefname, newrefname, err.buf);
1739	else
1740	error("unable to rename '%s' to '%s': %s", oldrefname, newrefname, err.buf);
1741	strbuf_release(&err);
1742	goto rollback;
1743	}
1744	oidcpy(&lock->old_oid, &orig_oid);
1745
1746	if (write_ref_to_lockfile(refs, lock, &orig_oid, &err) \|\|
1747	commit_ref_update(refs, lock, &orig_oid, logmsg, 0, &err)) {
1748	error("unable to write current sha1 into %s: %s", newrefname, err.buf);
1749	strbuf_release(&err);
1750	goto rollback;
1751	}
1752
1753	ret = 0;
1754	goto out;
1755
1756	rollback:
1757	lock = lock_ref_oid_basic(refs, oldrefname, &err);
1758	if (!lock) {
1759	error("unable to lock %s for rollback: %s", oldrefname, err.buf);
1760	strbuf_release(&err);
1761	goto rollbacklog;
1762	}
1763
1764	if (write_ref_to_lockfile(refs, lock, &orig_oid, &err) \|\|
1765	commit_ref_update(refs, lock, &orig_oid, NULL, REF_SKIP_CREATE_REFLOG, &err)) {
1766	error("unable to write current sha1 into %s: %s", oldrefname, err.buf);
1767	strbuf_release(&err);
1768	}
1769
1770	rollbacklog:
1771	if (logmoved && rename(sb_newref.buf, sb_oldref.buf))
1772	error("unable to restore logfile %s from %s: %s",
1773	oldrefname, newrefname, strerror(errno));
1774	if (!logmoved && log &&
1775	rename(tmp_renamed_log.buf, sb_oldref.buf))
1776	error("unable to restore logfile %s from logs/"TMP_RENAMED_LOG": %s",
1777	oldrefname, strerror(errno));
1778	ret = 1;
1779	out:
1780	strbuf_release(&sb_newref);
1781	strbuf_release(&sb_oldref);
1782	strbuf_release(&tmp_renamed_log);
1783
1784	return ret;
1785	}
1786
1787	static int files_rename_ref(struct ref_store *ref_store,
1788	const char oldrefname, const char newrefname,
1789	const char *logmsg)
1790	{
1791	return files_copy_or_rename_ref(ref_store, oldrefname,
1792	newrefname, logmsg, 0);
1793	}
1794
1795	static int files_copy_ref(struct ref_store *ref_store,
1796	const char oldrefname, const char newrefname,
1797	const char *logmsg)
1798	{
1799	return files_copy_or_rename_ref(ref_store, oldrefname,
1800	newrefname, logmsg, 1);
1801	}
1802
1803	static int close_ref_gently(struct ref_lock *lock)
1804	{
1805	if (close_lock_file_gently(&lock->lk))
1806	return -1;
1807	return 0;
1808	}
1809
1810	static int commit_ref(struct ref_lock *lock)
1811	{
1812	char *path = get_locked_file_path(&lock->lk);
1813	struct stat st;
1814
1815	if (!lstat(path, &st) && S_ISDIR(st.st_mode)) {
1816	/*
1817	* There is a directory at the path we want to rename
1818	* the lockfile to. Hopefully it is empty; try to
1819	* delete it.
1820	*/
1821	size_t len = strlen(path);
1822	struct strbuf sb_path = STRBUF_INIT;
1823
1824	strbuf_attach(&sb_path, path, len, len + 1);
1825
1826	/*
1827	* If this fails, commit_lock_file() will also fail
1828	* and will report the problem.
1829	*/
1830	remove_empty_directories(&sb_path);
1831	strbuf_release(&sb_path);
1832	} else {
1833	free(path);
1834	}
1835
1836	if (commit_lock_file(&lock->lk))
1837	return -1;
1838	return 0;
1839	}
1840
1841	static int open_or_create_logfile(const char path, void cb)
1842	{
1843	int *fd = cb;
1844
1845	*fd = open(path, O_APPEND \| O_WRONLY \| O_CREAT, 0666);
1846	return (*fd < 0) ? -1 : 0;
1847	}
1848
1849	/*
1850	* Create a reflog for a ref. If force_create = 0, only create the
1851	* reflog for certain refs (those for which should_autocreate_reflog
1852	* returns non-zero). Otherwise, create it regardless of the reference
1853	* name. If the logfile already existed or was created, return 0 and
1854	* set *logfd to the file descriptor opened for appending to the file.
1855	* If no logfile exists and we decided not to create one, return 0 and
1856	* set logfd to -1. On failure, fill in err, set *logfd to -1, and
1857	* return -1.
1858	*/
1859	static int log_ref_setup(struct files_ref_store *refs,
1860	const char *refname, int force_create,
1861	int logfd, struct strbuf err)
1862	{
1863	enum log_refs_config log_refs_cfg = refs->log_all_ref_updates;
1864	struct strbuf logfile_sb = STRBUF_INIT;
1865	char *logfile;
1866
1867	if (log_refs_cfg == LOG_REFS_UNSET)
1868	log_refs_cfg = is_bare_repository() ? LOG_REFS_NONE : LOG_REFS_NORMAL;
1869
1870	files_reflog_path(refs, &logfile_sb, refname);
1871	logfile = strbuf_detach(&logfile_sb, NULL);
1872
1873	if (force_create \|\| should_autocreate_reflog(log_refs_cfg, refname)) {
1874	if (raceproof_create_file(logfile, open_or_create_logfile, logfd)) {
1875	if (errno == ENOENT)
1876	strbuf_addf(err, "unable to create directory for '%s': "
1877	"%s", logfile, strerror(errno));
1878	else if (errno == EISDIR)
1879	strbuf_addf(err, "there are still logs under '%s'",
1880	logfile);
1881	else
1882	strbuf_addf(err, "unable to append to '%s': %s",
1883	logfile, strerror(errno));
1884
1885	goto error;
1886	}
1887	} else {
1888	*logfd = open(logfile, O_APPEND \| O_WRONLY);
1889	if (*logfd < 0) {
1890	if (errno == ENOENT \|\| errno == EISDIR) {
1891	/*
1892	* The logfile doesn't already exist,
1893	* but that is not an error; it only
1894	* means that we won't write log
1895	* entries to it.
1896	*/
1897	;
1898	} else {
1899	strbuf_addf(err, "unable to append to '%s': %s",
1900	logfile, strerror(errno));
1901	goto error;
1902	}
1903	}
1904	}
1905
1906	if (*logfd >= 0)
1907	adjust_shared_perm(the_repository, logfile);
1908
1909	free(logfile);
1910	return 0;
1911
1912	error:
1913	free(logfile);
1914	return -1;
1915	}
1916
1917	static int files_create_reflog(struct ref_store ref_store, const char refname,
1918	struct strbuf *err)
1919	{
1920	struct files_ref_store *refs =
1921	files_downcast(ref_store, REF_STORE_WRITE, "create_reflog");
1922	int fd;
1923
1924	if (log_ref_setup(refs, refname, 1, &fd, err))
1925	return -1;
1926
1927	if (fd >= 0)
1928	close(fd);
1929
1930	return 0;
1931	}
1932
1933	static int log_ref_write_fd(int fd, const struct object_id *old_oid,
1934	const struct object_id *new_oid,
1935	const char committer, const char msg)
1936	{
1937	struct strbuf sb = STRBUF_INIT;
1938	int ret = 0;
1939
1940	if (!committer)
1941	committer = git_committer_info(0);
1942
1943	strbuf_addf(&sb, "%s %s %s", oid_to_hex(old_oid), oid_to_hex(new_oid), committer);
1944	if (msg && *msg) {
1945	strbuf_addch(&sb, '\t');
1946	strbuf_addstr(&sb, msg);
1947	}
1948	strbuf_addch(&sb, '\n');
1949	if (write_in_full(fd, sb.buf, sb.len) < 0)
1950	ret = -1;
1951	strbuf_release(&sb);
1952	return ret;
1953	}
1954
1955	static int files_log_ref_write(struct files_ref_store *refs,
1956	const char *refname,
1957	const struct object_id *old_oid,
1958	const struct object_id *new_oid,
1959	const char committer_info, const char msg,
1960	int flags, struct strbuf *err)
1961	{
1962	int logfd, result;
1963
1964	if (flags & REF_SKIP_CREATE_REFLOG)
1965	return 0;
1966
1967	result = log_ref_setup(refs, refname,
1968	flags & REF_FORCE_CREATE_REFLOG,
1969	&logfd, err);
1970
1971	if (result)
1972	return result;
1973
1974	if (logfd < 0)
1975	return 0;
1976	result = log_ref_write_fd(logfd, old_oid, new_oid, committer_info, msg);
1977	if (result) {
1978	struct strbuf sb = STRBUF_INIT;
1979	int save_errno = errno;
1980
1981	files_reflog_path(refs, &sb, refname);
1982	strbuf_addf(err, "unable to append to '%s': %s",
1983	sb.buf, strerror(save_errno));
1984	strbuf_release(&sb);
1985	close(logfd);
1986	return -1;
1987	}
1988	if (close(logfd)) {
1989	struct strbuf sb = STRBUF_INIT;
1990	int save_errno = errno;
1991
1992	files_reflog_path(refs, &sb, refname);
1993	strbuf_addf(err, "unable to append to '%s': %s",
1994	sb.buf, strerror(save_errno));
1995	strbuf_release(&sb);
1996	return -1;
1997	}
1998	return 0;
1999	}
2000
2001	/*
2002	* Write oid into the open lockfile, then close the lockfile. On
2003	* errors, rollback the lockfile, fill in *err and return -1.
2004	*/
2005	static enum ref_transaction_error write_ref_to_lockfile(struct files_ref_store *refs,
2006	struct ref_lock *lock,
2007	const struct object_id *oid,
2008	struct strbuf *err)
2009	{
2010	static char term = '\n';
2011	int fd;
2012
2013	fd = get_lock_file_fd(&lock->lk);
2014	if (write_in_full(fd, oid_to_hex(oid), refs->base.repo->hash_algo->hexsz) < 0 \|\|
2015	write_in_full(fd, &term, 1) < 0 \|\|
2016	fsync_component(FSYNC_COMPONENT_REFERENCE, get_lock_file_fd(&lock->lk)) < 0 \|\|
2017	close_ref_gently(lock) < 0) {
2018	strbuf_addf(err,
2019	"couldn't write '%s'", get_lock_file_path(&lock->lk));
2020	unlock_ref(lock);
2021	return REF_TRANSACTION_ERROR_GENERIC;
2022	}
2023	return 0;
2024	}
2025
2026	/*
2027	* Commit a change to a loose reference that has already been written
2028	* to the loose reference lockfile. Also update the reflogs if
2029	* necessary, using the specified lockmsg (which can be NULL).
2030	*/
2031	static int commit_ref_update(struct files_ref_store *refs,
2032	struct ref_lock *lock,
2033	const struct object_id oid, const char logmsg,
2034	int flags,
2035	struct strbuf *err)
2036	{
2037	files_assert_main_repository(refs, "commit_ref_update");
2038
2039	clear_loose_ref_cache(refs);
2040	if (files_log_ref_write(refs, lock->ref_name, &lock->old_oid, oid, NULL,
2041	logmsg, flags, err)) {
2042	char *old_msg = strbuf_detach(err, NULL);
2043	strbuf_addf(err, "cannot update the ref '%s': %s",
2044	lock->ref_name, old_msg);
2045	free(old_msg);
2046	unlock_ref(lock);
2047	return -1;
2048	}
2049
2050	if (strcmp(lock->ref_name, "HEAD") != 0) {
2051	/*
2052	* Special hack: If a branch is updated directly and HEAD
2053	* points to it (may happen on the remote side of a push
2054	* for example) then logically the HEAD reflog should be
2055	* updated too.
2056	* A generic solution implies reverse symref information,
2057	* but finding all symrefs pointing to the given branch
2058	* would be rather costly for this rare event (the direct
2059	* update of a branch) to be worth it. So let's cheat and
2060	* check with HEAD only which should cover 99% of all usage
2061	* scenarios (even 100% of the default ones).
2062	*/
2063	int head_flag;
2064	const char *head_ref;
2065
2066	head_ref = refs_resolve_ref_unsafe(&refs->base, "HEAD",
2067	RESOLVE_REF_READING,
2068	NULL, &head_flag);
2069	if (head_ref && (head_flag & REF_ISSYMREF) &&
2070	!strcmp(head_ref, lock->ref_name)) {
2071	struct strbuf log_err = STRBUF_INIT;
2072	if (files_log_ref_write(refs, "HEAD", &lock->old_oid,
2073	oid, NULL, logmsg, flags,
2074	&log_err)) {
2075	error("%s", log_err.buf);
2076	strbuf_release(&log_err);
2077	}
2078	}
2079	}
2080
2081	if (commit_ref(lock)) {
2082	strbuf_addf(err, "couldn't set '%s'", lock->ref_name);
2083	unlock_ref(lock);
2084	return -1;
2085	}
2086
2087	unlock_ref(lock);
2088	return 0;
2089	}
2090
2091	#if defined(NO_SYMLINK_HEAD) \|\| defined(WITH_BREAKING_CHANGES)
2092	#define create_ref_symlink(a, b) (-1)
2093	#else
2094	static int create_ref_symlink(struct ref_lock lock, const char target)
2095	{
2096	static int warn_once = 1;
2097	char *ref_path;
2098	int ret = -1;
2099
2100	ref_path = get_locked_file_path(&lock->lk);
2101	unlink(ref_path);
2102	ret = symlink(target, ref_path);
2103	free(ref_path);
2104
2105	if (ret)
2106	fprintf(stderr, "no symlink - falling back to symbolic ref\n");
2107
2108	if (warn_once)
2109	warning(_("'core.preferSymlinkRefs=true' is nominated for removal.\n"
2110	"hint: The use of symbolic links for symbolic refs is deprecated\n"
2111	"hint: and will be removed in Git 3.0. The configuration that\n"
2112	"hint: tells Git to use them is thus going away. You can unset\n"
2113	"hint: it with:\n"
2114	"hint:\n"
2115	"hint:\tgit config unset core.preferSymlinkRefs\n"
2116	"hint:\n"
2117	"hint: Git will then use the textual symref format instead."));
2118	warn_once = 0;
2119
2120	return ret;
2121	}
2122	#endif
2123
2124	static int create_symref_lock(struct ref_lock lock, const char target,
2125	struct strbuf *err)
2126	{
2127	if (!fdopen_lock_file(&lock->lk, "w")) {
2128	strbuf_addf(err, "unable to fdopen %s: %s",
2129	get_lock_file_path(&lock->lk), strerror(errno));
2130	return -1;
2131	}
2132
2133	if (fprintf(get_lock_file_fp(&lock->lk), "ref: %s\n", target) < 0) {
2134	strbuf_addf(err, "unable to write to %s: %s",
2135	get_lock_file_path(&lock->lk), strerror(errno));
2136	return -1;
2137	}
2138
2139	return 0;
2140	}
2141
2142	static int files_reflog_exists(struct ref_store *ref_store,
2143	const char *refname)
2144	{
2145	struct files_ref_store *refs =
2146	files_downcast(ref_store, REF_STORE_READ, "reflog_exists");
2147	struct strbuf sb = STRBUF_INIT;
2148	struct stat st;
2149	int ret;
2150
2151	files_reflog_path(refs, &sb, refname);
2152	ret = !lstat(sb.buf, &st) && S_ISREG(st.st_mode);
2153	strbuf_release(&sb);
2154	return ret;
2155	}
2156
2157	static int files_delete_reflog(struct ref_store *ref_store,
2158	const char *refname)
2159	{
2160	struct files_ref_store *refs =
2161	files_downcast(ref_store, REF_STORE_WRITE, "delete_reflog");
2162	struct strbuf sb = STRBUF_INIT;
2163	int ret;
2164
2165	files_reflog_path(refs, &sb, refname);
2166	ret = remove_path(sb.buf);
2167	strbuf_release(&sb);
2168	return ret;
2169	}
2170
2171	static int show_one_reflog_ent(struct files_ref_store *refs,
2172	const char *refname,
2173	struct strbuf *sb,
2174	each_reflog_ent_fn fn, void *cb_data)
2175	{
2176	struct object_id ooid, noid;
2177	char email_end, message;
2178	timestamp_t timestamp;
2179	int tz;
2180	char *p = sb->buf;
2181
2182	/* old SP new SP name <email> SP time TAB msg LF */
2183	if (!sb->len \|\| sb->buf[sb->len - 1] != '\n' \|\|
2184	parse_oid_hex_algop(p, &ooid, &p, refs->base.repo->hash_algo) \|\| *p++ != ' ' \|\|
2185	parse_oid_hex_algop(p, &noid, &p, refs->base.repo->hash_algo) \|\| *p++ != ' ' \|\|
2186	!(email_end = strchr(p, '>')) \|\|
2187	email_end[1] != ' ' \|\|
2188	!(timestamp = parse_timestamp(email_end + 2, &message, 10)) \|\|
2189	!message \|\| message[0] != ' ' \|\|
2190	(message[1] != '+' && message[1] != '-') \|\|
2191	!isdigit(message[2]) \|\| !isdigit(message[3]) \|\|
2192	!isdigit(message[4]) \|\| !isdigit(message[5]))
2193	return 0; /* corrupt? */
2194	email_end[1] = '\0';
2195	tz = strtol(message + 1, NULL, 10);
2196	if (message[6] != '\t')
2197	message += 6;
2198	else
2199	message += 7;
2200	return fn(refname, &ooid, &noid, p, timestamp, tz, message, cb_data);
2201	}
2202
2203	static char find_beginning_of_line(char bob, char *scan)
2204	{
2205	while (bob < scan && *(--scan) != '\n')
2206	; /* keep scanning backwards */
2207	/*
2208	* Return either beginning of the buffer, or LF at the end of
2209	* the previous line.
2210	*/
2211	return scan;
2212	}
2213
2214	static int files_for_each_reflog_ent_reverse(struct ref_store *ref_store,
2215	const char *refname,
2216	each_reflog_ent_fn fn,
2217	void *cb_data)
2218	{
2219	struct files_ref_store *refs =
2220	files_downcast(ref_store, REF_STORE_READ,
2221	"for_each_reflog_ent_reverse");
2222	struct strbuf sb = STRBUF_INIT;
2223	FILE *logfp;
2224	long pos;
2225	int ret = 0, at_tail = 1;
2226
2227	files_reflog_path(refs, &sb, refname);
2228	logfp = fopen(sb.buf, "r");
2229	strbuf_release(&sb);
2230	if (!logfp)
2231	return -1;
2232
2233	/* Jump to the end */
2234	if (fseek(logfp, 0, SEEK_END) < 0)
2235	ret = error("cannot seek back reflog for %s: %s",
2236	refname, strerror(errno));
2237	pos = ftell(logfp);
2238	while (!ret && 0 < pos) {
2239	int cnt;
2240	size_t nread;
2241	char buf[BUFSIZ];
2242	char endp, scanp;
2243
2244	/* Fill next block from the end */
2245	cnt = (sizeof(buf) < pos) ? sizeof(buf) : pos;
2246	if (fseek(logfp, pos - cnt, SEEK_SET)) {
2247	ret = error("cannot seek back reflog for %s: %s",
2248	refname, strerror(errno));
2249	break;
2250	}
2251	nread = fread(buf, cnt, 1, logfp);
2252	if (nread != 1) {
2253	ret = error("cannot read %d bytes from reflog for %s: %s",
2254	cnt, refname, strerror(errno));
2255	break;
2256	}
2257	pos -= cnt;
2258
2259	scanp = endp = buf + cnt;
2260	if (at_tail && scanp[-1] == '\n')
2261	/* Looking at the final LF at the end of the file */
2262	scanp--;
2263	at_tail = 0;
2264
2265	while (buf < scanp) {
2266	/*
2267	* terminating LF of the previous line, or the beginning
2268	* of the buffer.
2269	*/
2270	char *bp;
2271
2272	bp = find_beginning_of_line(buf, scanp);
2273
2274	if (*bp == '\n') {
2275	/*
2276	* The newline is the end of the previous line,
2277	* so we know we have complete line starting
2278	* at (bp + 1). Prefix it onto any prior data
2279	* we collected for the line and process it.
2280	*/
2281	strbuf_splice(&sb, 0, 0, bp + 1, endp - (bp + 1));
2282	scanp = bp;
2283	endp = bp + 1;
2284	ret = show_one_reflog_ent(refs, refname, &sb, fn, cb_data);
2285	strbuf_reset(&sb);
2286	if (ret)
2287	break;
2288	} else if (!pos) {
2289	/*
2290	* We are at the start of the buffer, and the
2291	* start of the file; there is no previous
2292	* line, and we have everything for this one.
2293	* Process it, and we can end the loop.
2294	*/
2295	strbuf_splice(&sb, 0, 0, buf, endp - buf);
2296	ret = show_one_reflog_ent(refs, refname, &sb, fn, cb_data);
2297	strbuf_reset(&sb);
2298	break;
2299	}
2300
2301	if (bp == buf) {
2302	/*
2303	* We are at the start of the buffer, and there
2304	* is more file to read backwards. Which means
2305	* we are in the middle of a line. Note that we
2306	* may get here even if *bp was a newline; that
2307	* just means we are at the exact end of the
2308	* previous line, rather than some spot in the
2309	* middle.
2310	*
2311	* Save away what we have to be combined with
2312	* the data from the next read.
2313	*/
2314	strbuf_splice(&sb, 0, 0, buf, endp - buf);
2315	break;
2316	}
2317	}
2318
2319	}
2320	if (!ret && sb.len)
2321	BUG("reverse reflog parser had leftover data");
2322
2323	fclose(logfp);
2324	strbuf_release(&sb);
2325	return ret;
2326	}
2327
2328	static int files_for_each_reflog_ent(struct ref_store *ref_store,
2329	const char *refname,
2330	each_reflog_ent_fn fn, void *cb_data)
2331	{
2332	struct files_ref_store *refs =
2333	files_downcast(ref_store, REF_STORE_READ,
2334	"for_each_reflog_ent");
2335	FILE *logfp;
2336	struct strbuf sb = STRBUF_INIT;
2337	int ret = 0;
2338
2339	files_reflog_path(refs, &sb, refname);
2340	logfp = fopen(sb.buf, "r");
2341	strbuf_release(&sb);
2342	if (!logfp)
2343	return -1;
2344
2345	while (!ret && !strbuf_getwholeline(&sb, logfp, '\n'))
2346	ret = show_one_reflog_ent(refs, refname, &sb, fn, cb_data);
2347	fclose(logfp);
2348	strbuf_release(&sb);
2349	return ret;
2350	}
2351
2352	struct files_reflog_iterator {
2353	struct ref_iterator base;
2354	struct ref_store *ref_store;
2355	struct dir_iterator *dir_iterator;
2356	};
2357
2358	static int files_reflog_iterator_advance(struct ref_iterator *ref_iterator)
2359	{
2360	struct files_reflog_iterator *iter =
2361	(struct files_reflog_iterator *)ref_iterator;
2362	struct dir_iterator *diter = iter->dir_iterator;
2363	int ok;
2364
2365	while ((ok = dir_iterator_advance(diter)) == ITER_OK) {
2366	if (!S_ISREG(diter->st.st_mode))
2367	continue;
2368	if (check_refname_format(diter->basename,
2369	REFNAME_ALLOW_ONELEVEL))
2370	continue;
2371
2372	iter->base.ref.name = diter->relative_path;
2373	return ITER_OK;
2374	}
2375
2376	return ok;
2377	}
2378
2379	static int files_reflog_iterator_seek(struct ref_iterator *ref_iterator UNUSED,
2380	const char *refname UNUSED,
2381	unsigned int flags UNUSED)
2382	{
2383	BUG("ref_iterator_seek() called for reflog_iterator");
2384	}
2385
2386	static void files_reflog_iterator_release(struct ref_iterator *ref_iterator)
2387	{
2388	struct files_reflog_iterator *iter =
2389	(struct files_reflog_iterator *)ref_iterator;
2390	dir_iterator_free(iter->dir_iterator);
2391	}
2392
2393	static struct ref_iterator_vtable files_reflog_iterator_vtable = {
2394	.advance = files_reflog_iterator_advance,
2395	.seek = files_reflog_iterator_seek,
2396	.release = files_reflog_iterator_release,
2397	};
2398
2399	static struct ref_iterator reflog_iterator_begin(struct ref_store ref_store,
2400	const char *gitdir)
2401	{
2402	struct dir_iterator *diter;
2403	struct files_reflog_iterator *iter;
2404	struct ref_iterator *ref_iterator;
2405	struct strbuf sb = STRBUF_INIT;
2406
2407	strbuf_addf(&sb, "%s/logs", gitdir);
2408
2409	diter = dir_iterator_begin(sb.buf, DIR_ITERATOR_SORTED);
2410	if (!diter) {
2411	strbuf_release(&sb);
2412	return empty_ref_iterator_begin();
2413	}
2414
2415	CALLOC_ARRAY(iter, 1);
2416	ref_iterator = &iter->base;
2417
2418	base_ref_iterator_init(ref_iterator, &files_reflog_iterator_vtable);
2419	iter->dir_iterator = diter;
2420	iter->ref_store = ref_store;
2421	strbuf_release(&sb);
2422
2423	return ref_iterator;
2424	}
2425
2426	static struct ref_iterator files_reflog_iterator_begin(struct ref_store ref_store)
2427	{
2428	struct files_ref_store *refs =
2429	files_downcast(ref_store, REF_STORE_READ,
2430	"reflog_iterator_begin");
2431
2432	if (!strcmp(refs->base.gitdir, refs->gitcommondir)) {
2433	return reflog_iterator_begin(ref_store, refs->gitcommondir);
2434	} else {
2435	return merge_ref_iterator_begin(
2436	reflog_iterator_begin(ref_store, refs->base.gitdir),
2437	reflog_iterator_begin(ref_store, refs->gitcommondir),
2438	ref_iterator_select, refs);
2439	}
2440	}
2441
2442	/*
2443	* If update is a direct update of head_ref (the reference pointed to
2444	* by HEAD), then add an extra REF_LOG_ONLY update for HEAD.
2445	*/
2446	static enum ref_transaction_error split_head_update(struct ref_update *update,
2447	struct ref_transaction *transaction,
2448	const char *head_ref,
2449	struct strbuf *err)
2450	{
2451	struct ref_update *new_update;
2452
2453	if ((update->flags & REF_LOG_ONLY) \|\|
2454	(update->flags & REF_SKIP_CREATE_REFLOG) \|\|
2455	(update->flags & REF_IS_PRUNING) \|\|
2456	(update->flags & REF_UPDATE_VIA_HEAD))
2457	return 0;
2458
2459	if (strcmp(update->refname, head_ref))
2460	return 0;
2461
2462	/*
2463	* First make sure that HEAD is not already in the
2464	* transaction. This check is O(lg N) in the transaction
2465	* size, but it happens at most once per transaction.
2466	*/
2467	if (string_list_has_string(&transaction->refnames, "HEAD")) {
2468	/* An entry already existed */
2469	strbuf_addf(err,
2470	"multiple updates for 'HEAD' (including one "
2471	"via its referent '%s') are not allowed",
2472	update->refname);
2473	return REF_TRANSACTION_ERROR_NAME_CONFLICT;
2474	}
2475
2476	new_update = ref_transaction_add_update(
2477	transaction, "HEAD",
2478	update->flags \| REF_LOG_ONLY \| REF_NO_DEREF \| REF_LOG_VIA_SPLIT,
2479	&update->new_oid, &update->old_oid, &update->peeled,
2480	NULL, NULL, update->committer_info, update->msg);
2481	new_update->parent_update = update;
2482
2483	/*
2484	* Add "HEAD". This insertion is O(N) in the transaction
2485	* size, but it happens at most once per transaction.
2486	* Add new_update->refname instead of a literal "HEAD".
2487	*/
2488	if (strcmp(new_update->refname, "HEAD"))
2489	BUG("%s unexpectedly not 'HEAD'", new_update->refname);
2490
2491	return 0;
2492	}
2493
2494	/*
2495	* update is for a symref that points at referent and doesn't have
2496	* REF_NO_DEREF set. Split it into two updates:
2497	* - The original update, but with REF_LOG_ONLY and REF_NO_DEREF set
2498	* - A new, separate update for the referent reference
2499	* Note that the new update will itself be subject to splitting when
2500	* the iteration gets to it.
2501	*/
2502	static enum ref_transaction_error split_symref_update(struct ref_update *update,
2503	const char *referent,
2504	struct ref_transaction *transaction,
2505	struct strbuf *err)
2506	{
2507	struct ref_update *new_update;
2508	unsigned int new_flags;
2509
2510	/*
2511	* First make sure that referent is not already in the
2512	* transaction. This check is O(lg N) in the transaction
2513	* size, but it happens at most once per symref in a
2514	* transaction.
2515	*/
2516	if (string_list_has_string(&transaction->refnames, referent)) {
2517	/* An entry already exists */
2518	strbuf_addf(err,
2519	"multiple updates for '%s' (including one "
2520	"via symref '%s') are not allowed",
2521	referent, update->refname);
2522	return REF_TRANSACTION_ERROR_NAME_CONFLICT;
2523	}
2524
2525	new_flags = update->flags;
2526	if (!strcmp(update->refname, "HEAD")) {
2527	/*
2528	* Record that the new update came via HEAD, so that
2529	* when we process it, split_head_update() doesn't try
2530	* to add another reflog update for HEAD. Note that
2531	* this bit will be propagated if the new_update
2532	* itself needs to be split.
2533	*/
2534	new_flags \|= REF_UPDATE_VIA_HEAD;
2535	}
2536
2537	new_update = ref_transaction_add_update(
2538	transaction, referent, new_flags,
2539	update->new_target ? NULL : &update->new_oid,
2540	update->old_target ? NULL : &update->old_oid,
2541	&update->peeled, update->new_target, update->old_target,
2542	NULL, update->msg);
2543
2544	new_update->parent_update = update;
2545
2546	/*
2547	* Change the symbolic ref update to log only. Also, it
2548	* doesn't need to check its old OID value, as that will be
2549	* done when new_update is processed.
2550	*/
2551	update->flags \|= REF_LOG_ONLY \| REF_NO_DEREF;
2552
2553	return 0;
2554	}
2555
2556	/*
2557	* Check whether the REF_HAVE_OLD and old_oid values stored in update
2558	* are consistent with oid, which is the reference's current value. If
2559	* everything is OK, return 0; otherwise, write an error message to
2560	* err and return -1.
2561	*/
2562	static enum ref_transaction_error check_old_oid(struct ref_update *update,
2563	struct object_id *oid,
2564	struct strbuf *referent,
2565	struct strbuf *err)
2566	{
2567	if (update->flags & REF_LOG_ONLY \|\|
2568	!(update->flags & REF_HAVE_OLD))
2569	return 0;
2570
2571	if (oideq(oid, &update->old_oid)) {
2572	/*
2573	* Normally matching the expected old oid is enough. Either we
2574	* found the ref at the expected state, or we are creating and
2575	* expect the null oid (and likewise found nothing).
2576	*
2577	* But there is one exception for the null oid: if we found a
2578	* symref pointing to nothing we'll also get the null oid. In
2579	* regular recursive mode, that's good (we'll write to what the
2580	* symref points to, which doesn't exist). But in no-deref
2581	* mode, it means we'll clobber the symref, even though the
2582	* caller asked for this to be a creation event. So flag
2583	* that case to preserve the dangling symref.
2584	*/
2585	if ((update->flags & REF_NO_DEREF) && referent->len &&
2586	is_null_oid(oid)) {
2587	strbuf_addf(err, "cannot lock ref '%s': "
2588	"dangling symref already exists",
2589	ref_update_original_update_refname(update));
2590	return REF_TRANSACTION_ERROR_CREATE_EXISTS;
2591	}
2592	return 0;
2593	}
2594
2595	if (is_null_oid(&update->old_oid)) {
2596	strbuf_addf(err, "cannot lock ref '%s': "
2597	"reference already exists",
2598	ref_update_original_update_refname(update));
2599	return REF_TRANSACTION_ERROR_CREATE_EXISTS;
2600	} else if (is_null_oid(oid)) {
2601	strbuf_addf(err, "cannot lock ref '%s': "
2602	"reference is missing but expected %s",
2603	ref_update_original_update_refname(update),
2604	oid_to_hex(&update->old_oid));
2605	return REF_TRANSACTION_ERROR_NONEXISTENT_REF;
2606	}
2607
2608	strbuf_addf(err, "cannot lock ref '%s': is at %s but expected %s",
2609	ref_update_original_update_refname(update), oid_to_hex(oid),
2610	oid_to_hex(&update->old_oid));
2611
2612	return REF_TRANSACTION_ERROR_INCORRECT_OLD_VALUE;
2613	}
2614
2615	struct files_transaction_backend_data {
2616	struct ref_transaction *packed_transaction;
2617	int packed_refs_locked;
2618	struct strmap ref_locks;
2619	};
2620
2621	/*
2622	* Prepare for carrying out update:
2623	* - Lock the reference referred to by update.
2624	* - Read the reference under lock.
2625	* - Check that its old OID value (if specified) is correct, and in
2626	* any case record it in update->lock->old_oid for later use when
2627	* writing the reflog.
2628	* - If it is a symref update without REF_NO_DEREF, split it up into a
2629	* REF_LOG_ONLY update of the symref and add a separate update for
2630	* the referent to transaction.
2631	* - If it is an update of head_ref, add a corresponding REF_LOG_ONLY
2632	* update of HEAD.
2633	*/
2634	static enum ref_transaction_error lock_ref_for_update(struct files_ref_store *refs,
2635	struct ref_update *update,
2636	size_t update_idx,
2637	struct ref_transaction *transaction,
2638	const char *head_ref,
2639	struct string_list *refnames_to_check,
2640	struct strbuf *err)
2641	{
2642	struct strbuf referent = STRBUF_INIT;
2643	int mustexist = ref_update_expects_existing_old_ref(update);
2644	struct files_transaction_backend_data *backend_data;
2645	enum ref_transaction_error ret = 0;
2646	struct ref_lock *lock;
2647
2648	files_assert_main_repository(refs, "lock_ref_for_update");
2649
2650	backend_data = transaction->backend_data;
2651
2652	if ((update->flags & REF_HAVE_NEW) && ref_update_has_null_new_value(update))
2653	update->flags \|= REF_DELETING;
2654
2655	if (head_ref) {
2656	ret = split_head_update(update, transaction, head_ref, err);
2657	if (ret)
2658	goto out;
2659	}
2660
2661	lock = strmap_get(&backend_data->ref_locks, update->refname);
2662	if (lock) {
2663	lock->count++;
2664	} else {
2665	ret = lock_raw_ref(refs, transaction, update_idx, mustexist,
2666	refnames_to_check, &lock, &referent, err);
2667	if (ret) {
2668	char *reason;
2669
2670	reason = strbuf_detach(err, NULL);
2671	strbuf_addf(err, "cannot lock ref '%s': %s",
2672	ref_update_original_update_refname(update), reason);
2673	free(reason);
2674	goto out;
2675	}
2676
2677	strmap_put(&backend_data->ref_locks, update->refname, lock);
2678	}
2679
2680	update->backend_data = lock;
2681
2682	if (update->flags & REF_LOG_VIA_SPLIT) {
2683	struct ref_lock *parent_lock;
2684
2685	if (!update->parent_update)
2686	BUG("split update without a parent");
2687
2688	parent_lock = update->parent_update->backend_data;
2689
2690	/*
2691	* Check that "HEAD" didn't racily change since we have looked
2692	* it up. If it did we must refuse to write the reflog entry.
2693	*
2694	* Note that this does not catch all races: if "HEAD" was
2695	* racily changed to point to one of the refs part of the
2696	* transaction then we would miss writing the split reflog
2697	* entry for "HEAD".
2698	*/
2699	if (!(update->type & REF_ISSYMREF) \|\|
2700	strcmp(update->parent_update->refname, referent.buf)) {
2701	strbuf_addstr(err, "HEAD has been racily updated");
2702	ret = REF_TRANSACTION_ERROR_GENERIC;
2703	goto out;
2704	}
2705
2706	if (update->flags & REF_HAVE_OLD) {
2707	oidcpy(&lock->old_oid, &update->old_oid);
2708	} else {
2709	oidcpy(&lock->old_oid, &parent_lock->old_oid);
2710	}
2711	} else if (update->type & REF_ISSYMREF) {
2712	if (update->flags & REF_NO_DEREF) {
2713	/*
2714	* We won't be reading the referent as part of
2715	* the transaction, so we have to read it here
2716	* to record and possibly check old_oid:
2717	*/
2718	if (!refs_resolve_ref_unsafe(&refs->base,
2719	referent.buf, 0,
2720	&lock->old_oid, NULL)) {
2721	if (update->flags & REF_HAVE_OLD) {
2722	strbuf_addf(err, "cannot lock ref '%s': "
2723	"error reading reference",
2724	ref_update_original_update_refname(update));
2725	ret = REF_TRANSACTION_ERROR_GENERIC;
2726	goto out;
2727	}
2728	}
2729
2730	if (update->old_target)
2731	ret = ref_update_check_old_target(referent.buf, update, err);
2732	else
2733	ret = check_old_oid(update, &lock->old_oid,
2734	&referent, err);
2735	if (ret)
2736	goto out;
2737	} else {
2738	/*
2739	* Create a new update for the reference this
2740	* symref is pointing at. Also, we will record
2741	* and verify old_oid for this update as part
2742	* of processing the split-off update, so we
2743	* don't have to do it here.
2744	*/
2745	ret = split_symref_update(update, referent.buf,
2746	transaction, err);
2747	if (ret)
2748	goto out;
2749	}
2750	} else {
2751	struct ref_update *parent_update;
2752
2753	/*
2754	* Even if the ref is a regular ref, if `old_target` is set, we
2755	* fail with an error.
2756	*/
2757	if (update->old_target) {
2758	strbuf_addf(err, _("cannot lock ref '%s': "
2759	"expected symref with target '%s': "
2760	"but is a regular ref"),
2761	ref_update_original_update_refname(update),
2762	update->old_target);
2763	ret = REF_TRANSACTION_ERROR_EXPECTED_SYMREF;
2764	goto out;
2765	} else {
2766	ret = check_old_oid(update, &lock->old_oid,
2767	&referent, err);
2768	if (ret) {
2769	goto out;
2770	}
2771	}
2772
2773	/*
2774	* If this update is happening indirectly because of a
2775	* symref update, record the old OID in the parent
2776	* update:
2777	*/
2778	for (parent_update = update->parent_update;
2779	parent_update;
2780	parent_update = parent_update->parent_update) {
2781	struct ref_lock *parent_lock = parent_update->backend_data;
2782	oidcpy(&parent_lock->old_oid, &lock->old_oid);
2783	}
2784	}
2785
2786	if (update->new_target && !(update->flags & REF_LOG_ONLY)) {
2787	if (create_symref_lock(lock, update->new_target, err)) {
2788	ret = REF_TRANSACTION_ERROR_GENERIC;
2789	goto out;
2790	}
2791
2792	if (close_ref_gently(lock)) {
2793	strbuf_addf(err, "couldn't close '%s.lock'",
2794	update->refname);
2795	ret = REF_TRANSACTION_ERROR_GENERIC;
2796	goto out;
2797	}
2798
2799	/*
2800	* Once we have created the symref lock, the commit
2801	* phase of the transaction only needs to commit the lock.
2802	*/
2803	update->flags \|= REF_NEEDS_COMMIT;
2804	} else if ((update->flags & REF_HAVE_NEW) &&
2805	!(update->flags & REF_DELETING) &&
2806	!(update->flags & REF_LOG_ONLY)) {
2807	if (!(update->type & REF_ISSYMREF) &&
2808	oideq(&lock->old_oid, &update->new_oid)) {
2809	/*
2810	* The reference already has the desired
2811	* value, so we don't need to write it.
2812	*/
2813	} else {
2814	ret = write_ref_to_lockfile(
2815	refs, lock, &update->new_oid,
2816	err);
2817	if (ret) {
2818	char *write_err = strbuf_detach(err, NULL);
2819
2820	/*
2821	* The lock was freed upon failure of
2822	* write_ref_to_lockfile():
2823	*/
2824	update->backend_data = NULL;
2825	strbuf_addf(err,
2826	"cannot update ref '%s': %s",
2827	update->refname, write_err);
2828	free(write_err);
2829	goto out;
2830	} else {
2831	update->flags \|= REF_NEEDS_COMMIT;
2832	}
2833	}
2834	}
2835	if (!(update->flags & REF_NEEDS_COMMIT)) {
2836	/*
2837	* We didn't call write_ref_to_lockfile(), so
2838	* the lockfile is still open. Close it to
2839	* free up the file descriptor:
2840	*/
2841	if (close_ref_gently(lock)) {
2842	strbuf_addf(err, "couldn't close '%s.lock'",
2843	update->refname);
2844	ret = REF_TRANSACTION_ERROR_GENERIC;
2845	goto out;
2846	}
2847	}
2848
2849	out:
2850	strbuf_release(&referent);
2851	return ret;
2852	}
2853
2854	/*
2855	* Unlock any references in `transaction` that are still locked, and
2856	* mark the transaction closed.
2857	*/
2858	static void files_transaction_cleanup(struct files_ref_store *refs,
2859	struct ref_transaction *transaction)
2860	{
2861	size_t i;
2862	struct files_transaction_backend_data *backend_data =
2863	transaction->backend_data;
2864	struct strbuf err = STRBUF_INIT;
2865
2866	for (i = 0; i < transaction->nr; i++) {
2867	struct ref_update *update = transaction->updates[i];
2868	struct ref_lock *lock = update->backend_data;
2869
2870	if (lock) {
2871	unlock_ref(lock);
2872	try_remove_empty_parents(refs, update->refname,
2873	REMOVE_EMPTY_PARENTS_REF);
2874	update->backend_data = NULL;
2875	}
2876	}
2877
2878	if (backend_data) {
2879	if (backend_data->packed_transaction &&
2880	ref_transaction_abort(backend_data->packed_transaction, &err)) {
2881	error("error aborting transaction: %s", err.buf);
2882	strbuf_release(&err);
2883	}
2884
2885	if (backend_data->packed_refs_locked)
2886	packed_refs_unlock(refs->packed_ref_store);
2887
2888	strmap_clear(&backend_data->ref_locks, 0);
2889
2890	free(backend_data);
2891	}
2892
2893	transaction->state = REF_TRANSACTION_CLOSED;
2894	}
2895
2896	static int files_transaction_prepare(struct ref_store *ref_store,
2897	struct ref_transaction *transaction,
2898	struct strbuf *err)
2899	{
2900	struct files_ref_store *refs =
2901	files_downcast(ref_store, REF_STORE_WRITE,
2902	"ref_transaction_prepare");
2903	size_t i;
2904	int ret = 0;
2905	struct string_list refnames_to_check = STRING_LIST_INIT_DUP;
2906	char *head_ref = NULL;
2907	int head_type;
2908	struct files_transaction_backend_data *backend_data;
2909	struct ref_transaction *packed_transaction = NULL;
2910
2911	assert(err);
2912
2913	if (transaction->flags & REF_TRANSACTION_FLAG_INITIAL)
2914	goto cleanup;
2915	if (!transaction->nr)
2916	goto cleanup;
2917
2918	CALLOC_ARRAY(backend_data, 1);
2919	strmap_init(&backend_data->ref_locks);
2920	transaction->backend_data = backend_data;
2921
2922	/*
2923	* Fail if any of the updates use REF_IS_PRUNING without REF_NO_DEREF.
2924	*/
2925	for (i = 0; i < transaction->nr; i++) {
2926	struct ref_update *update = transaction->updates[i];
2927
2928	if ((update->flags & REF_IS_PRUNING) &&
2929	!(update->flags & REF_NO_DEREF))
2930	BUG("REF_IS_PRUNING set without REF_NO_DEREF");
2931	}
2932
2933	/*
2934	* Special hack: If a branch is updated directly and HEAD
2935	* points to it (may happen on the remote side of a push
2936	* for example) then logically the HEAD reflog should be
2937	* updated too.
2938	*
2939	* A generic solution would require reverse symref lookups,
2940	* but finding all symrefs pointing to a given branch would be
2941	* rather costly for this rare event (the direct update of a
2942	* branch) to be worth it. So let's cheat and check with HEAD
2943	* only, which should cover 99% of all usage scenarios (even
2944	* 100% of the default ones).
2945	*
2946	* So if HEAD is a symbolic reference, then record the name of
2947	* the reference that it points to. If we see an update of
2948	* head_ref within the transaction, then split_head_update()
2949	* arranges for the reflog of HEAD to be updated, too.
2950	*/
2951	head_ref = refs_resolve_refdup(ref_store, "HEAD",
2952	RESOLVE_REF_NO_RECURSE,
2953	NULL, &head_type);
2954
2955	if (head_ref && !(head_type & REF_ISSYMREF)) {
2956	FREE_AND_NULL(head_ref);
2957	}
2958
2959	/*
2960	* Acquire all locks, verify old values if provided, check
2961	* that new values are valid, and write new values to the
2962	* lockfiles, ready to be activated. Only keep one lockfile
2963	* open at a time to avoid running out of file descriptors.
2964	* Note that lock_ref_for_update() might append more updates
2965	* to the transaction.
2966	*/
2967	for (i = 0; i < transaction->nr; i++) {
2968	struct ref_update *update = transaction->updates[i];
2969
2970	ret = lock_ref_for_update(refs, update, i, transaction,
2971	head_ref, &refnames_to_check,
2972	err);
2973	if (ret) {
2974	if (ref_transaction_maybe_set_rejected(transaction, i,
2975	ret, err)) {
2976	ret = 0;
2977	continue;
2978	}
2979	goto cleanup;
2980	}
2981
2982	if (update->flags & REF_DELETING &&
2983	!(update->flags & REF_LOG_ONLY) &&
2984	!(update->flags & REF_IS_PRUNING)) {
2985	/*
2986	* This reference has to be deleted from
2987	* packed-refs if it exists there.
2988	*/
2989	if (!packed_transaction) {
2990	packed_transaction = ref_store_transaction_begin(
2991	refs->packed_ref_store,
2992	transaction->flags, err);
2993	if (!packed_transaction) {
2994	ret = REF_TRANSACTION_ERROR_GENERIC;
2995	goto cleanup;
2996	}
2997
2998	backend_data->packed_transaction =
2999	packed_transaction;
3000	}
3001
3002	ref_transaction_add_update(
3003	packed_transaction, update->refname,
3004	REF_HAVE_NEW \| REF_NO_DEREF,
3005	&update->new_oid, NULL, NULL,
3006	NULL, NULL, NULL, NULL);
3007	}
3008	}
3009
3010	/*
3011	* Verify that none of the loose reference that we're about to write
3012	* conflict with any existing packed references. Ideally, we'd do this
3013	* check after the packed-refs are locked so that the file cannot
3014	* change underneath our feet. But introducing such a lock now would
3015	* probably do more harm than good as users rely on there not being a
3016	* global lock with the "files" backend.
3017	*
3018	* Another alternative would be to do the check after the (optional)
3019	* lock, but that would extend the time we spend in the globally-locked
3020	* state.
3021	*
3022	* So instead, we accept the race for now.
3023	*/
3024	if (refs_verify_refnames_available(refs->packed_ref_store, &refnames_to_check,
3025	&transaction->refnames, NULL, transaction,
3026	0, err)) {
3027	ret = REF_TRANSACTION_ERROR_NAME_CONFLICT;
3028	goto cleanup;
3029	}
3030
3031	if (packed_transaction) {
3032	if (packed_refs_lock(refs->packed_ref_store, 0, err)) {
3033	ret = REF_TRANSACTION_ERROR_GENERIC;
3034	goto cleanup;
3035	}
3036	backend_data->packed_refs_locked = 1;
3037
3038	if (is_packed_transaction_needed(refs->packed_ref_store,
3039	packed_transaction)) {
3040	ret = ref_transaction_prepare(packed_transaction, err);
3041	/*
3042	* A failure during the prepare step will abort
3043	* itself, but not free. Do that now, and disconnect
3044	* from the files_transaction so it does not try to
3045	* abort us when we hit the cleanup code below.
3046	*/
3047	if (ret) {
3048	ref_transaction_free(packed_transaction);
3049	backend_data->packed_transaction = NULL;
3050	}
3051	} else {
3052	/*
3053	* We can skip rewriting the `packed-refs`
3054	* file. But we do need to leave it locked, so
3055	* that somebody else doesn't pack a reference
3056	* that we are trying to delete.
3057	*
3058	* We need to disconnect our transaction from
3059	* backend_data, since the abort (whether successful or
3060	* not) will free it.
3061	*/
3062	backend_data->packed_transaction = NULL;
3063	if (ref_transaction_abort(packed_transaction, err)) {
3064	ret = REF_TRANSACTION_ERROR_GENERIC;
3065	goto cleanup;
3066	}
3067	}
3068	}
3069
3070	cleanup:
3071	free(head_ref);
3072	string_list_clear(&refnames_to_check, 1);
3073
3074	if (ret)
3075	files_transaction_cleanup(refs, transaction);
3076	else
3077	transaction->state = REF_TRANSACTION_PREPARED;
3078
3079	return ret;
3080	}
3081
3082	static int parse_and_write_reflog(struct files_ref_store *refs,
3083	struct ref_update *update,
3084	struct ref_lock *lock,
3085	struct strbuf *err)
3086	{
3087	struct object_id *old_oid = &lock->old_oid;
3088
3089	if (update->flags & REF_LOG_USE_PROVIDED_OIDS) {
3090	if (!(update->flags & REF_HAVE_OLD) \|\|
3091	!(update->flags & REF_HAVE_NEW) \|\|
3092	!(update->flags & REF_LOG_ONLY)) {
3093	strbuf_addf(err, _("trying to write reflog for '%s' "
3094	"with incomplete values"), update->refname);
3095	return REF_TRANSACTION_ERROR_GENERIC;
3096	}
3097
3098	old_oid = &update->old_oid;
3099	}
3100
3101	if (update->new_target) {
3102	/*
3103	* We want to get the resolved OID for the target, to ensure
3104	* that the correct value is added to the reflog.
3105	*/
3106	if (!refs_resolve_ref_unsafe(&refs->base, update->new_target,
3107	RESOLVE_REF_READING,
3108	&update->new_oid, NULL)) {
3109	/*
3110	* TODO: currently we skip creating reflogs for dangling
3111	* symref updates. It would be nice to capture this as
3112	* zero oid updates however.
3113	*/
3114	return 0;
3115	}
3116	}
3117
3118	if (files_log_ref_write(refs, lock->ref_name, old_oid,
3119	&update->new_oid, update->committer_info,
3120	update->msg, update->flags, err)) {
3121	char *old_msg = strbuf_detach(err, NULL);
3122
3123	strbuf_addf(err, "cannot update the ref '%s': %s",
3124	lock->ref_name, old_msg);
3125	free(old_msg);
3126	unlock_ref(lock);
3127	update->backend_data = NULL;
3128	return -1;
3129	}
3130
3131	return 0;
3132	}
3133
3134	static int ref_present(const struct reference ref, void cb_data)
3135	{
3136	struct string_list *affected_refnames = cb_data;
3137
3138	return string_list_has_string(affected_refnames, ref->name);
3139	}
3140
3141	static int files_transaction_finish_initial(struct files_ref_store *refs,
3142	struct ref_transaction *transaction,
3143	struct strbuf *err)
3144	{
3145	struct refs_for_each_ref_options opts = {
3146	.flags = REFS_FOR_EACH_INCLUDE_BROKEN,
3147	};
3148	size_t i;
3149	int ret = 0;
3150	struct string_list affected_refnames = STRING_LIST_INIT_NODUP;
3151	struct string_list refnames_to_check = STRING_LIST_INIT_NODUP;
3152	struct ref_transaction *packed_transaction = NULL;
3153	struct ref_transaction *loose_transaction = NULL;
3154
3155	assert(err);
3156
3157	if (transaction->state != REF_TRANSACTION_PREPARED)
3158	BUG("commit called for transaction that is not prepared");
3159
3160	/*
3161	* It's really undefined to call this function in an active
3162	* repository or when there are existing references: we are
3163	* only locking and changing packed-refs, so (1) any
3164	* simultaneous processes might try to change a reference at
3165	* the same time we do, and (2) any existing loose versions of
3166	* the references that we are setting would have precedence
3167	* over our values. But some remote helpers create the remote
3168	* "HEAD" and "master" branches before calling this function,
3169	* so here we really only check that none of the references
3170	* that we are creating already exists.
3171	*/
3172	if (refs_for_each_ref_ext(&refs->base, ref_present,
3173	&transaction->refnames, &opts))
3174	BUG("initial ref transaction called with existing refs");
3175
3176	packed_transaction = ref_store_transaction_begin(refs->packed_ref_store,
3177	transaction->flags, err);
3178	if (!packed_transaction) {
3179	ret = REF_TRANSACTION_ERROR_GENERIC;
3180	goto cleanup;
3181	}
3182
3183	for (i = 0; i < transaction->nr; i++) {
3184	struct ref_update *update = transaction->updates[i];
3185
3186	if (!(update->flags & REF_LOG_ONLY) &&
3187	(update->flags & REF_HAVE_OLD) &&
3188	!is_null_oid(&update->old_oid))
3189	BUG("initial ref transaction with old_sha1 set");
3190
3191	string_list_append(&refnames_to_check, update->refname);
3192
3193	/*
3194	* packed-refs don't support symbolic refs, root refs and reflogs,
3195	* so we have to queue these references via the loose transaction.
3196	*/
3197	if (update->new_target \|\|
3198	is_root_ref(update->refname) \|\|
3199	(update->flags & REF_LOG_ONLY)) {
3200	if (!loose_transaction) {
3201	loose_transaction = ref_store_transaction_begin(&refs->base, 0, err);
3202	if (!loose_transaction) {
3203	ret = REF_TRANSACTION_ERROR_GENERIC;
3204	goto cleanup;
3205	}
3206	}
3207
3208	if (update->flags & REF_LOG_ONLY)
3209	ref_transaction_add_update(loose_transaction, update->refname,
3210	update->flags, &update->new_oid,
3211	&update->old_oid, &update->peeled,
3212	NULL, NULL,
3213	update->committer_info, update->msg);
3214	else
3215	ref_transaction_add_update(loose_transaction, update->refname,
3216	update->flags & ~REF_HAVE_OLD,
3217	update->new_target ? NULL : &update->new_oid, NULL,
3218	&update->peeled, update->new_target,
3219	NULL, update->committer_info,
3220	NULL);
3221	} else {
3222	ref_transaction_add_update(packed_transaction, update->refname,
3223	update->flags & ~REF_HAVE_OLD,
3224	&update->new_oid, &update->old_oid,
3225	&update->peeled, NULL, NULL,
3226	update->committer_info, NULL);
3227	}
3228	}
3229
3230	if (packed_refs_lock(refs->packed_ref_store, 0, err)) {
3231	ret = REF_TRANSACTION_ERROR_GENERIC;
3232	goto cleanup;
3233	}
3234
3235	if (refs_verify_refnames_available(&refs->base, &refnames_to_check,
3236	&affected_refnames, NULL, transaction,
3237	1, err)) {
3238	packed_refs_unlock(refs->packed_ref_store);
3239	ret = REF_TRANSACTION_ERROR_NAME_CONFLICT;
3240	goto cleanup;
3241	}
3242
3243	if (ref_transaction_commit(packed_transaction, err)) {
3244	ret = REF_TRANSACTION_ERROR_GENERIC;
3245	goto cleanup;
3246	}
3247	packed_refs_unlock(refs->packed_ref_store);
3248
3249	if (loose_transaction) {
3250	if (ref_transaction_prepare(loose_transaction, err) \|\|
3251	ref_transaction_commit(loose_transaction, err)) {
3252	ret = REF_TRANSACTION_ERROR_GENERIC;
3253	goto cleanup;
3254	}
3255	}
3256
3257	cleanup:
3258	if (loose_transaction)
3259	ref_transaction_free(loose_transaction);
3260	if (packed_transaction)
3261	ref_transaction_free(packed_transaction);
3262	transaction->state = REF_TRANSACTION_CLOSED;
3263	string_list_clear(&affected_refnames, 0);
3264	string_list_clear(&refnames_to_check, 0);
3265	return ret;
3266	}
3267
3268	static int files_transaction_finish(struct ref_store *ref_store,
3269	struct ref_transaction *transaction,
3270	struct strbuf *err)
3271	{
3272	struct files_ref_store *refs =
3273	files_downcast(ref_store, 0, "ref_transaction_finish");
3274	size_t i;
3275	int ret = 0;
3276	struct strbuf sb = STRBUF_INIT;
3277	struct files_transaction_backend_data *backend_data;
3278	struct ref_transaction *packed_transaction;
3279
3280
3281	assert(err);
3282
3283	if (transaction->flags & REF_TRANSACTION_FLAG_INITIAL)
3284	return files_transaction_finish_initial(refs, transaction, err);
3285	if (!transaction->nr) {
3286	transaction->state = REF_TRANSACTION_CLOSED;
3287	return 0;
3288	}
3289
3290	backend_data = transaction->backend_data;
3291	packed_transaction = backend_data->packed_transaction;
3292
3293	/* Perform updates first so live commits remain referenced */
3294	for (i = 0; i < transaction->nr; i++) {
3295	struct ref_update *update = transaction->updates[i];
3296	struct ref_lock *lock = update->backend_data;
3297
3298	if (update->rejection_err)
3299	continue;
3300
3301	if (update->flags & REF_NEEDS_COMMIT \|\|
3302	update->flags & REF_LOG_ONLY) {
3303	if (parse_and_write_reflog(refs, update, lock, err)) {
3304	ret = REF_TRANSACTION_ERROR_GENERIC;
3305	goto cleanup;
3306	}
3307	}
3308
3309	/*
3310	* We try creating a symlink, if that succeeds we continue to the
3311	* next update. If not, we try and create a regular symref.
3312	*/
3313	if (update->new_target && refs->prefer_symlink_refs)
3314	/*
3315	* By using the `NOT_CONSTANT()` trick, we can avoid
3316	* errors by `clang`'s `-Wunreachable` logic that would
3317	* report that the `continue` statement is not reachable
3318	* when `NO_SYMLINK_HEAD` is `#define`d.
3319	*/
3320	if (NOT_CONSTANT(!create_ref_symlink(lock, update->new_target)))
3321	continue;
3322
3323	if (update->flags & REF_NEEDS_COMMIT) {
3324	clear_loose_ref_cache(refs);
3325	if (commit_ref(lock)) {
3326	strbuf_addf(err, "couldn't set '%s'", lock->ref_name);
3327	unlock_ref(lock);
3328	update->backend_data = NULL;
3329	ret = REF_TRANSACTION_ERROR_GENERIC;
3330	goto cleanup;
3331	}
3332	}
3333	}
3334
3335	/*
3336	* Now that updates are safely completed, we can perform
3337	* deletes. First delete the reflogs of any references that
3338	* will be deleted, since (in the unexpected event of an
3339	* error) leaving a reference without a reflog is less bad
3340	* than leaving a reflog without a reference (the latter is a
3341	* mildly invalid repository state):
3342	*/
3343	for (i = 0; i < transaction->nr; i++) {
3344	struct ref_update *update = transaction->updates[i];
3345
3346	if (update->rejection_err)
3347	continue;
3348
3349	if (update->flags & REF_DELETING &&
3350	!(update->flags & REF_LOG_ONLY) &&
3351	!(update->flags & REF_IS_PRUNING)) {
3352	strbuf_reset(&sb);
3353	files_reflog_path(refs, &sb, update->refname);
3354	if (!unlink_or_warn(sb.buf))
3355	try_remove_empty_parents(refs, update->refname,
3356	REMOVE_EMPTY_PARENTS_REFLOG);
3357	}
3358	}
3359
3360	/*
3361	* Perform deletes now that updates are safely completed.
3362	*
3363	* First delete any packed versions of the references, while
3364	* retaining the packed-refs lock:
3365	*/
3366	if (packed_transaction) {
3367	ret = ref_transaction_commit(packed_transaction, err);
3368	ref_transaction_free(packed_transaction);
3369	packed_transaction = NULL;
3370	backend_data->packed_transaction = NULL;
3371	if (ret)
3372	goto cleanup;
3373	}
3374
3375	/* Now delete the loose versions of the references: */
3376	for (i = 0; i < transaction->nr; i++) {
3377	struct ref_update *update = transaction->updates[i];
3378	struct ref_lock *lock = update->backend_data;
3379
3380	if (update->rejection_err)
3381	continue;
3382
3383	if (update->flags & REF_DELETING &&
3384	!(update->flags & REF_LOG_ONLY)) {
3385	update->flags \|= REF_DELETED_RMDIR;
3386	if (!(update->type & REF_ISPACKED) \|\|
3387	update->type & REF_ISSYMREF) {
3388	/* It is a loose reference. */
3389	strbuf_reset(&sb);
3390	files_ref_path(refs, &sb, lock->ref_name);
3391	if (unlink_or_msg(sb.buf, err)) {
3392	ret = REF_TRANSACTION_ERROR_GENERIC;
3393	goto cleanup;
3394	}
3395	}
3396	}
3397	}
3398
3399	clear_loose_ref_cache(refs);
3400
3401	cleanup:
3402	files_transaction_cleanup(refs, transaction);
3403
3404	for (i = 0; i < transaction->nr; i++) {
3405	struct ref_update *update = transaction->updates[i];
3406
3407	if (update->flags & REF_DELETED_RMDIR) {
3408	/*
3409	* The reference was deleted. Delete any
3410	* empty parent directories. (Note that this
3411	* can only work because we have already
3412	* removed the lockfile.)
3413	*/
3414	try_remove_empty_parents(refs, update->refname,
3415	REMOVE_EMPTY_PARENTS_REF);
3416	}
3417	}
3418
3419	strbuf_release(&sb);
3420	return ret;
3421	}
3422
3423	static int files_transaction_abort(struct ref_store *ref_store,
3424	struct ref_transaction *transaction,
3425	struct strbuf *err UNUSED)
3426	{
3427	struct files_ref_store *refs =
3428	files_downcast(ref_store, 0, "ref_transaction_abort");
3429
3430	files_transaction_cleanup(refs, transaction);
3431	return 0;
3432	}
3433
3434	struct expire_reflog_cb {
3435	reflog_expiry_should_prune_fn *should_prune_fn;
3436	void *policy_cb;
3437	FILE *newlog;
3438	struct object_id last_kept_oid;
3439	unsigned int rewrite:1,
3440	dry_run:1;
3441	};
3442
3443	static int expire_reflog_ent(const char *refname UNUSED,
3444	struct object_id ooid, struct object_id noid,
3445	const char *email, timestamp_t timestamp, int tz,
3446	const char message, void cb_data)
3447	{
3448	struct expire_reflog_cb *cb = cb_data;
3449	reflog_expiry_should_prune_fn *fn = cb->should_prune_fn;
3450
3451	if (cb->rewrite)
3452	ooid = &cb->last_kept_oid;
3453
3454	if (fn(ooid, noid, email, timestamp, tz, message, cb->policy_cb))
3455	return 0;
3456
3457	if (cb->dry_run)
3458	return 0; /* --dry-run */
3459
3460	fprintf(cb->newlog, "%s %s %s %"PRItime" %+05d\t%s", oid_to_hex(ooid),
3461	oid_to_hex(noid), email, timestamp, tz, message);
3462	oidcpy(&cb->last_kept_oid, noid);
3463
3464	return 0;
3465	}
3466
3467	static int files_reflog_expire(struct ref_store *ref_store,
3468	const char *refname,
3469	unsigned int expire_flags,
3470	reflog_expiry_prepare_fn prepare_fn,
3471	reflog_expiry_should_prune_fn should_prune_fn,
3472	reflog_expiry_cleanup_fn cleanup_fn,
3473	void *policy_cb_data)
3474	{
3475	struct files_ref_store *refs =
3476	files_downcast(ref_store, REF_STORE_WRITE, "reflog_expire");
3477	struct lock_file reflog_lock = LOCK_INIT;
3478	struct expire_reflog_cb cb;
3479	struct ref_lock *lock;
3480	struct strbuf log_file_sb = STRBUF_INIT;
3481	char *log_file;
3482	int status = 0;
3483	struct strbuf err = STRBUF_INIT;
3484	const struct object_id *oid;
3485
3486	memset(&cb, 0, sizeof(cb));
3487	cb.rewrite = !!(expire_flags & EXPIRE_REFLOGS_REWRITE);
3488	cb.dry_run = !!(expire_flags & EXPIRE_REFLOGS_DRY_RUN);
3489	cb.policy_cb = policy_cb_data;
3490	cb.should_prune_fn = should_prune_fn;
3491
3492	/*
3493	* The reflog file is locked by holding the lock on the
3494	* reference itself, plus we might need to update the
3495	* reference if --updateref was specified:
3496	*/
3497	lock = lock_ref_oid_basic(refs, refname, &err);
3498	if (!lock) {
3499	error("cannot lock ref '%s': %s", refname, err.buf);
3500	strbuf_release(&err);
3501	return -1;
3502	}
3503	oid = &lock->old_oid;
3504
3505	/*
3506	* When refs are deleted, their reflog is deleted before the
3507	* ref itself is deleted. This is because there is no separate
3508	* lock for reflog; instead we take a lock on the ref with
3509	* lock_ref_oid_basic().
3510	*
3511	* If a race happens and the reflog doesn't exist after we've
3512	* acquired the lock that's OK. We've got nothing more to do;
3513	* We were asked to delete the reflog, but someone else
3514	* deleted it! The caller doesn't care that we deleted it,
3515	* just that it is deleted. So we can return successfully.
3516	*/
3517	if (!refs_reflog_exists(ref_store, refname)) {
3518	unlock_ref(lock);
3519	return 0;
3520	}
3521
3522	files_reflog_path(refs, &log_file_sb, refname);
3523	log_file = strbuf_detach(&log_file_sb, NULL);
3524	if (!cb.dry_run) {
3525	/*
3526	* Even though holding $GIT_DIR/logs/$reflog.lock has
3527	* no locking implications, we use the lock_file
3528	* machinery here anyway because it does a lot of the
3529	* work we need, including cleaning up if the program
3530	* exits unexpectedly.
3531	*/
3532	if (hold_lock_file_for_update(&reflog_lock, log_file, 0) < 0) {
3533	struct strbuf err = STRBUF_INIT;
3534	unable_to_lock_message(log_file, errno, &err);
3535	error("%s", err.buf);
3536	strbuf_release(&err);
3537	goto failure;
3538	}
3539	cb.newlog = fdopen_lock_file(&reflog_lock, "w");
3540	if (!cb.newlog) {
3541	error("cannot fdopen %s (%s)",
3542	get_lock_file_path(&reflog_lock), strerror(errno));
3543	goto failure;
3544	}
3545	}
3546
3547	(*prepare_fn)(refname, oid, cb.policy_cb);
3548	refs_for_each_reflog_ent(ref_store, refname, expire_reflog_ent, &cb);
3549	(*cleanup_fn)(cb.policy_cb);
3550
3551	if (!cb.dry_run) {
3552	/*
3553	* It doesn't make sense to adjust a reference pointed
3554	* to by a symbolic ref based on expiring entries in
3555	* the symbolic reference's reflog. Nor can we update
3556	* a reference if there are no remaining reflog
3557	* entries.
3558	*/
3559	int update = 0;
3560
3561	if ((expire_flags & EXPIRE_REFLOGS_UPDATE_REF) &&
3562	!is_null_oid(&cb.last_kept_oid)) {
3563	int type;
3564	const char *ref;
3565
3566	ref = refs_resolve_ref_unsafe(&refs->base, refname,
3567	RESOLVE_REF_NO_RECURSE,
3568	NULL, &type);
3569	update = !!(ref && !(type & REF_ISSYMREF));
3570	}
3571
3572	if (close_lock_file_gently(&reflog_lock)) {
3573	status \|= error("couldn't write %s: %s", log_file,
3574	strerror(errno));
3575	rollback_lock_file(&reflog_lock);
3576	} else if (update &&
3577	(write_in_full(get_lock_file_fd(&lock->lk),
3578	oid_to_hex(&cb.last_kept_oid), refs->base.repo->hash_algo->hexsz) < 0 \|\|
3579	write_str_in_full(get_lock_file_fd(&lock->lk), "\n") < 0 \|\|
3580	close_ref_gently(lock) < 0)) {
3581	status \|= error("couldn't write %s",
3582	get_lock_file_path(&lock->lk));
3583	rollback_lock_file(&reflog_lock);
3584	} else if (commit_lock_file(&reflog_lock)) {
3585	status \|= error("unable to write reflog '%s' (%s)",
3586	log_file, strerror(errno));
3587	} else if (update && commit_ref(lock)) {
3588	status \|= error("couldn't set %s", lock->ref_name);
3589	}
3590	}
3591	free(log_file);
3592	unlock_ref(lock);
3593	return status;
3594
3595	failure:
3596	rollback_lock_file(&reflog_lock);
3597	free(log_file);
3598	unlock_ref(lock);
3599	return -1;
3600	}
3601
3602	static int files_ref_store_create_on_disk(struct ref_store *ref_store,
3603	int flags,
3604	struct strbuf *err UNUSED)
3605	{
3606	struct files_ref_store *refs =
3607	files_downcast(ref_store, REF_STORE_WRITE, "create");
3608	struct strbuf sb = STRBUF_INIT;
3609
3610	/*
3611	* We need to create a "refs" dir in any case so that older versions of
3612	* Git can tell that this is a repository. This serves two main purposes:
3613	*
3614	* - Clients will know to stop walking the parent-directory chain when
3615	* detecting the Git repository. Otherwise they may end up detecting
3616	* a Git repository in a parent directory instead.
3617	*
3618	* - Instead of failing to detect a repository with unknown reference
3619	* format altogether, old clients will print an error saying that
3620	* they do not understand the reference format extension.
3621	*/
3622	strbuf_addf(&sb, "%s/refs", ref_store->gitdir);
3623	safe_create_dir(the_repository, sb.buf, 1);
3624	adjust_shared_perm(the_repository, sb.buf);
3625
3626	/*
3627	* There is no need to create directories for common refs when creating
3628	* a worktree ref store.
3629	*/
3630	if (!(flags & REF_STORE_CREATE_ON_DISK_IS_WORKTREE)) {
3631	/*
3632	* Create .git/refs/{heads,tags}
3633	*/
3634	strbuf_reset(&sb);
3635	files_ref_path(refs, &sb, "refs/heads");
3636	safe_create_dir(the_repository, sb.buf, 1);
3637
3638	strbuf_reset(&sb);
3639	files_ref_path(refs, &sb, "refs/tags");
3640	safe_create_dir(the_repository, sb.buf, 1);
3641	}
3642
3643	strbuf_release(&sb);
3644	return 0;
3645	}
3646
3647	struct remove_one_root_ref_data {
3648	const char *gitdir;
3649	struct strbuf *err;
3650	};
3651
3652	static int remove_one_root_ref(const char *refname,
3653	void *cb_data)
3654	{
3655	struct remove_one_root_ref_data *data = cb_data;
3656	struct strbuf buf = STRBUF_INIT;
3657	int ret = 0;
3658
3659	strbuf_addf(&buf, "%s/%s", data->gitdir, refname);
3660
3661	ret = unlink(buf.buf);
3662	if (ret < 0)
3663	strbuf_addf(data->err, "could not delete %s: %s\n",
3664	refname, strerror(errno));
3665
3666	strbuf_release(&buf);
3667	return ret;
3668	}
3669
3670	static int files_ref_store_remove_on_disk(struct ref_store *ref_store,
3671	struct strbuf *err)
3672	{
3673	struct files_ref_store *refs =
3674	files_downcast(ref_store, REF_STORE_WRITE, "remove");
3675	struct remove_one_root_ref_data data = {
3676	.gitdir = refs->base.gitdir,
3677	.err = err,
3678	};
3679	struct strbuf sb = STRBUF_INIT;
3680	int ret = 0;
3681
3682	strbuf_addf(&sb, "%s/refs", refs->base.gitdir);
3683	if (remove_dir_recursively(&sb, 0) < 0) {
3684	strbuf_addf(err, "could not delete refs: %s",
3685	strerror(errno));
3686	ret = -1;
3687	}
3688	strbuf_reset(&sb);
3689
3690	strbuf_addf(&sb, "%s/logs", refs->base.gitdir);
3691	if (remove_dir_recursively(&sb, 0) < 0) {
3692	strbuf_addf(err, "could not delete logs: %s",
3693	strerror(errno));
3694	ret = -1;
3695	}
3696	strbuf_reset(&sb);
3697
3698	if (for_each_root_ref(refs, remove_one_root_ref, &data) < 0)
3699	ret = -1;
3700
3701	/*
3702	* Directly access the cleanup functions for packed-refs as the generic function
3703	* would try to clear stubs which isn't required for the files backend.
3704	*/
3705	if (refs->packed_ref_store->be->remove_on_disk(refs->packed_ref_store, err) < 0)
3706	ret = -1;
3707
3708	strbuf_release(&sb);
3709	return ret;
3710	}
3711
3712	/*
3713	* For refs and reflogs, they share a unified interface when scanning
3714	* the whole directory. This function is used as the callback for each
3715	* regular file or symlink in the directory.
3716	*/
3717	typedef int (files_fsck_refs_fn)(struct ref_store ref_store,
3718	struct fsck_options *o,
3719	const char *refname,
3720	const char *path,
3721	int mode);
3722
3723	static int files_fsck_symref_target(struct ref_store *ref_store,
3724	struct fsck_options *o,
3725	struct fsck_ref_report *report,
3726	const char *refname,
3727	struct strbuf *referent,
3728	unsigned int symbolic_link)
3729	{
3730	char orig_last_byte;
3731	size_t orig_len;
3732	int ret = 0;
3733
3734	orig_len = referent->len;
3735	orig_last_byte = referent->buf[orig_len - 1];
3736
3737	if (!symbolic_link) {
3738	strbuf_rtrim(referent);
3739
3740	if (referent->len == orig_len \|\|
3741	(referent->len < orig_len && orig_last_byte != '\n')) {
3742	ret \|= fsck_report_ref(o, report,
3743	FSCK_MSG_REF_MISSING_NEWLINE,
3744	"misses LF at the end");
3745	}
3746
3747	if (referent->len != orig_len && referent->len != orig_len - 1) {
3748	ret \|= fsck_report_ref(o, report,
3749	FSCK_MSG_TRAILING_REF_CONTENT,
3750	"has trailing whitespaces or newlines");
3751	}
3752	}
3753
3754	ret \|= refs_fsck_symref(ref_store, o, report, refname, referent->buf);
3755
3756	return ret ? -1 : 0;
3757	}
3758
3759	static int files_fsck_refs_content(struct ref_store *ref_store,
3760	struct fsck_options *o,
3761	const char *target_name,
3762	const char *path,
3763	int mode)
3764	{
3765	struct strbuf ref_content = STRBUF_INIT;
3766	struct strbuf abs_gitdir = STRBUF_INIT;
3767	struct strbuf referent = STRBUF_INIT;
3768	struct fsck_ref_report report = { 0 };
3769	const char *trailing = NULL;
3770	unsigned int type = 0;
3771	int failure_errno = 0;
3772	struct object_id oid;
3773	int ret = 0;
3774
3775	report.path = target_name;
3776
3777	if (S_ISLNK(mode)) {
3778	const char *relative_referent_path = NULL;
3779
3780	ret = fsck_report_ref(o, &report,
3781	FSCK_MSG_SYMLINK_REF,
3782	"use deprecated symbolic link for symref");
3783
3784	strbuf_add_absolute_path(&abs_gitdir, ref_store->repo->gitdir);
3785	strbuf_normalize_path(&abs_gitdir);
3786	if (!is_dir_sep(abs_gitdir.buf[abs_gitdir.len - 1]))
3787	strbuf_addch(&abs_gitdir, '/');
3788
3789	strbuf_add_real_path(&ref_content, path);
3790	skip_prefix(ref_content.buf, abs_gitdir.buf,
3791	&relative_referent_path);
3792
3793	if (relative_referent_path)
3794	strbuf_addstr(&referent, relative_referent_path);
3795	else
3796	strbuf_addbuf(&referent, &ref_content);
3797
3798	ret \|= files_fsck_symref_target(ref_store, o, &report,
3799	target_name, &referent, 1);
3800	goto cleanup;
3801	}
3802
3803	if (strbuf_read_file(&ref_content, path, 0) < 0) {
3804	/*
3805	* Ref file could be removed by another concurrent process. We should
3806	* ignore this error and continue to the next ref.
3807	*/
3808	if (errno == ENOENT)
3809	goto cleanup;
3810
3811	ret = error_errno(_("cannot read ref file '%s'"), path);
3812	goto cleanup;
3813	}
3814
3815	if (parse_loose_ref_contents(ref_store->repo->hash_algo,
3816	ref_content.buf, &oid, &referent,
3817	&type, &trailing, &failure_errno)) {
3818	strbuf_rtrim(&ref_content);
3819	ret = fsck_report_ref(o, &report,
3820	FSCK_MSG_BAD_REF_CONTENT,
3821	"%s", ref_content.buf);
3822	goto cleanup;
3823	}
3824
3825	if (!(type & REF_ISSYMREF)) {
3826	if (!*trailing) {
3827	ret = fsck_report_ref(o, &report,
3828	FSCK_MSG_REF_MISSING_NEWLINE,
3829	"misses LF at the end");
3830	goto cleanup;
3831	}
3832	if (trailing != '\n' \|\| (trailing + 1)) {
3833	ret = fsck_report_ref(o, &report,
3834	FSCK_MSG_TRAILING_REF_CONTENT,
3835	"has trailing garbage: '%s'", trailing);
3836	goto cleanup;
3837	}
3838
3839	ret = refs_fsck_ref(ref_store, o, &report, target_name, &oid);
3840	} else {
3841	ret = files_fsck_symref_target(ref_store, o, &report,
3842	target_name, &referent, 0);
3843	goto cleanup;
3844	}
3845
3846	cleanup:
3847	strbuf_release(&ref_content);
3848	strbuf_release(&referent);
3849	strbuf_release(&abs_gitdir);
3850	return ret;
3851	}
3852
3853	static int files_fsck_refs_name(struct ref_store *ref_store UNUSED,
3854	struct fsck_options *o,
3855	const char *refname,
3856	const char *path UNUSED,
3857	int mode UNUSED)
3858	{
3859	struct strbuf sb = STRBUF_INIT;
3860	int ret = 0;
3861
3862	if (is_root_ref(refname))
3863	goto cleanup;
3864
3865	if (check_refname_format(refname, 0)) {
3866	struct fsck_ref_report report = { 0 };
3867
3868	report.path = refname;
3869	ret = fsck_report_ref(o, &report,
3870	FSCK_MSG_BAD_REF_NAME,
3871	"invalid refname format");
3872	}
3873
3874	cleanup:
3875	strbuf_release(&sb);
3876	return ret;
3877	}
3878
3879	static const files_fsck_refs_fn fsck_refs_fn[]= {
3880	files_fsck_refs_name,
3881	files_fsck_refs_content,
3882	NULL,
3883	};
3884
3885	static int files_fsck_ref(struct ref_store *ref_store,
3886	struct fsck_options *o,
3887	const char *refname,
3888	const char *path,
3889	int mode)
3890	{
3891	int ret = 0;
3892
3893	if (o->verbose)
3894	fprintf_ln(stderr, "Checking %s", refname);
3895
3896	if (!S_ISREG(mode) && !S_ISLNK(mode)) {
3897	struct fsck_ref_report report = { .path = refname };
3898
3899	if (fsck_report_ref(o, &report,
3900	FSCK_MSG_BAD_REF_FILETYPE,
3901	"unexpected file type"))
3902	ret = -1;
3903	goto out;
3904	}
3905
3906	for (size_t i = 0; fsck_refs_fn[i]; i++)
3907	if (fsck_refs_fn[i](ref_store, o, refname, path, mode))
3908	ret = -1;
3909
3910	out:
3911	return ret;
3912	}
3913
3914	static int files_fsck_refs_dir(struct ref_store *ref_store,
3915	struct fsck_options *o,
3916	struct worktree *wt)
3917	{
3918	struct strbuf refname = STRBUF_INIT;
3919	struct strbuf sb = STRBUF_INIT;
3920	struct dir_iterator *iter;
3921	const char *filename;
3922	int iter_status;
3923	int ret = 0;
3924
3925	strbuf_addf(&sb, "%s/refs", ref_store->gitdir);
3926
3927	iter = dir_iterator_begin(sb.buf, 0);
3928	if (!iter) {
3929	if (errno == ENOENT && !is_main_worktree(wt))
3930	goto out;
3931
3932	ret = error_errno(_("cannot open directory %s"), sb.buf);
3933	goto out;
3934	}
3935
3936	while ((iter_status = dir_iterator_advance(iter)) == ITER_OK) {
3937	if (S_ISDIR(iter->st.st_mode))
3938	continue;
3939
3940	strbuf_reset(&refname);
3941	if (!is_main_worktree(wt))
3942	strbuf_addf(&refname, "worktrees/%s/", wt->id);
3943	strbuf_addf(&refname, "refs/%s", iter->relative_path);
3944
3945	filename = basename((char *) iter->path.buf);
3946
3947	/*
3948	* Ignore the files ending with ".lock" as they may be lock files.
3949	* However, do not skip invalid refnames with '.lock' suffix.
3950	*/
3951	if (filename[0] != '.' && ends_with(filename, ".lock"))
3952	continue;
3953
3954	if (files_fsck_ref(ref_store, o, refname.buf,
3955	iter->path.buf, iter->st.st_mode) < 0)
3956	ret = -1;
3957	}
3958
3959	if (iter_status != ITER_DONE)
3960	ret = error(_("failed to iterate over '%s'"), sb.buf);
3961
3962	out:
3963	dir_iterator_free(iter);
3964	strbuf_release(&sb);
3965	strbuf_release(&refname);
3966	return ret;
3967	}
3968
3969	struct files_fsck_root_ref_data {
3970	struct files_ref_store *refs;
3971	struct fsck_options *o;
3972	struct worktree *wt;
3973	struct strbuf refname;
3974	struct strbuf path;
3975	};
3976
3977	static int files_fsck_root_ref(const char refname, void cb_data)
3978	{
3979	struct files_fsck_root_ref_data *data = cb_data;
3980	struct stat st;
3981
3982	strbuf_reset(&data->refname);
3983	if (!is_main_worktree(data->wt))
3984	strbuf_addf(&data->refname, "worktrees/%s/", data->wt->id);
3985	strbuf_addstr(&data->refname, refname);
3986
3987	strbuf_reset(&data->path);
3988	strbuf_addf(&data->path, "%s/%s", data->refs->gitcommondir, data->refname.buf);
3989
3990	if (stat(data->path.buf, &st)) {
3991	if (errno == ENOENT)
3992	return 0;
3993	return error_errno("failed to read ref: '%s'", data->path.buf);
3994	}
3995
3996	return files_fsck_ref(&data->refs->base, data->o, data->refname.buf,
3997	data->path.buf, st.st_mode);
3998	}
3999
4000	static int files_fsck(struct ref_store *ref_store,
4001	struct fsck_options *o,
4002	struct worktree *wt)
4003	{
4004	struct files_ref_store *refs =
4005	files_downcast(ref_store, REF_STORE_READ, "fsck");
4006	struct files_fsck_root_ref_data data = {
4007	.refs = refs,
4008	.o = o,
4009	.wt = wt,
4010	.refname = STRBUF_INIT,
4011	.path = STRBUF_INIT,
4012	};
4013	int ret = 0;
4014
4015	if (files_fsck_refs_dir(ref_store, o, wt) < 0)
4016	ret = -1;
4017
4018	if (for_each_root_ref(refs, files_fsck_root_ref, &data) < 0)
4019	ret = -1;
4020
4021	if (refs->packed_ref_store->be->fsck(refs->packed_ref_store, o, wt) < 0)
4022	ret = -1;
4023
4024	strbuf_release(&data.refname);
4025	strbuf_release(&data.path);
4026	return ret;
4027	}
4028
4029	struct ref_storage_be refs_be_files = {
4030	.name = "files",
4031	.init = files_ref_store_init,
4032	.release = files_ref_store_release,
4033	.create_on_disk = files_ref_store_create_on_disk,
4034	.remove_on_disk = files_ref_store_remove_on_disk,
4035
4036	.transaction_prepare = files_transaction_prepare,
4037	.transaction_finish = files_transaction_finish,
4038	.transaction_abort = files_transaction_abort,
4039
4040	.optimize = files_optimize,
4041	.optimize_required = files_optimize_required,
4042	.rename_ref = files_rename_ref,
4043	.copy_ref = files_copy_ref,
4044
4045	.iterator_begin = files_ref_iterator_begin,
4046	.read_raw_ref = files_read_raw_ref,
4047	.read_symbolic_ref = files_read_symbolic_ref,
4048
4049	.reflog_iterator_begin = files_reflog_iterator_begin,
4050	.for_each_reflog_ent = files_for_each_reflog_ent,
4051	.for_each_reflog_ent_reverse = files_for_each_reflog_ent_reverse,
4052	.reflog_exists = files_reflog_exists,
4053	.create_reflog = files_create_reflog,
4054	.delete_reflog = files_delete_reflog,
4055	.reflog_expire = files_reflog_expire,
4056
4057	.fsck = files_fsck,
4058	};