git

1
#define USE_THE_REPOSITORY_VARIABLE
2

3
#include "git-compat-util.h"
4
#include "abspath.h"
5
#include "copy.h"
6
#include "environment.h"
7
#include "exec-cmd.h"
8
#include "gettext.h"
9
#include "hex.h"
10
#include "object-name.h"
11
#include "refs.h"
12
#include "repository.h"
13
#include "config.h"
14
#include "dir.h"
15
#include "setup.h"
16
#include "string-list.h"
17
#include "chdir-notify.h"
18
#include "path.h"
19
#include "quote.h"
20
#include "trace2.h"
21
#include "worktree.h"
22
#include "exec-cmd.h"
23

24
static int inside_git_dir = -1;
25
static int inside_work_tree = -1;
26
static int work_tree_config_is_bogus;
27
enum allowed_bare_repo {
28
	ALLOWED_BARE_REPO_EXPLICIT = 0,
29
	ALLOWED_BARE_REPO_ALL,
30
};
31

32
static struct startup_info the_startup_info;
33
struct startup_info *startup_info = &the_startup_info;
34
const char *tmp_original_cwd;
35

36
/*
37
 * The input parameter must contain an absolute path, and it must already be
38
 * normalized.
39
 *
40
 * Find the part of an absolute path that lies inside the work tree by
41
 * dereferencing symlinks outside the work tree, for example:
42
 * /dir1/repo/dir2/file   (work tree is /dir1/repo)      -> dir2/file
43
 * /dir/file              (work tree is /)               -> dir/file
44
 * /dir/symlink1/symlink2 (symlink1 points to work tree) -> symlink2
45
 * /dir/repolink/file     (repolink points to /dir/repo) -> file
46
 * /dir/repo              (exactly equal to work tree)   -> (empty string)
47
 */
48
static int abspath_part_inside_repo(char *path)
49
{
50
	size_t len;
51
	size_t wtlen;
52
	char *path0;
53
	int off;
54
	const char *work_tree = precompose_string_if_needed(get_git_work_tree());
55
	struct strbuf realpath = STRBUF_INIT;
56

57
	if (!work_tree)
58
		return -1;
59
	wtlen = strlen(work_tree);
60
	len = strlen(path);
61
	off = offset_1st_component(path);
62

63
	/* check if work tree is already the prefix */
64
	if (wtlen <= len && !fspathncmp(path, work_tree, wtlen)) {
65
		if (path[wtlen] == '/') {
66
			memmove(path, path + wtlen + 1, len - wtlen);
67
			return 0;
68
		} else if (path[wtlen - 1] == '/' || path[wtlen] == '\0') {
69
			/* work tree is the root, or the whole path */
70
			memmove(path, path + wtlen, len - wtlen + 1);
71
			return 0;
72
		}
73
		/* work tree might match beginning of a symlink to work tree */
74
		off = wtlen;
75
	}
76
	path0 = path;
77
	path += off;
78

79
	/* check each '/'-terminated level */
80
	while (*path) {
81
		path++;
82
		if (*path == '/') {
83
			*path = '\0';
84
			strbuf_realpath(&realpath, path0, 1);
85
			if (fspathcmp(realpath.buf, work_tree) == 0) {
86
				memmove(path0, path + 1, len - (path - path0));
87
				strbuf_release(&realpath);
88
				return 0;
89
			}
90
			*path = '/';
91
		}
92
	}
93

94
	/* check whole path */
95
	strbuf_realpath(&realpath, path0, 1);
96
	if (fspathcmp(realpath.buf, work_tree) == 0) {
97
		*path0 = '\0';
98
		strbuf_release(&realpath);
99
		return 0;
100
	}
101

102
	strbuf_release(&realpath);
103
	return -1;
104
}
105

106
/*
107
 * Normalize "path", prepending the "prefix" for relative paths. If
108
 * remaining_prefix is not NULL, return the actual prefix still
109
 * remains in the path. For example, prefix = sub1/sub2/ and path is
110
 *
111
 *  foo          -> sub1/sub2/foo  (full prefix)
112
 *  ../foo       -> sub1/foo       (remaining prefix is sub1/)
113
 *  ../../bar    -> bar            (no remaining prefix)
114
 *  ../../sub1/sub2/foo -> sub1/sub2/foo (but no remaining prefix)
115
 *  `pwd`/../bar -> sub1/bar       (no remaining prefix)
116
 */
117
char *prefix_path_gently(const char *prefix, int len,
118
			 int *remaining_prefix, const char *path)
119
{
120
	const char *orig = path;
121
	char *sanitized;
122
	if (is_absolute_path(orig)) {
123
		sanitized = xmallocz(strlen(path));
124
		if (remaining_prefix)
125
			*remaining_prefix = 0;
126
		if (normalize_path_copy_len(sanitized, path, remaining_prefix)) {
127
			free(sanitized);
128
			return NULL;
129
		}
130
		if (abspath_part_inside_repo(sanitized)) {
131
			free(sanitized);
132
			return NULL;
133
		}
134
	} else {
135
		sanitized = xstrfmt("%.*s%s", len, len ? prefix : "", path);
136
		if (remaining_prefix)
137
			*remaining_prefix = len;
138
		if (normalize_path_copy_len(sanitized, sanitized, remaining_prefix)) {
139
			free(sanitized);
140
			return NULL;
141
		}
142
	}
143
	return sanitized;
144
}
145

146
char *prefix_path(const char *prefix, int len, const char *path)
147
{
148
	char *r = prefix_path_gently(prefix, len, NULL, path);
149
	if (!r) {
150
		const char *hint_path = get_git_work_tree();
151
		if (!hint_path)
152
			hint_path = get_git_dir();
153
		die(_("'%s' is outside repository at '%s'"), path,
154
		    absolute_path(hint_path));
155
	}
156
	return r;
157
}
158

159
int path_inside_repo(const char *prefix, const char *path)
160
{
161
	int len = prefix ? strlen(prefix) : 0;
162
	char *r = prefix_path_gently(prefix, len, NULL, path);
163
	if (r) {
164
		free(r);
165
		return 1;
166
	}
167
	return 0;
168
}
169

170
int check_filename(const char *prefix, const char *arg)
171
{
172
	char *to_free = NULL;
173
	struct stat st;
174

175
	if (skip_prefix(arg, ":/", &arg)) {
176
		if (!*arg) /* ":/" is root dir, always exists */
177
			return 1;
178
		prefix = NULL;
179
	} else if (skip_prefix(arg, ":!", &arg) ||
180
		   skip_prefix(arg, ":^", &arg)) {
181
		if (!*arg) /* excluding everything is silly, but allowed */
182
			return 1;
183
	}
184

185
	if (prefix)
186
		arg = to_free = prefix_filename(prefix, arg);
187

188
	if (!lstat(arg, &st)) {
189
		free(to_free);
190
		return 1; /* file exists */
191
	}
192
	if (is_missing_file_error(errno)) {
193
		free(to_free);
194
		return 0; /* file does not exist */
195
	}
196
	die_errno(_("failed to stat '%s'"), arg);
197
}
198

199
static void NORETURN die_verify_filename(struct repository *r,
200
					 const char *prefix,
201
					 const char *arg,
202
					 int diagnose_misspelt_rev)
203
{
204
	if (!diagnose_misspelt_rev)
205
		die(_("%s: no such path in the working tree.\n"
206
		      "Use 'git <command> -- <path>...' to specify paths that do not exist locally."),
207
		    arg);
208
	/*
209
	 * Saying "'(icase)foo' does not exist in the index" when the
210
	 * user gave us ":(icase)foo" is just stupid.  A magic pathspec
211
	 * begins with a colon and is followed by a non-alnum; do not
212
	 * let maybe_die_on_misspelt_object_name() even trigger.
213
	 */
214
	if (!(arg[0] == ':' && !isalnum(arg[1])))
215
		maybe_die_on_misspelt_object_name(r, arg, prefix);
216

217
	/* ... or fall back the most general message. */
218
	die(_("ambiguous argument '%s': unknown revision or path not in the working tree.\n"
219
	      "Use '--' to separate paths from revisions, like this:\n"
220
	      "'git <command> [<revision>...] -- [<file>...]'"), arg);
221

222
}
223

224
/*
225
 * Check for arguments that don't resolve as actual files,
226
 * but which look sufficiently like pathspecs that we'll consider
227
 * them such for the purposes of rev/pathspec DWIM parsing.
228
 */
229
static int looks_like_pathspec(const char *arg)
230
{
231
	const char *p;
232
	int escaped = 0;
233

234
	/*
235
	 * Wildcard characters imply the user is looking to match pathspecs
236
	 * that aren't in the filesystem. Note that this doesn't include
237
	 * backslash even though it's a glob special; by itself it doesn't
238
	 * cause any increase in the match. Likewise ignore backslash-escaped
239
	 * wildcard characters.
240
	 */
241
	for (p = arg; *p; p++) {
242
		if (escaped) {
243
			escaped = 0;
244
		} else if (is_glob_special(*p)) {
245
			if (*p == '\\')
246
				escaped = 1;
247
			else
248
				return 1;
249
		}
250
	}
251

252
	/* long-form pathspec magic */
253
	if (starts_with(arg, ":("))
254
		return 1;
255

256
	return 0;
257
}
258

259
/*
260
 * Verify a filename that we got as an argument for a pathspec
261
 * entry. Note that a filename that begins with "-" never verifies
262
 * as true, because even if such a filename were to exist, we want
263
 * it to be preceded by the "--" marker (or we want the user to
264
 * use a format like "./-filename")
265
 *
266
 * The "diagnose_misspelt_rev" is used to provide a user-friendly
267
 * diagnosis when dying upon finding that "name" is not a pathname.
268
 * If set to 1, the diagnosis will try to diagnose "name" as an
269
 * invalid object name (e.g. HEAD:foo). If set to 0, the diagnosis
270
 * will only complain about an inexisting file.
271
 *
272
 * This function is typically called to check that a "file or rev"
273
 * argument is unambiguous. In this case, the caller will want
274
 * diagnose_misspelt_rev == 1 when verifying the first non-rev
275
 * argument (which could have been a revision), and
276
 * diagnose_misspelt_rev == 0 for the next ones (because we already
277
 * saw a filename, there's not ambiguity anymore).
278
 */
279
void verify_filename(const char *prefix,
280
		     const char *arg,
281
		     int diagnose_misspelt_rev)
282
{
283
	if (*arg == '-')
284
		die(_("option '%s' must come before non-option arguments"), arg);
285
	if (looks_like_pathspec(arg) || check_filename(prefix, arg))
286
		return;
287
	die_verify_filename(the_repository, prefix, arg, diagnose_misspelt_rev);
288
}
289

290
/*
291
 * Opposite of the above: the command line did not have -- marker
292
 * and we parsed the arg as a refname.  It should not be interpretable
293
 * as a filename.
294
 */
295
void verify_non_filename(const char *prefix, const char *arg)
296
{
297
	if (!is_inside_work_tree() || is_inside_git_dir())
298
		return;
299
	if (*arg == '-')
300
		return; /* flag */
301
	if (!check_filename(prefix, arg))
302
		return;
303
	die(_("ambiguous argument '%s': both revision and filename\n"
304
	      "Use '--' to separate paths from revisions, like this:\n"
305
	      "'git <command> [<revision>...] -- [<file>...]'"), arg);
306
}
307

308
int get_common_dir(struct strbuf *sb, const char *gitdir)
309
{
310
	const char *git_env_common_dir = getenv(GIT_COMMON_DIR_ENVIRONMENT);
311
	if (git_env_common_dir) {
312
		strbuf_addstr(sb, git_env_common_dir);
313
		return 1;
314
	} else {
315
		return get_common_dir_noenv(sb, gitdir);
316
	}
317
}
318

319
int get_common_dir_noenv(struct strbuf *sb, const char *gitdir)
320
{
321
	struct strbuf data = STRBUF_INIT;
322
	struct strbuf path = STRBUF_INIT;
323
	int ret = 0;
324

325
	strbuf_addf(&path, "%s/commondir", gitdir);
326
	if (file_exists(path.buf)) {
327
		if (strbuf_read_file(&data, path.buf, 0) <= 0)
328
			die_errno(_("failed to read %s"), path.buf);
329
		while (data.len && (data.buf[data.len - 1] == '\n' ||
330
				    data.buf[data.len - 1] == '\r'))
331
			data.len--;
332
		data.buf[data.len] = '\0';
333
		strbuf_reset(&path);
334
		if (!is_absolute_path(data.buf))
335
			strbuf_addf(&path, "%s/", gitdir);
336
		strbuf_addbuf(&path, &data);
337
		strbuf_add_real_path(sb, path.buf);
338
		ret = 1;
339
	} else {
340
		strbuf_addstr(sb, gitdir);
341
	}
342

343
	strbuf_release(&data);
344
	strbuf_release(&path);
345
	return ret;
346
}
347

348
static int validate_headref(const char *path)
349
{
350
	struct stat st;
351
	char buffer[256];
352
	const char *refname;
353
	struct object_id oid;
354
	int fd;
355
	ssize_t len;
356

357
	if (lstat(path, &st) < 0)
358
		return -1;
359

360
	/* Make sure it is a "refs/.." symlink */
361
	if (S_ISLNK(st.st_mode)) {
362
		len = readlink(path, buffer, sizeof(buffer)-1);
363
		if (len >= 5 && !memcmp("refs/", buffer, 5))
364
			return 0;
365
		return -1;
366
	}
367

368
	/*
369
	 * Anything else, just open it and try to see if it is a symbolic ref.
370
	 */
371
	fd = open(path, O_RDONLY);
372
	if (fd < 0)
373
		return -1;
374
	len = read_in_full(fd, buffer, sizeof(buffer)-1);
375
	close(fd);
376

377
	if (len < 0)
378
		return -1;
379
	buffer[len] = '\0';
380

381
	/*
382
	 * Is it a symbolic ref?
383
	 */
384
	if (skip_prefix(buffer, "ref:", &refname)) {
385
		while (isspace(*refname))
386
			refname++;
387
		if (starts_with(refname, "refs/"))
388
			return 0;
389
	}
390

391
	/*
392
	 * Is this a detached HEAD?
393
	 */
394
	if (get_oid_hex_any(buffer, &oid) != GIT_HASH_UNKNOWN)
395
		return 0;
396

397
	return -1;
398
}
399

400
/*
401
 * Test if it looks like we're at a git directory.
402
 * We want to see:
403
 *
404
 *  - either an objects/ directory _or_ the proper
405
 *    GIT_OBJECT_DIRECTORY environment variable
406
 *  - a refs/ directory
407
 *  - either a HEAD symlink or a HEAD file that is formatted as
408
 *    a proper "ref:", or a regular file HEAD that has a properly
409
 *    formatted sha1 object name.
410
 */
411
int is_git_directory(const char *suspect)
412
{
413
	struct strbuf path = STRBUF_INIT;
414
	int ret = 0;
415
	size_t len;
416

417
	/* Check worktree-related signatures */
418
	strbuf_addstr(&path, suspect);
419
	strbuf_complete(&path, '/');
420
	strbuf_addstr(&path, "HEAD");
421
	if (validate_headref(path.buf))
422
		goto done;
423

424
	strbuf_reset(&path);
425
	get_common_dir(&path, suspect);
426
	len = path.len;
427

428
	/* Check non-worktree-related signatures */
429
	if (getenv(DB_ENVIRONMENT)) {
430
		if (access(getenv(DB_ENVIRONMENT), X_OK))
431
			goto done;
432
	}
433
	else {
434
		strbuf_setlen(&path, len);
435
		strbuf_addstr(&path, "/objects");
436
		if (access(path.buf, X_OK))
437
			goto done;
438
	}
439

440
	strbuf_setlen(&path, len);
441
	strbuf_addstr(&path, "/refs");
442
	if (access(path.buf, X_OK))
443
		goto done;
444

445
	ret = 1;
446
done:
447
	strbuf_release(&path);
448
	return ret;
449
}
450

451
int is_nonbare_repository_dir(struct strbuf *path)
452
{
453
	int ret = 0;
454
	int gitfile_error;
455
	size_t orig_path_len = path->len;
456
	assert(orig_path_len != 0);
457
	strbuf_complete(path, '/');
458
	strbuf_addstr(path, ".git");
459
	if (read_gitfile_gently(path->buf, &gitfile_error) || is_git_directory(path->buf))
460
		ret = 1;
461
	if (gitfile_error == READ_GITFILE_ERR_OPEN_FAILED ||
462
	    gitfile_error == READ_GITFILE_ERR_READ_FAILED)
463
		ret = 1;
464
	strbuf_setlen(path, orig_path_len);
465
	return ret;
466
}
467

468
int is_inside_git_dir(void)
469
{
470
	if (inside_git_dir < 0)
471
		inside_git_dir = is_inside_dir(get_git_dir());
472
	return inside_git_dir;
473
}
474

475
int is_inside_work_tree(void)
476
{
477
	if (inside_work_tree < 0)
478
		inside_work_tree = is_inside_dir(get_git_work_tree());
479
	return inside_work_tree;
480
}
481

482
void setup_work_tree(void)
483
{
484
	const char *work_tree;
485
	static int initialized = 0;
486

487
	if (initialized)
488
		return;
489

490
	if (work_tree_config_is_bogus)
491
		die(_("unable to set up work tree using invalid config"));
492

493
	work_tree = get_git_work_tree();
494
	if (!work_tree || chdir_notify(work_tree))
495
		die(_("this operation must be run in a work tree"));
496

497
	/*
498
	 * Make sure subsequent git processes find correct worktree
499
	 * if $GIT_WORK_TREE is set relative
500
	 */
501
	if (getenv(GIT_WORK_TREE_ENVIRONMENT))
502
		setenv(GIT_WORK_TREE_ENVIRONMENT, ".", 1);
503

504
	initialized = 1;
505
}
506

507
static void setup_original_cwd(void)
508
{
509
	struct strbuf tmp = STRBUF_INIT;
510
	const char *worktree = NULL;
511
	int offset = -1;
512

513
	if (!tmp_original_cwd)
514
		return;
515

516
	/*
517
	 * startup_info->original_cwd points to the current working
518
	 * directory we inherited from our parent process, which is a
519
	 * directory we want to avoid removing.
520
	 *
521
	 * For convience, we would like to have the path relative to the
522
	 * worktree instead of an absolute path.
523
	 *
524
	 * Yes, startup_info->original_cwd is usually the same as 'prefix',
525
	 * but differs in two ways:
526
	 *   - prefix has a trailing '/'
527
	 *   - if the user passes '-C' to git, that modifies the prefix but
528
	 *     not startup_info->original_cwd.
529
	 */
530

531
	/* Normalize the directory */
532
	if (!strbuf_realpath(&tmp, tmp_original_cwd, 0)) {
533
		trace2_data_string("setup", the_repository,
534
				   "realpath-path", tmp_original_cwd);
535
		trace2_data_string("setup", the_repository,
536
				   "realpath-failure", strerror(errno));
537
		free((char*)tmp_original_cwd);
538
		tmp_original_cwd = NULL;
539
		return;
540
	}
541

542
	free((char*)tmp_original_cwd);
543
	tmp_original_cwd = NULL;
544
	startup_info->original_cwd = strbuf_detach(&tmp, NULL);
545

546
	/*
547
	 * Get our worktree; we only protect the current working directory
548
	 * if it's in the worktree.
549
	 */
550
	worktree = get_git_work_tree();
551
	if (!worktree)
552
		goto no_prevention_needed;
553

554
	offset = dir_inside_of(startup_info->original_cwd, worktree);
555
	if (offset >= 0) {
556
		/*
557
		 * If startup_info->original_cwd == worktree, that is already
558
		 * protected and we don't need original_cwd as a secondary
559
		 * protection measure.
560
		 */
561
		if (!*(startup_info->original_cwd + offset))
562
			goto no_prevention_needed;
563

564
		/*
565
		 * original_cwd was inside worktree; precompose it just as
566
		 * we do prefix so that built up paths will match
567
		 */
568
		startup_info->original_cwd = \
569
			precompose_string_if_needed(startup_info->original_cwd
570
						    + offset);
571
		return;
572
	}
573

574
no_prevention_needed:
575
	free((char*)startup_info->original_cwd);
576
	startup_info->original_cwd = NULL;
577
}
578

579
static int read_worktree_config(const char *var, const char *value,
580
				const struct config_context *ctx UNUSED,
581
				void *vdata)
582
{
583
	struct repository_format *data = vdata;
584

585
	if (strcmp(var, "core.bare") == 0) {
586
		data->is_bare = git_config_bool(var, value);
587
	} else if (strcmp(var, "core.worktree") == 0) {
588
		if (!value)
589
			return config_error_nonbool(var);
590
		free(data->work_tree);
591
		data->work_tree = xstrdup(value);
592
	}
593
	return 0;
594
}
595

596
enum extension_result {
597
	EXTENSION_ERROR = -1, /* compatible with error(), etc */
598
	EXTENSION_UNKNOWN = 0,
599
	EXTENSION_OK = 1
600
};
601

602
/*
603
 * Do not add new extensions to this function. It handles extensions which are
604
 * respected even in v0-format repositories for historical compatibility.
605
 */
606
static enum extension_result handle_extension_v0(const char *var,
607
						 const char *value,
608
						 const char *ext,
609
						 struct repository_format *data)
610
{
611
		if (!strcmp(ext, "noop")) {
612
			return EXTENSION_OK;
613
		} else if (!strcmp(ext, "preciousobjects")) {
614
			data->precious_objects = git_config_bool(var, value);
615
			return EXTENSION_OK;
616
		} else if (!strcmp(ext, "partialclone")) {
617
			if (!value)
618
				return config_error_nonbool(var);
619
			data->partial_clone = xstrdup(value);
620
			return EXTENSION_OK;
621
		} else if (!strcmp(ext, "worktreeconfig")) {
622
			data->worktree_config = git_config_bool(var, value);
623
			return EXTENSION_OK;
624
		}
625

626
		return EXTENSION_UNKNOWN;
627
}
628

629
/*
630
 * Record any new extensions in this function.
631
 */
632
static enum extension_result handle_extension(const char *var,
633
					      const char *value,
634
					      const char *ext,
635
					      struct repository_format *data)
636
{
637
	if (!strcmp(ext, "noop-v1")) {
638
		return EXTENSION_OK;
639
	} else if (!strcmp(ext, "objectformat")) {
640
		int format;
641

642
		if (!value)
643
			return config_error_nonbool(var);
644
		format = hash_algo_by_name(value);
645
		if (format == GIT_HASH_UNKNOWN)
646
			return error(_("invalid value for '%s': '%s'"),
647
				     "extensions.objectformat", value);
648
		data->hash_algo = format;
649
		return EXTENSION_OK;
650
	} else if (!strcmp(ext, "compatobjectformat")) {
651
		struct string_list_item *item;
652
		int format;
653

654
		if (!value)
655
			return config_error_nonbool(var);
656
		format = hash_algo_by_name(value);
657
		if (format == GIT_HASH_UNKNOWN)
658
			return error(_("invalid value for '%s': '%s'"),
659
				     "extensions.compatobjectformat", value);
660
		/* For now only support compatObjectFormat being specified once. */
661
		for_each_string_list_item(item, &data->v1_only_extensions) {
662
			if (!strcmp(item->string, "compatobjectformat"))
663
				return error(_("'%s' already specified as '%s'"),
664
					"extensions.compatobjectformat",
665
					hash_algos[data->compat_hash_algo].name);
666
		}
667
		data->compat_hash_algo = format;
668
		return EXTENSION_OK;
669
	} else if (!strcmp(ext, "refstorage")) {
670
		unsigned int format;
671

672
		if (!value)
673
			return config_error_nonbool(var);
674
		format = ref_storage_format_by_name(value);
675
		if (format == REF_STORAGE_FORMAT_UNKNOWN)
676
			return error(_("invalid value for '%s': '%s'"),
677
				     "extensions.refstorage", value);
678
		data->ref_storage_format = format;
679
		return EXTENSION_OK;
680
	}
681
	return EXTENSION_UNKNOWN;
682
}
683

684
static int check_repo_format(const char *var, const char *value,
685
			     const struct config_context *ctx, void *vdata)
686
{
687
	struct repository_format *data = vdata;
688
	const char *ext;
689

690
	if (strcmp(var, "core.repositoryformatversion") == 0)
691
		data->version = git_config_int(var, value, ctx->kvi);
692
	else if (skip_prefix(var, "extensions.", &ext)) {
693
		switch (handle_extension_v0(var, value, ext, data)) {
694
		case EXTENSION_ERROR:
695
			return -1;
696
		case EXTENSION_OK:
697
			return 0;
698
		case EXTENSION_UNKNOWN:
699
			break;
700
		}
701

702
		switch (handle_extension(var, value, ext, data)) {
703
		case EXTENSION_ERROR:
704
			return -1;
705
		case EXTENSION_OK:
706
			string_list_append(&data->v1_only_extensions, ext);
707
			return 0;
708
		case EXTENSION_UNKNOWN:
709
			string_list_append(&data->unknown_extensions, ext);
710
			return 0;
711
		}
712
	}
713

714
	return read_worktree_config(var, value, ctx, vdata);
715
}
716

717
static int check_repository_format_gently(const char *gitdir, struct repository_format *candidate, int *nongit_ok)
718
{
719
	struct strbuf sb = STRBUF_INIT;
720
	struct strbuf err = STRBUF_INIT;
721
	int has_common;
722

723
	has_common = get_common_dir(&sb, gitdir);
724
	strbuf_addstr(&sb, "/config");
725
	read_repository_format(candidate, sb.buf);
726
	strbuf_release(&sb);
727

728
	/*
729
	 * For historical use of check_repository_format() in git-init,
730
	 * we treat a missing config as a silent "ok", even when nongit_ok
731
	 * is unset.
732
	 */
733
	if (candidate->version < 0)
734
		return 0;
735

736
	if (verify_repository_format(candidate, &err) < 0) {
737
		if (nongit_ok) {
738
			warning("%s", err.buf);
739
			strbuf_release(&err);
740
			*nongit_ok = -1;
741
			return -1;
742
		}
743
		die("%s", err.buf);
744
	}
745

746
	repository_format_precious_objects = candidate->precious_objects;
747
	string_list_clear(&candidate->unknown_extensions, 0);
748
	string_list_clear(&candidate->v1_only_extensions, 0);
749

750
	if (candidate->worktree_config) {
751
		/*
752
		 * pick up core.bare and core.worktree from per-worktree
753
		 * config if present
754
		 */
755
		strbuf_addf(&sb, "%s/config.worktree", gitdir);
756
		git_config_from_file(read_worktree_config, sb.buf, candidate);
757
		strbuf_release(&sb);
758
		has_common = 0;
759
	}
760

761
	if (!has_common) {
762
		if (candidate->is_bare != -1) {
763
			is_bare_repository_cfg = candidate->is_bare;
764
			if (is_bare_repository_cfg == 1)
765
				inside_work_tree = -1;
766
		}
767
		if (candidate->work_tree) {
768
			free(git_work_tree_cfg);
769
			git_work_tree_cfg = xstrdup(candidate->work_tree);
770
			inside_work_tree = -1;
771
		}
772
	}
773

774
	return 0;
775
}
776

777
int upgrade_repository_format(int target_version)
778
{
779
	struct strbuf sb = STRBUF_INIT;
780
	struct strbuf err = STRBUF_INIT;
781
	struct strbuf repo_version = STRBUF_INIT;
782
	struct repository_format repo_fmt = REPOSITORY_FORMAT_INIT;
783
	int ret;
784

785
	strbuf_git_common_path(&sb, the_repository, "config");
786
	read_repository_format(&repo_fmt, sb.buf);
787
	strbuf_release(&sb);
788

789
	if (repo_fmt.version >= target_version) {
790
		ret = 0;
791
		goto out;
792
	}
793

794
	if (verify_repository_format(&repo_fmt, &err) < 0) {
795
		ret = error("cannot upgrade repository format from %d to %d: %s",
796
			    repo_fmt.version, target_version, err.buf);
797
		goto out;
798
	}
799
	if (!repo_fmt.version && repo_fmt.unknown_extensions.nr) {
800
		ret = error("cannot upgrade repository format: "
801
			    "unknown extension %s",
802
			    repo_fmt.unknown_extensions.items[0].string);
803
		goto out;
804
	}
805

806
	strbuf_addf(&repo_version, "%d", target_version);
807
	git_config_set("core.repositoryformatversion", repo_version.buf);
808

809
	ret = 1;
810

811
out:
812
	clear_repository_format(&repo_fmt);
813
	strbuf_release(&repo_version);
814
	strbuf_release(&err);
815
	return ret;
816
}
817

818
static void init_repository_format(struct repository_format *format)
819
{
820
	const struct repository_format fresh = REPOSITORY_FORMAT_INIT;
821

822
	memcpy(format, &fresh, sizeof(fresh));
823
}
824

825
int read_repository_format(struct repository_format *format, const char *path)
826
{
827
	clear_repository_format(format);
828
	git_config_from_file(check_repo_format, path, format);
829
	if (format->version == -1)
830
		clear_repository_format(format);
831
	return format->version;
832
}
833

834
void clear_repository_format(struct repository_format *format)
835
{
836
	string_list_clear(&format->unknown_extensions, 0);
837
	string_list_clear(&format->v1_only_extensions, 0);
838
	free(format->work_tree);
839
	free(format->partial_clone);
840
	init_repository_format(format);
841
}
842

843
int verify_repository_format(const struct repository_format *format,
844
			     struct strbuf *err)
845
{
846
	if (GIT_REPO_VERSION_READ < format->version) {
847
		strbuf_addf(err, _("Expected git repo version <= %d, found %d"),
848
			    GIT_REPO_VERSION_READ, format->version);
849
		return -1;
850
	}
851

852
	if (format->version >= 1 && format->unknown_extensions.nr) {
853
		int i;
854

855
		strbuf_addstr(err, Q_("unknown repository extension found:",
856
				      "unknown repository extensions found:",
857
				      format->unknown_extensions.nr));
858

859
		for (i = 0; i < format->unknown_extensions.nr; i++)
860
			strbuf_addf(err, "\n\t%s",
861
				    format->unknown_extensions.items[i].string);
862
		return -1;
863
	}
864

865
	if (format->version == 0 && format->v1_only_extensions.nr) {
866
		int i;
867

868
		strbuf_addstr(err,
869
			      Q_("repo version is 0, but v1-only extension found:",
870
				 "repo version is 0, but v1-only extensions found:",
871
				 format->v1_only_extensions.nr));
872

873
		for (i = 0; i < format->v1_only_extensions.nr; i++)
874
			strbuf_addf(err, "\n\t%s",
875
				    format->v1_only_extensions.items[i].string);
876
		return -1;
877
	}
878

879
	return 0;
880
}
881

882
void read_gitfile_error_die(int error_code, const char *path, const char *dir)
883
{
884
	switch (error_code) {
885
	case READ_GITFILE_ERR_STAT_FAILED:
886
	case READ_GITFILE_ERR_NOT_A_FILE:
887
		/* non-fatal; follow return path */
888
		break;
889
	case READ_GITFILE_ERR_OPEN_FAILED:
890
		die_errno(_("error opening '%s'"), path);
891
	case READ_GITFILE_ERR_TOO_LARGE:
892
		die(_("too large to be a .git file: '%s'"), path);
893
	case READ_GITFILE_ERR_READ_FAILED:
894
		die(_("error reading %s"), path);
895
	case READ_GITFILE_ERR_INVALID_FORMAT:
896
		die(_("invalid gitfile format: %s"), path);
897
	case READ_GITFILE_ERR_NO_PATH:
898
		die(_("no path in gitfile: %s"), path);
899
	case READ_GITFILE_ERR_NOT_A_REPO:
900
		die(_("not a git repository: %s"), dir);
901
	default:
902
		BUG("unknown error code");
903
	}
904
}
905

906
/*
907
 * Try to read the location of the git directory from the .git file,
908
 * return path to git directory if found. The return value comes from
909
 * a shared buffer.
910
 *
911
 * On failure, if return_error_code is not NULL, return_error_code
912
 * will be set to an error code and NULL will be returned. If
913
 * return_error_code is NULL the function will die instead (for most
914
 * cases).
915
 */
916
const char *read_gitfile_gently(const char *path, int *return_error_code)
917
{
918
	const int max_file_size = 1 << 20;  /* 1MB */
919
	int error_code = 0;
920
	char *buf = NULL;
921
	char *dir = NULL;
922
	const char *slash;
923
	struct stat st;
924
	int fd;
925
	ssize_t len;
926
	static struct strbuf realpath = STRBUF_INIT;
927

928
	if (stat(path, &st)) {
929
		/* NEEDSWORK: discern between ENOENT vs other errors */
930
		error_code = READ_GITFILE_ERR_STAT_FAILED;
931
		goto cleanup_return;
932
	}
933
	if (!S_ISREG(st.st_mode)) {
934
		error_code = READ_GITFILE_ERR_NOT_A_FILE;
935
		goto cleanup_return;
936
	}
937
	if (st.st_size > max_file_size) {
938
		error_code = READ_GITFILE_ERR_TOO_LARGE;
939
		goto cleanup_return;
940
	}
941
	fd = open(path, O_RDONLY);
942
	if (fd < 0) {
943
		error_code = READ_GITFILE_ERR_OPEN_FAILED;
944
		goto cleanup_return;
945
	}
946
	buf = xmallocz(st.st_size);
947
	len = read_in_full(fd, buf, st.st_size);
948
	close(fd);
949
	if (len != st.st_size) {
950
		error_code = READ_GITFILE_ERR_READ_FAILED;
951
		goto cleanup_return;
952
	}
953
	if (!starts_with(buf, "gitdir: ")) {
954
		error_code = READ_GITFILE_ERR_INVALID_FORMAT;
955
		goto cleanup_return;
956
	}
957
	while (buf[len - 1] == '\n' || buf[len - 1] == '\r')
958
		len--;
959
	if (len < 9) {
960
		error_code = READ_GITFILE_ERR_NO_PATH;
961
		goto cleanup_return;
962
	}
963
	buf[len] = '\0';
964
	dir = buf + 8;
965

966
	if (!is_absolute_path(dir) && (slash = strrchr(path, '/'))) {
967
		size_t pathlen = slash+1 - path;
968
		dir = xstrfmt("%.*s%.*s", (int)pathlen, path,
969
			      (int)(len - 8), buf + 8);
970
		free(buf);
971
		buf = dir;
972
	}
973
	if (!is_git_directory(dir)) {
974
		error_code = READ_GITFILE_ERR_NOT_A_REPO;
975
		goto cleanup_return;
976
	}
977

978
	strbuf_realpath(&realpath, dir, 1);
979
	path = realpath.buf;
980

981
cleanup_return:
982
	if (return_error_code)
983
		*return_error_code = error_code;
984
	else if (error_code)
985
		read_gitfile_error_die(error_code, path, dir);
986

987
	free(buf);
988
	return error_code ? NULL : path;
989
}
990

991
static const char *setup_explicit_git_dir(const char *gitdirenv,
992
					  struct strbuf *cwd,
993
					  struct repository_format *repo_fmt,
994
					  int *nongit_ok)
995
{
996
	const char *work_tree_env = getenv(GIT_WORK_TREE_ENVIRONMENT);
997
	const char *worktree;
998
	char *gitfile;
999
	int offset;
1000

1001
	if (PATH_MAX - 40 < strlen(gitdirenv))
1002
		die(_("'$%s' too big"), GIT_DIR_ENVIRONMENT);
1003

1004
	gitfile = (char*)read_gitfile(gitdirenv);
1005
	if (gitfile) {
1006
		gitfile = xstrdup(gitfile);
1007
		gitdirenv = gitfile;
1008
	}
1009

1010
	if (!is_git_directory(gitdirenv)) {
1011
		if (nongit_ok) {
1012
			*nongit_ok = 1;
1013
			free(gitfile);
1014
			return NULL;
1015
		}
1016
		die(_("not a git repository: '%s'"), gitdirenv);
1017
	}
1018

1019
	if (check_repository_format_gently(gitdirenv, repo_fmt, nongit_ok)) {
1020
		free(gitfile);
1021
		return NULL;
1022
	}
1023

1024
	/* #3, #7, #11, #15, #19, #23, #27, #31 (see t1510) */
1025
	if (work_tree_env)
1026
		set_git_work_tree(work_tree_env);
1027
	else if (is_bare_repository_cfg > 0) {
1028
		if (git_work_tree_cfg) {
1029
			/* #22.2, #30 */
1030
			warning("core.bare and core.worktree do not make sense");
1031
			work_tree_config_is_bogus = 1;
1032
		}
1033

1034
		/* #18, #26 */
1035
		set_git_dir(gitdirenv, 0);
1036
		free(gitfile);
1037
		return NULL;
1038
	}
1039
	else if (git_work_tree_cfg) { /* #6, #14 */
1040
		if (is_absolute_path(git_work_tree_cfg))
1041
			set_git_work_tree(git_work_tree_cfg);
1042
		else {
1043
			char *core_worktree;
1044
			if (chdir(gitdirenv))
1045
				die_errno(_("cannot chdir to '%s'"), gitdirenv);
1046
			if (chdir(git_work_tree_cfg))
1047
				die_errno(_("cannot chdir to '%s'"), git_work_tree_cfg);
1048
			core_worktree = xgetcwd();
1049
			if (chdir(cwd->buf))
1050
				die_errno(_("cannot come back to cwd"));
1051
			set_git_work_tree(core_worktree);
1052
			free(core_worktree);
1053
		}
1054
	}
1055
	else if (!git_env_bool(GIT_IMPLICIT_WORK_TREE_ENVIRONMENT, 1)) {
1056
		/* #16d */
1057
		set_git_dir(gitdirenv, 0);
1058
		free(gitfile);
1059
		return NULL;
1060
	}
1061
	else /* #2, #10 */
1062
		set_git_work_tree(".");
1063

1064
	/* set_git_work_tree() must have been called by now */
1065
	worktree = get_git_work_tree();
1066

1067
	/* both get_git_work_tree() and cwd are already normalized */
1068
	if (!strcmp(cwd->buf, worktree)) { /* cwd == worktree */
1069
		set_git_dir(gitdirenv, 0);
1070
		free(gitfile);
1071
		return NULL;
1072
	}
1073

1074
	offset = dir_inside_of(cwd->buf, worktree);
1075
	if (offset >= 0) {	/* cwd inside worktree? */
1076
		set_git_dir(gitdirenv, 1);
1077
		if (chdir(worktree))
1078
			die_errno(_("cannot chdir to '%s'"), worktree);
1079
		strbuf_addch(cwd, '/');
1080
		free(gitfile);
1081
		return cwd->buf + offset;
1082
	}
1083

1084
	/* cwd outside worktree */
1085
	set_git_dir(gitdirenv, 0);
1086
	free(gitfile);
1087
	return NULL;
1088
}
1089

1090
static const char *setup_discovered_git_dir(const char *gitdir,
1091
					    struct strbuf *cwd, int offset,
1092
					    struct repository_format *repo_fmt,
1093
					    int *nongit_ok)
1094
{
1095
	if (check_repository_format_gently(gitdir, repo_fmt, nongit_ok))
1096
		return NULL;
1097

1098
	/* --work-tree is set without --git-dir; use discovered one */
1099
	if (getenv(GIT_WORK_TREE_ENVIRONMENT) || git_work_tree_cfg) {
1100
		char *to_free = NULL;
1101
		const char *ret;
1102

1103
		if (offset != cwd->len && !is_absolute_path(gitdir))
1104
			gitdir = to_free = real_pathdup(gitdir, 1);
1105
		if (chdir(cwd->buf))
1106
			die_errno(_("cannot come back to cwd"));
1107
		ret = setup_explicit_git_dir(gitdir, cwd, repo_fmt, nongit_ok);
1108
		free(to_free);
1109
		return ret;
1110
	}
1111

1112
	/* #16.2, #17.2, #20.2, #21.2, #24, #25, #28, #29 (see t1510) */
1113
	if (is_bare_repository_cfg > 0) {
1114
		set_git_dir(gitdir, (offset != cwd->len));
1115
		if (chdir(cwd->buf))
1116
			die_errno(_("cannot come back to cwd"));
1117
		return NULL;
1118
	}
1119

1120
	/* #0, #1, #5, #8, #9, #12, #13 */
1121
	set_git_work_tree(".");
1122
	if (strcmp(gitdir, DEFAULT_GIT_DIR_ENVIRONMENT))
1123
		set_git_dir(gitdir, 0);
1124
	inside_git_dir = 0;
1125
	inside_work_tree = 1;
1126
	if (offset >= cwd->len)
1127
		return NULL;
1128

1129
	/* Make "offset" point past the '/' (already the case for root dirs) */
1130
	if (offset != offset_1st_component(cwd->buf))
1131
		offset++;
1132
	/* Add a '/' at the end */
1133
	strbuf_addch(cwd, '/');
1134
	return cwd->buf + offset;
1135
}
1136

1137
/* #16.1, #17.1, #20.1, #21.1, #22.1 (see t1510) */
1138
static const char *setup_bare_git_dir(struct strbuf *cwd, int offset,
1139
				      struct repository_format *repo_fmt,
1140
				      int *nongit_ok)
1141
{
1142
	int root_len;
1143

1144
	if (check_repository_format_gently(".", repo_fmt, nongit_ok))
1145
		return NULL;
1146

1147
	setenv(GIT_IMPLICIT_WORK_TREE_ENVIRONMENT, "0", 1);
1148

1149
	/* --work-tree is set without --git-dir; use discovered one */
1150
	if (getenv(GIT_WORK_TREE_ENVIRONMENT) || git_work_tree_cfg) {
1151
		static const char *gitdir;
1152

1153
		gitdir = offset == cwd->len ? "." : xmemdupz(cwd->buf, offset);
1154
		if (chdir(cwd->buf))
1155
			die_errno(_("cannot come back to cwd"));
1156
		return setup_explicit_git_dir(gitdir, cwd, repo_fmt, nongit_ok);
1157
	}
1158

1159
	inside_git_dir = 1;
1160
	inside_work_tree = 0;
1161
	if (offset != cwd->len) {
1162
		if (chdir(cwd->buf))
1163
			die_errno(_("cannot come back to cwd"));
1164
		root_len = offset_1st_component(cwd->buf);
1165
		strbuf_setlen(cwd, offset > root_len ? offset : root_len);
1166
		set_git_dir(cwd->buf, 0);
1167
	}
1168
	else
1169
		set_git_dir(".", 0);
1170
	return NULL;
1171
}
1172

1173
static dev_t get_device_or_die(const char *path, const char *prefix, int prefix_len)
1174
{
1175
	struct stat buf;
1176
	if (stat(path, &buf)) {
1177
		die_errno(_("failed to stat '%*s%s%s'"),
1178
				prefix_len,
1179
				prefix ? prefix : "",
1180
				prefix ? "/" : "", path);
1181
	}
1182
	return buf.st_dev;
1183
}
1184

1185
/*
1186
 * A "string_list_each_func_t" function that canonicalizes an entry
1187
 * from GIT_CEILING_DIRECTORIES using real_pathdup(), or
1188
 * discards it if unusable.  The presence of an empty entry in
1189
 * GIT_CEILING_DIRECTORIES turns off canonicalization for all
1190
 * subsequent entries.
1191
 */
1192
static int canonicalize_ceiling_entry(struct string_list_item *item,
1193
				      void *cb_data)
1194
{
1195
	int *empty_entry_found = cb_data;
1196
	char *ceil = item->string;
1197

1198
	if (!*ceil) {
1199
		*empty_entry_found = 1;
1200
		return 0;
1201
	} else if (!is_absolute_path(ceil)) {
1202
		return 0;
1203
	} else if (*empty_entry_found) {
1204
		/* Keep entry but do not canonicalize it */
1205
		return 1;
1206
	} else {
1207
		char *real_path = real_pathdup(ceil, 0);
1208
		if (!real_path) {
1209
			return 0;
1210
		}
1211
		free(item->string);
1212
		item->string = real_path;
1213
		return 1;
1214
	}
1215
}
1216

1217
struct safe_directory_data {
1218
	char *path;
1219
	int is_safe;
1220
};
1221

1222
static int safe_directory_cb(const char *key, const char *value,
1223
			     const struct config_context *ctx UNUSED, void *d)
1224
{
1225
	struct safe_directory_data *data = d;
1226

1227
	if (strcmp(key, "safe.directory"))
1228
		return 0;
1229

1230
	if (!value || !*value) {
1231
		data->is_safe = 0;
1232
	} else if (!strcmp(value, "*")) {
1233
		data->is_safe = 1;
1234
	} else {
1235
		char *allowed = NULL;
1236

1237
		if (!git_config_pathname(&allowed, key, value)) {
1238
			char *normalized = NULL;
1239

1240
			/*
1241
			 * Setting safe.directory to a non-absolute path
1242
			 * makes little sense---it won't be relative to
1243
			 * the configuration file the item is defined in.
1244
			 * Except for ".", which means "if we are at the top
1245
			 * level of a repository, then it is OK", which is
1246
			 * slightly tighter than "*" that allows discovery.
1247
			 */
1248
			if (!is_absolute_path(allowed) && strcmp(allowed, ".")) {
1249
				warning(_("safe.directory '%s' not absolute"),
1250
					allowed);
1251
				goto next;
1252
			}
1253

1254
			/*
1255
			 * A .gitconfig in $HOME may be shared across
1256
			 * different machines and safe.directory entries
1257
			 * may or may not exist as paths on all of these
1258
			 * machines.  In other words, it is not a warning
1259
			 * worthy event when there is no such path on this
1260
			 * machine---the entry may be useful elsewhere.
1261
			 */
1262
			normalized = real_pathdup(allowed, 0);
1263
			if (!normalized)
1264
				goto next;
1265

1266
			if (ends_with(normalized, "/*")) {
1267
				size_t len = strlen(normalized);
1268
				if (!fspathncmp(normalized, data->path, len - 1))
1269
					data->is_safe = 1;
1270
			} else if (!fspathcmp(data->path, normalized)) {
1271
				data->is_safe = 1;
1272
			}
1273
		next:
1274
			free(normalized);
1275
			free(allowed);
1276
		}
1277
	}
1278

1279
	return 0;
1280
}
1281

1282
/*
1283
 * Check if a repository is safe, by verifying the ownership of the
1284
 * worktree (if any), the git directory, and the gitfile (if any).
1285
 *
1286
 * Exemptions for known-safe repositories can be added via `safe.directory`
1287
 * config settings; for non-bare repositories, their worktree needs to be
1288
 * added, for bare ones their git directory.
1289
 */
1290
static int ensure_valid_ownership(const char *gitfile,
1291
				  const char *worktree, const char *gitdir,
1292
				  struct strbuf *report)
1293
{
1294
	struct safe_directory_data data = { 0 };
1295

1296
	if (!git_env_bool("GIT_TEST_ASSUME_DIFFERENT_OWNER", 0) &&
1297
	    (!gitfile || is_path_owned_by_current_user(gitfile, report)) &&
1298
	    (!worktree || is_path_owned_by_current_user(worktree, report)) &&
1299
	    (!gitdir || is_path_owned_by_current_user(gitdir, report)))
1300
		return 1;
1301

1302
	/*
1303
	 * normalize the data.path for comparison with normalized paths
1304
	 * that come from the configuration file.  The path is unsafe
1305
	 * if it cannot be normalized.
1306
	 */
1307
	data.path = real_pathdup(worktree ? worktree : gitdir, 0);
1308
	if (!data.path)
1309
		return 0;
1310

1311
	/*
1312
	 * data.path is the "path" that identifies the repository and it is
1313
	 * constant regardless of what failed above. data.is_safe should be
1314
	 * initialized to false, and might be changed by the callback.
1315
	 */
1316
	git_protected_config(safe_directory_cb, &data);
1317

1318
	free(data.path);
1319
	return data.is_safe;
1320
}
1321

1322
void die_upon_dubious_ownership(const char *gitfile, const char *worktree,
1323
				const char *gitdir)
1324
{
1325
	struct strbuf report = STRBUF_INIT, quoted = STRBUF_INIT;
1326
	const char *path;
1327

1328
	if (ensure_valid_ownership(gitfile, worktree, gitdir, &report))
1329
		return;
1330

1331
	strbuf_complete(&report, '\n');
1332
	path = gitfile ? gitfile : gitdir;
1333
	sq_quote_buf_pretty(&quoted, path);
1334

1335
	die(_("detected dubious ownership in repository at '%s'\n"
1336
	      "%s"
1337
	      "To add an exception for this directory, call:\n"
1338
	      "\n"
1339
	      "\tgit config --global --add safe.directory %s"),
1340
	    path, report.buf, quoted.buf);
1341
}
1342

1343
static int allowed_bare_repo_cb(const char *key, const char *value,
1344
				const struct config_context *ctx UNUSED,
1345
				void *d)
1346
{
1347
	enum allowed_bare_repo *allowed_bare_repo = d;
1348

1349
	if (strcasecmp(key, "safe.bareRepository"))
1350
		return 0;
1351

1352
	if (!strcmp(value, "explicit")) {
1353
		*allowed_bare_repo = ALLOWED_BARE_REPO_EXPLICIT;
1354
		return 0;
1355
	}
1356
	if (!strcmp(value, "all")) {
1357
		*allowed_bare_repo = ALLOWED_BARE_REPO_ALL;
1358
		return 0;
1359
	}
1360
	return -1;
1361
}
1362

1363
static enum allowed_bare_repo get_allowed_bare_repo(void)
1364
{
1365
	enum allowed_bare_repo result = ALLOWED_BARE_REPO_ALL;
1366
	git_protected_config(allowed_bare_repo_cb, &result);
1367
	return result;
1368
}
1369

1370
static const char *allowed_bare_repo_to_string(
1371
	enum allowed_bare_repo allowed_bare_repo)
1372
{
1373
	switch (allowed_bare_repo) {
1374
	case ALLOWED_BARE_REPO_EXPLICIT:
1375
		return "explicit";
1376
	case ALLOWED_BARE_REPO_ALL:
1377
		return "all";
1378
	default:
1379
		BUG("invalid allowed_bare_repo %d",
1380
		    allowed_bare_repo);
1381
	}
1382
	return NULL;
1383
}
1384

1385
static int is_implicit_bare_repo(const char *path)
1386
{
1387
	/*
1388
	 * what we found is a ".git" directory at the root of
1389
	 * the working tree.
1390
	 */
1391
	if (ends_with_path_components(path, ".git"))
1392
		return 1;
1393

1394
	/*
1395
	 * we are inside $GIT_DIR of a secondary worktree of a
1396
	 * non-bare repository.
1397
	 */
1398
	if (strstr(path, "/.git/worktrees/"))
1399
		return 1;
1400

1401
	/*
1402
	 * we are inside $GIT_DIR of a worktree of a non-embedded
1403
	 * submodule, whose superproject is not a bare repository.
1404
	 */
1405
	if (strstr(path, "/.git/modules/"))
1406
		return 1;
1407

1408
	return 0;
1409
}
1410

1411
/*
1412
 * We cannot decide in this function whether we are in the work tree or
1413
 * not, since the config can only be read _after_ this function was called.
1414
 *
1415
 * Also, we avoid changing any global state (such as the current working
1416
 * directory) to allow early callers.
1417
 *
1418
 * The directory where the search should start needs to be passed in via the
1419
 * `dir` parameter; upon return, the `dir` buffer will contain the path of
1420
 * the directory where the search ended, and `gitdir` will contain the path of
1421
 * the discovered .git/ directory, if any. If `gitdir` is not absolute, it
1422
 * is relative to `dir` (i.e. *not* necessarily the cwd).
1423
 */
1424
static enum discovery_result setup_git_directory_gently_1(struct strbuf *dir,
1425
							  struct strbuf *gitdir,
1426
							  struct strbuf *report,
1427
							  int die_on_error)
1428
{
1429
	const char *env_ceiling_dirs = getenv(CEILING_DIRECTORIES_ENVIRONMENT);
1430
	struct string_list ceiling_dirs = STRING_LIST_INIT_DUP;
1431
	const char *gitdirenv;
1432
	int ceil_offset = -1, min_offset = offset_1st_component(dir->buf);
1433
	dev_t current_device = 0;
1434
	int one_filesystem = 1;
1435

1436
	/*
1437
	 * If GIT_DIR is set explicitly, we're not going
1438
	 * to do any discovery, but we still do repository
1439
	 * validation.
1440
	 */
1441
	gitdirenv = getenv(GIT_DIR_ENVIRONMENT);
1442
	if (gitdirenv) {
1443
		strbuf_addstr(gitdir, gitdirenv);
1444
		return GIT_DIR_EXPLICIT;
1445
	}
1446

1447
	if (env_ceiling_dirs) {
1448
		int empty_entry_found = 0;
1449

1450
		string_list_split(&ceiling_dirs, env_ceiling_dirs, PATH_SEP, -1);
1451
		filter_string_list(&ceiling_dirs, 0,
1452
				   canonicalize_ceiling_entry, &empty_entry_found);
1453
		ceil_offset = longest_ancestor_length(dir->buf, &ceiling_dirs);
1454
		string_list_clear(&ceiling_dirs, 0);
1455
	}
1456

1457
	if (ceil_offset < 0)
1458
		ceil_offset = min_offset - 2;
1459

1460
	if (min_offset && min_offset == dir->len &&
1461
	    !is_dir_sep(dir->buf[min_offset - 1])) {
1462
		strbuf_addch(dir, '/');
1463
		min_offset++;
1464
	}
1465

1466
	/*
1467
	 * Test in the following order (relative to the dir):
1468
	 * - .git (file containing "gitdir: <path>")
1469
	 * - .git/
1470
	 * - ./ (bare)
1471
	 * - ../.git
1472
	 * - ../.git/
1473
	 * - ../ (bare)
1474
	 * - ../../.git
1475
	 *   etc.
1476
	 */
1477
	one_filesystem = !git_env_bool("GIT_DISCOVERY_ACROSS_FILESYSTEM", 0);
1478
	if (one_filesystem)
1479
		current_device = get_device_or_die(dir->buf, NULL, 0);
1480
	for (;;) {
1481
		int offset = dir->len, error_code = 0;
1482
		char *gitdir_path = NULL;
1483
		char *gitfile = NULL;
1484

1485
		if (offset > min_offset)
1486
			strbuf_addch(dir, '/');
1487
		strbuf_addstr(dir, DEFAULT_GIT_DIR_ENVIRONMENT);
1488
		gitdirenv = read_gitfile_gently(dir->buf, die_on_error ?
1489
						NULL : &error_code);
1490
		if (!gitdirenv) {
1491
			if (die_on_error ||
1492
			    error_code == READ_GITFILE_ERR_NOT_A_FILE) {
1493
				/* NEEDSWORK: fail if .git is not file nor dir */
1494
				if (is_git_directory(dir->buf)) {
1495
					gitdirenv = DEFAULT_GIT_DIR_ENVIRONMENT;
1496
					gitdir_path = xstrdup(dir->buf);
1497
				}
1498
			} else if (error_code != READ_GITFILE_ERR_STAT_FAILED)
1499
				return GIT_DIR_INVALID_GITFILE;
1500
		} else
1501
			gitfile = xstrdup(dir->buf);
1502
		/*
1503
		 * Earlier, we tentatively added DEFAULT_GIT_DIR_ENVIRONMENT
1504
		 * to check that directory for a repository.
1505
		 * Now trim that tentative addition away, because we want to
1506
		 * focus on the real directory we are in.
1507
		 */
1508
		strbuf_setlen(dir, offset);
1509
		if (gitdirenv) {
1510
			enum discovery_result ret;
1511
			const char *gitdir_candidate =
1512
				gitdir_path ? gitdir_path : gitdirenv;
1513

1514
			if (ensure_valid_ownership(gitfile, dir->buf,
1515
						   gitdir_candidate, report)) {
1516
				strbuf_addstr(gitdir, gitdirenv);
1517
				ret = GIT_DIR_DISCOVERED;
1518
			} else
1519
				ret = GIT_DIR_INVALID_OWNERSHIP;
1520

1521
			/*
1522
			 * Earlier, during discovery, we might have allocated
1523
			 * string copies for gitdir_path or gitfile so make
1524
			 * sure we don't leak by freeing them now, before
1525
			 * leaving the loop and function.
1526
			 *
1527
			 * Note: gitdirenv will be non-NULL whenever these are
1528
			 * allocated, therefore we need not take care of releasing
1529
			 * them outside of this conditional block.
1530
			 */
1531
			free(gitdir_path);
1532
			free(gitfile);
1533

1534
			return ret;
1535
		}
1536

1537
		if (is_git_directory(dir->buf)) {
1538
			trace2_data_string("setup", NULL, "implicit-bare-repository", dir->buf);
1539
			if (get_allowed_bare_repo() == ALLOWED_BARE_REPO_EXPLICIT &&
1540
			    !is_implicit_bare_repo(dir->buf))
1541
				return GIT_DIR_DISALLOWED_BARE;
1542
			if (!ensure_valid_ownership(NULL, NULL, dir->buf, report))
1543
				return GIT_DIR_INVALID_OWNERSHIP;
1544
			strbuf_addstr(gitdir, ".");
1545
			return GIT_DIR_BARE;
1546
		}
1547

1548
		if (offset <= min_offset)
1549
			return GIT_DIR_HIT_CEILING;
1550

1551
		while (--offset > ceil_offset && !is_dir_sep(dir->buf[offset]))
1552
			; /* continue */
1553
		if (offset <= ceil_offset)
1554
			return GIT_DIR_HIT_CEILING;
1555

1556
		strbuf_setlen(dir, offset > min_offset ?  offset : min_offset);
1557
		if (one_filesystem &&
1558
		    current_device != get_device_or_die(dir->buf, NULL, offset))
1559
			return GIT_DIR_HIT_MOUNT_POINT;
1560
	}
1561
}
1562

1563
enum discovery_result discover_git_directory_reason(struct strbuf *commondir,
1564
						    struct strbuf *gitdir)
1565
{
1566
	struct strbuf dir = STRBUF_INIT, err = STRBUF_INIT;
1567
	size_t gitdir_offset = gitdir->len, cwd_len;
1568
	size_t commondir_offset = commondir->len;
1569
	struct repository_format candidate = REPOSITORY_FORMAT_INIT;
1570
	enum discovery_result result;
1571

1572
	if (strbuf_getcwd(&dir))
1573
		return GIT_DIR_CWD_FAILURE;
1574

1575
	cwd_len = dir.len;
1576
	result = setup_git_directory_gently_1(&dir, gitdir, NULL, 0);
1577
	if (result <= 0) {
1578
		strbuf_release(&dir);
1579
		return result;
1580
	}
1581

1582
	/*
1583
	 * The returned gitdir is relative to dir, and if dir does not reflect
1584
	 * the current working directory, we simply make the gitdir absolute.
1585
	 */
1586
	if (dir.len < cwd_len && !is_absolute_path(gitdir->buf + gitdir_offset)) {
1587
		/* Avoid a trailing "/." */
1588
		if (!strcmp(".", gitdir->buf + gitdir_offset))
1589
			strbuf_setlen(gitdir, gitdir_offset);
1590
		else
1591
			strbuf_addch(&dir, '/');
1592
		strbuf_insert(gitdir, gitdir_offset, dir.buf, dir.len);
1593
	}
1594

1595
	get_common_dir(commondir, gitdir->buf + gitdir_offset);
1596

1597
	strbuf_reset(&dir);
1598
	strbuf_addf(&dir, "%s/config", commondir->buf + commondir_offset);
1599
	read_repository_format(&candidate, dir.buf);
1600
	strbuf_release(&dir);
1601

1602
	if (verify_repository_format(&candidate, &err) < 0) {
1603
		warning("ignoring git dir '%s': %s",
1604
			gitdir->buf + gitdir_offset, err.buf);
1605
		strbuf_release(&err);
1606
		strbuf_setlen(commondir, commondir_offset);
1607
		strbuf_setlen(gitdir, gitdir_offset);
1608
		clear_repository_format(&candidate);
1609
		return GIT_DIR_INVALID_FORMAT;
1610
	}
1611

1612
	clear_repository_format(&candidate);
1613
	return result;
1614
}
1615

1616
const char *setup_git_directory_gently(int *nongit_ok)
1617
{
1618
	static struct strbuf cwd = STRBUF_INIT;
1619
	struct strbuf dir = STRBUF_INIT, gitdir = STRBUF_INIT, report = STRBUF_INIT;
1620
	const char *prefix = NULL;
1621
	struct repository_format repo_fmt = REPOSITORY_FORMAT_INIT;
1622

1623
	/*
1624
	 * We may have read an incomplete configuration before
1625
	 * setting-up the git directory. If so, clear the cache so
1626
	 * that the next queries to the configuration reload complete
1627
	 * configuration (including the per-repo config file that we
1628
	 * ignored previously).
1629
	 */
1630
	git_config_clear();
1631

1632
	/*
1633
	 * Let's assume that we are in a git repository.
1634
	 * If it turns out later that we are somewhere else, the value will be
1635
	 * updated accordingly.
1636
	 */
1637
	if (nongit_ok)
1638
		*nongit_ok = 0;
1639

1640
	if (strbuf_getcwd(&cwd))
1641
		die_errno(_("Unable to read current working directory"));
1642
	strbuf_addbuf(&dir, &cwd);
1643

1644
	switch (setup_git_directory_gently_1(&dir, &gitdir, &report, 1)) {
1645
	case GIT_DIR_EXPLICIT:
1646
		prefix = setup_explicit_git_dir(gitdir.buf, &cwd, &repo_fmt, nongit_ok);
1647
		break;
1648
	case GIT_DIR_DISCOVERED:
1649
		if (dir.len < cwd.len && chdir(dir.buf))
1650
			die(_("cannot change to '%s'"), dir.buf);
1651
		prefix = setup_discovered_git_dir(gitdir.buf, &cwd, dir.len,
1652
						  &repo_fmt, nongit_ok);
1653
		break;
1654
	case GIT_DIR_BARE:
1655
		if (dir.len < cwd.len && chdir(dir.buf))
1656
			die(_("cannot change to '%s'"), dir.buf);
1657
		prefix = setup_bare_git_dir(&cwd, dir.len, &repo_fmt, nongit_ok);
1658
		break;
1659
	case GIT_DIR_HIT_CEILING:
1660
		if (!nongit_ok)
1661
			die(_("not a git repository (or any of the parent directories): %s"),
1662
			    DEFAULT_GIT_DIR_ENVIRONMENT);
1663
		*nongit_ok = 1;
1664
		break;
1665
	case GIT_DIR_HIT_MOUNT_POINT:
1666
		if (!nongit_ok)
1667
			die(_("not a git repository (or any parent up to mount point %s)\n"
1668
			      "Stopping at filesystem boundary (GIT_DISCOVERY_ACROSS_FILESYSTEM not set)."),
1669
			    dir.buf);
1670
		*nongit_ok = 1;
1671
		break;
1672
	case GIT_DIR_INVALID_OWNERSHIP:
1673
		if (!nongit_ok) {
1674
			struct strbuf quoted = STRBUF_INIT;
1675

1676
			strbuf_complete(&report, '\n');
1677
			sq_quote_buf_pretty(&quoted, dir.buf);
1678
			die(_("detected dubious ownership in repository at '%s'\n"
1679
			      "%s"
1680
			      "To add an exception for this directory, call:\n"
1681
			      "\n"
1682
			      "\tgit config --global --add safe.directory %s"),
1683
			    dir.buf, report.buf, quoted.buf);
1684
		}
1685
		*nongit_ok = 1;
1686
		break;
1687
	case GIT_DIR_DISALLOWED_BARE:
1688
		if (!nongit_ok) {
1689
			die(_("cannot use bare repository '%s' (safe.bareRepository is '%s')"),
1690
			    dir.buf,
1691
			    allowed_bare_repo_to_string(get_allowed_bare_repo()));
1692
		}
1693
		*nongit_ok = 1;
1694
		break;
1695
	case GIT_DIR_CWD_FAILURE:
1696
	case GIT_DIR_INVALID_FORMAT:
1697
		/*
1698
		 * As a safeguard against setup_git_directory_gently_1 returning
1699
		 * these values, fallthrough to BUG. Otherwise it is possible to
1700
		 * set startup_info->have_repository to 1 when we did nothing to
1701
		 * find a repository.
1702
		 */
1703
	default:
1704
		BUG("unhandled setup_git_directory_gently_1() result");
1705
	}
1706

1707
	/*
1708
	 * At this point, nongit_ok is stable. If it is non-NULL and points
1709
	 * to a non-zero value, then this means that we haven't found a
1710
	 * repository and that the caller expects startup_info to reflect
1711
	 * this.
1712
	 *
1713
	 * Regardless of the state of nongit_ok, startup_info->prefix and
1714
	 * the GIT_PREFIX environment variable must always match. For details
1715
	 * see Documentation/config/alias.txt.
1716
	 */
1717
	if (nongit_ok && *nongit_ok)
1718
		startup_info->have_repository = 0;
1719
	else
1720
		startup_info->have_repository = 1;
1721

1722
	/*
1723
	 * Not all paths through the setup code will call 'set_git_dir()' (which
1724
	 * directly sets up the environment) so in order to guarantee that the
1725
	 * environment is in a consistent state after setup, explicitly setup
1726
	 * the environment if we have a repository.
1727
	 *
1728
	 * NEEDSWORK: currently we allow bogus GIT_DIR values to be set in some
1729
	 * code paths so we also need to explicitly setup the environment if
1730
	 * the user has set GIT_DIR.  It may be beneficial to disallow bogus
1731
	 * GIT_DIR values at some point in the future.
1732
	 */
1733
	if (/* GIT_DIR_EXPLICIT, GIT_DIR_DISCOVERED, GIT_DIR_BARE */
1734
	    startup_info->have_repository ||
1735
	    /* GIT_DIR_EXPLICIT */
1736
	    getenv(GIT_DIR_ENVIRONMENT)) {
1737
		if (!the_repository->gitdir) {
1738
			const char *gitdir = getenv(GIT_DIR_ENVIRONMENT);
1739
			if (!gitdir)
1740
				gitdir = DEFAULT_GIT_DIR_ENVIRONMENT;
1741
			setup_git_env(gitdir);
1742
		}
1743
		if (startup_info->have_repository) {
1744
			repo_set_hash_algo(the_repository, repo_fmt.hash_algo);
1745
			repo_set_compat_hash_algo(the_repository,
1746
						  repo_fmt.compat_hash_algo);
1747
			repo_set_ref_storage_format(the_repository,
1748
						    repo_fmt.ref_storage_format);
1749
			the_repository->repository_format_worktree_config =
1750
				repo_fmt.worktree_config;
1751
			/* take ownership of repo_fmt.partial_clone */
1752
			the_repository->repository_format_partial_clone =
1753
				repo_fmt.partial_clone;
1754
			repo_fmt.partial_clone = NULL;
1755
		}
1756
	}
1757
	/*
1758
	 * Since precompose_string_if_needed() needs to look at
1759
	 * the core.precomposeunicode configuration, this
1760
	 * has to happen after the above block that finds
1761
	 * out where the repository is, i.e. a preparation
1762
	 * for calling git_config_get_bool().
1763
	 */
1764
	if (prefix) {
1765
		prefix = precompose_string_if_needed(prefix);
1766
		startup_info->prefix = prefix;
1767
		setenv(GIT_PREFIX_ENVIRONMENT, prefix, 1);
1768
	} else {
1769
		startup_info->prefix = NULL;
1770
		setenv(GIT_PREFIX_ENVIRONMENT, "", 1);
1771
	}
1772

1773
	setup_original_cwd();
1774

1775
	strbuf_release(&dir);
1776
	strbuf_release(&gitdir);
1777
	strbuf_release(&report);
1778
	clear_repository_format(&repo_fmt);
1779

1780
	return prefix;
1781
}
1782

1783
int git_config_perm(const char *var, const char *value)
1784
{
1785
	int i;
1786
	char *endptr;
1787

1788
	if (!value)
1789
		return PERM_GROUP;
1790

1791
	if (!strcmp(value, "umask"))
1792
		return PERM_UMASK;
1793
	if (!strcmp(value, "group"))
1794
		return PERM_GROUP;
1795
	if (!strcmp(value, "all") ||
1796
	    !strcmp(value, "world") ||
1797
	    !strcmp(value, "everybody"))
1798
		return PERM_EVERYBODY;
1799

1800
	/* Parse octal numbers */
1801
	i = strtol(value, &endptr, 8);
1802

1803
	/* If not an octal number, maybe true/false? */
1804
	if (*endptr != 0)
1805
		return git_config_bool(var, value) ? PERM_GROUP : PERM_UMASK;
1806

1807
	/*
1808
	 * Treat values 0, 1 and 2 as compatibility cases, otherwise it is
1809
	 * a chmod value to restrict to.
1810
	 */
1811
	switch (i) {
1812
	case PERM_UMASK:               /* 0 */
1813
		return PERM_UMASK;
1814
	case OLD_PERM_GROUP:           /* 1 */
1815
		return PERM_GROUP;
1816
	case OLD_PERM_EVERYBODY:       /* 2 */
1817
		return PERM_EVERYBODY;
1818
	}
1819

1820
	/* A filemode value was given: 0xxx */
1821

1822
	if ((i & 0600) != 0600)
1823
		die(_("problem with core.sharedRepository filemode value "
1824
		    "(0%.3o).\nThe owner of files must always have "
1825
		    "read and write permissions."), i);
1826

1827
	/*
1828
	 * Mask filemode value. Others can not get write permission.
1829
	 * x flags for directories are handled separately.
1830
	 */
1831
	return -(i & 0666);
1832
}
1833

1834
void check_repository_format(struct repository_format *fmt)
1835
{
1836
	struct repository_format repo_fmt = REPOSITORY_FORMAT_INIT;
1837
	if (!fmt)
1838
		fmt = &repo_fmt;
1839
	check_repository_format_gently(get_git_dir(), fmt, NULL);
1840
	startup_info->have_repository = 1;
1841
	repo_set_hash_algo(the_repository, fmt->hash_algo);
1842
	repo_set_compat_hash_algo(the_repository, fmt->compat_hash_algo);
1843
	repo_set_ref_storage_format(the_repository,
1844
				    fmt->ref_storage_format);
1845
	the_repository->repository_format_worktree_config =
1846
		fmt->worktree_config;
1847
	the_repository->repository_format_partial_clone =
1848
		xstrdup_or_null(fmt->partial_clone);
1849
	clear_repository_format(&repo_fmt);
1850
}
1851

1852
/*
1853
 * Returns the "prefix", a path to the current working directory
1854
 * relative to the work tree root, or NULL, if the current working
1855
 * directory is not a strict subdirectory of the work tree root. The
1856
 * prefix always ends with a '/' character.
1857
 */
1858
const char *setup_git_directory(void)
1859
{
1860
	return setup_git_directory_gently(NULL);
1861
}
1862

1863
const char *resolve_gitdir_gently(const char *suspect, int *return_error_code)
1864
{
1865
	if (is_git_directory(suspect))
1866
		return suspect;
1867
	return read_gitfile_gently(suspect, return_error_code);
1868
}
1869

1870
/* if any standard file descriptor is missing open it to /dev/null */
1871
void sanitize_stdfds(void)
1872
{
1873
	int fd = xopen("/dev/null", O_RDWR);
1874
	while (fd < 2)
1875
		fd = xdup(fd);
1876
	if (fd > 2)
1877
		close(fd);
1878
}
1879

1880
int daemonize(void)
1881
{
1882
#ifdef NO_POSIX_GOODIES
1883
	errno = ENOSYS;
1884
	return -1;
1885
#else
1886
	switch (fork()) {
1887
		case 0:
1888
			break;
1889
		case -1:
1890
			die_errno(_("fork failed"));
1891
		default:
1892
			exit(0);
1893
	}
1894
	if (setsid() == -1)
1895
		die_errno(_("setsid failed"));
1896
	close(0);
1897
	close(1);
1898
	close(2);
1899
	sanitize_stdfds();
1900
	return 0;
1901
#endif
1902
}
1903

1904
struct template_dir_cb_data {
1905
	char *path;
1906
	int initialized;
1907
};
1908

1909
static int template_dir_cb(const char *key, const char *value,
1910
			   const struct config_context *ctx UNUSED, void *d)
1911
{
1912
	struct template_dir_cb_data *data = d;
1913

1914
	if (strcmp(key, "init.templatedir"))
1915
		return 0;
1916

1917
	if (!value) {
1918
		data->path = NULL;
1919
	} else {
1920
		char *path = NULL;
1921

1922
		FREE_AND_NULL(data->path);
1923
		if (!git_config_pathname(&path, key, value))
1924
			data->path = path ? path : xstrdup(value);
1925
	}
1926

1927
	return 0;
1928
}
1929

1930
const char *get_template_dir(const char *option_template)
1931
{
1932
	const char *template_dir = option_template;
1933

1934
	if (!template_dir)
1935
		template_dir = getenv(TEMPLATE_DIR_ENVIRONMENT);
1936
	if (!template_dir) {
1937
		static struct template_dir_cb_data data;
1938

1939
		if (!data.initialized) {
1940
			git_protected_config(template_dir_cb, &data);
1941
			data.initialized = 1;
1942
		}
1943
		template_dir = data.path;
1944
	}
1945
	if (!template_dir) {
1946
		static char *dir;
1947

1948
		if (!dir)
1949
			dir = system_path(DEFAULT_GIT_TEMPLATE_DIR);
1950
		template_dir = dir;
1951
	}
1952
	return template_dir;
1953
}
1954

1955
#ifdef NO_TRUSTABLE_FILEMODE
1956
#define TEST_FILEMODE 0
1957
#else
1958
#define TEST_FILEMODE 1
1959
#endif
1960

1961
#define GIT_DEFAULT_HASH_ENVIRONMENT "GIT_DEFAULT_HASH"
1962

1963
static void copy_templates_1(struct strbuf *path, struct strbuf *template_path,
1964
			     DIR *dir)
1965
{
1966
	size_t path_baselen = path->len;
1967
	size_t template_baselen = template_path->len;
1968
	struct dirent *de;
1969

1970
	/* Note: if ".git/hooks" file exists in the repository being
1971
	 * re-initialized, /etc/core-git/templates/hooks/update would
1972
	 * cause "git init" to fail here.  I think this is sane but
1973
	 * it means that the set of templates we ship by default, along
1974
	 * with the way the namespace under .git/ is organized, should
1975
	 * be really carefully chosen.
1976
	 */
1977
	safe_create_dir(path->buf, 1);
1978
	while ((de = readdir(dir)) != NULL) {
1979
		struct stat st_git, st_template;
1980
		int exists = 0;
1981

1982
		strbuf_setlen(path, path_baselen);
1983
		strbuf_setlen(template_path, template_baselen);
1984

1985
		if (de->d_name[0] == '.')
1986
			continue;
1987
		strbuf_addstr(path, de->d_name);
1988
		strbuf_addstr(template_path, de->d_name);
1989
		if (lstat(path->buf, &st_git)) {
1990
			if (errno != ENOENT)
1991
				die_errno(_("cannot stat '%s'"), path->buf);
1992
		}
1993
		else
1994
			exists = 1;
1995

1996
		if (lstat(template_path->buf, &st_template))
1997
			die_errno(_("cannot stat template '%s'"), template_path->buf);
1998

1999
		if (S_ISDIR(st_template.st_mode)) {
2000
			DIR *subdir = opendir(template_path->buf);
2001
			if (!subdir)
2002
				die_errno(_("cannot opendir '%s'"), template_path->buf);
2003
			strbuf_addch(path, '/');
2004
			strbuf_addch(template_path, '/');
2005
			copy_templates_1(path, template_path, subdir);
2006
			closedir(subdir);
2007
		}
2008
		else if (exists)
2009
			continue;
2010
		else if (S_ISLNK(st_template.st_mode)) {
2011
			struct strbuf lnk = STRBUF_INIT;
2012
			if (strbuf_readlink(&lnk, template_path->buf,
2013
					    st_template.st_size) < 0)
2014
				die_errno(_("cannot readlink '%s'"), template_path->buf);
2015
			if (symlink(lnk.buf, path->buf))
2016
				die_errno(_("cannot symlink '%s' '%s'"),
2017
					  lnk.buf, path->buf);
2018
			strbuf_release(&lnk);
2019
		}
2020
		else if (S_ISREG(st_template.st_mode)) {
2021
			if (copy_file(path->buf, template_path->buf, st_template.st_mode))
2022
				die_errno(_("cannot copy '%s' to '%s'"),
2023
					  template_path->buf, path->buf);
2024
		}
2025
		else
2026
			error(_("ignoring template %s"), template_path->buf);
2027
	}
2028
}
2029

2030
static void copy_templates(const char *option_template)
2031
{
2032
	const char *template_dir = get_template_dir(option_template);
2033
	struct strbuf path = STRBUF_INIT;
2034
	struct strbuf template_path = STRBUF_INIT;
2035
	size_t template_len;
2036
	struct repository_format template_format = REPOSITORY_FORMAT_INIT;
2037
	struct strbuf err = STRBUF_INIT;
2038
	DIR *dir;
2039
	char *to_free = NULL;
2040

2041
	if (!template_dir || !*template_dir)
2042
		return;
2043

2044
	strbuf_addstr(&template_path, template_dir);
2045
	strbuf_complete(&template_path, '/');
2046
	template_len = template_path.len;
2047

2048
	dir = opendir(template_path.buf);
2049
	if (!dir) {
2050
		warning(_("templates not found in %s"), template_dir);
2051
		goto free_return;
2052
	}
2053

2054
	/* Make sure that template is from the correct vintage */
2055
	strbuf_addstr(&template_path, "config");
2056
	read_repository_format(&template_format, template_path.buf);
2057
	strbuf_setlen(&template_path, template_len);
2058

2059
	/*
2060
	 * No mention of version at all is OK, but anything else should be
2061
	 * verified.
2062
	 */
2063
	if (template_format.version >= 0 &&
2064
	    verify_repository_format(&template_format, &err) < 0) {
2065
		warning(_("not copying templates from '%s': %s"),
2066
			  template_dir, err.buf);
2067
		strbuf_release(&err);
2068
		goto close_free_return;
2069
	}
2070

2071
	strbuf_addstr(&path, get_git_common_dir());
2072
	strbuf_complete(&path, '/');
2073
	copy_templates_1(&path, &template_path, dir);
2074
close_free_return:
2075
	closedir(dir);
2076
free_return:
2077
	free(to_free);
2078
	strbuf_release(&path);
2079
	strbuf_release(&template_path);
2080
	clear_repository_format(&template_format);
2081
}
2082

2083
/*
2084
 * If the git_dir is not directly inside the working tree, then git will not
2085
 * find it by default, and we need to set the worktree explicitly.
2086
 */
2087
static int needs_work_tree_config(const char *git_dir, const char *work_tree)
2088
{
2089
	if (!strcmp(work_tree, "/") && !strcmp(git_dir, "/.git"))
2090
		return 0;
2091
	if (skip_prefix(git_dir, work_tree, &git_dir) &&
2092
	    !strcmp(git_dir, "/.git"))
2093
		return 0;
2094
	return 1;
2095
}
2096

2097
void initialize_repository_version(int hash_algo,
2098
				   enum ref_storage_format ref_storage_format,
2099
				   int reinit)
2100
{
2101
	char repo_version_string[10];
2102
	int repo_version = GIT_REPO_VERSION;
2103

2104
	/*
2105
	 * Note that we initialize the repository version to 1 when the ref
2106
	 * storage format is unknown. This is on purpose so that we can add the
2107
	 * correct object format to the config during git-clone(1). The format
2108
	 * version will get adjusted by git-clone(1) once it has learned about
2109
	 * the remote repository's format.
2110
	 */
2111
	if (hash_algo != GIT_HASH_SHA1 ||
2112
	    ref_storage_format != REF_STORAGE_FORMAT_FILES)
2113
		repo_version = GIT_REPO_VERSION_READ;
2114

2115
	/* This forces creation of new config file */
2116
	xsnprintf(repo_version_string, sizeof(repo_version_string),
2117
		  "%d", repo_version);
2118
	git_config_set("core.repositoryformatversion", repo_version_string);
2119

2120
	if (hash_algo != GIT_HASH_SHA1 && hash_algo != GIT_HASH_UNKNOWN)
2121
		git_config_set("extensions.objectformat",
2122
			       hash_algos[hash_algo].name);
2123
	else if (reinit)
2124
		git_config_set_gently("extensions.objectformat", NULL);
2125

2126
	if (ref_storage_format != REF_STORAGE_FORMAT_FILES)
2127
		git_config_set("extensions.refstorage",
2128
			       ref_storage_format_to_name(ref_storage_format));
2129
	else if (reinit)
2130
		git_config_set_gently("extensions.refstorage", NULL);
2131
}
2132

2133
static int is_reinit(void)
2134
{
2135
	struct strbuf buf = STRBUF_INIT;
2136
	char junk[2];
2137
	int ret;
2138

2139
	git_path_buf(&buf, "HEAD");
2140
	ret = !access(buf.buf, R_OK) || readlink(buf.buf, junk, sizeof(junk) - 1) != -1;
2141
	strbuf_release(&buf);
2142
	return ret;
2143
}
2144

2145
void create_reference_database(enum ref_storage_format ref_storage_format,
2146
			       const char *initial_branch, int quiet)
2147
{
2148
	struct strbuf err = STRBUF_INIT;
2149
	char *to_free = NULL;
2150
	int reinit = is_reinit();
2151

2152
	repo_set_ref_storage_format(the_repository, ref_storage_format);
2153
	if (ref_store_create_on_disk(get_main_ref_store(the_repository), 0, &err))
2154
		die("failed to set up refs db: %s", err.buf);
2155

2156
	/*
2157
	 * Point the HEAD symref to the initial branch with if HEAD does
2158
	 * not yet exist.
2159
	 */
2160
	if (!reinit) {
2161
		char *ref;
2162

2163
		if (!initial_branch)
2164
			initial_branch = to_free =
2165
				repo_default_branch_name(the_repository, quiet);
2166

2167
		ref = xstrfmt("refs/heads/%s", initial_branch);
2168
		if (check_refname_format(ref, 0) < 0)
2169
			die(_("invalid initial branch name: '%s'"),
2170
			    initial_branch);
2171

2172
		if (refs_update_symref(get_main_ref_store(the_repository), "HEAD", ref, NULL) < 0)
2173
			exit(1);
2174
		free(ref);
2175
	}
2176

2177
	if (reinit && initial_branch)
2178
		warning(_("re-init: ignored --initial-branch=%s"),
2179
			initial_branch);
2180

2181
	strbuf_release(&err);
2182
	free(to_free);
2183
}
2184

2185
static int create_default_files(const char *template_path,
2186
				const char *original_git_dir,
2187
				const struct repository_format *fmt,
2188
				int init_shared_repository)
2189
{
2190
	struct stat st1;
2191
	struct strbuf buf = STRBUF_INIT;
2192
	char *path;
2193
	int reinit;
2194
	int filemode;
2195
	const char *work_tree = get_git_work_tree();
2196

2197
	/*
2198
	 * First copy the templates -- we might have the default
2199
	 * config file there, in which case we would want to read
2200
	 * from it after installing.
2201
	 *
2202
	 * Before reading that config, we also need to clear out any cached
2203
	 * values (since we've just potentially changed what's available on
2204
	 * disk).
2205
	 */
2206
	copy_templates(template_path);
2207
	git_config_clear();
2208
	reset_shared_repository();
2209
	git_config(git_default_config, NULL);
2210

2211
	reinit = is_reinit();
2212

2213
	/*
2214
	 * We must make sure command-line options continue to override any
2215
	 * values we might have just re-read from the config.
2216
	 */
2217
	if (init_shared_repository != -1)
2218
		set_shared_repository(init_shared_repository);
2219

2220
	is_bare_repository_cfg = !work_tree;
2221

2222
	/*
2223
	 * We would have created the above under user's umask -- under
2224
	 * shared-repository settings, we would need to fix them up.
2225
	 */
2226
	if (get_shared_repository()) {
2227
		adjust_shared_perm(get_git_dir());
2228
	}
2229

2230
	initialize_repository_version(fmt->hash_algo, fmt->ref_storage_format, 0);
2231

2232
	/* Check filemode trustability */
2233
	path = git_path_buf(&buf, "config");
2234
	filemode = TEST_FILEMODE;
2235
	if (TEST_FILEMODE && !lstat(path, &st1)) {
2236
		struct stat st2;
2237
		filemode = (!chmod(path, st1.st_mode ^ S_IXUSR) &&
2238
				!lstat(path, &st2) &&
2239
				st1.st_mode != st2.st_mode &&
2240
				!chmod(path, st1.st_mode));
2241
		if (filemode && !reinit && (st1.st_mode & S_IXUSR))
2242
			filemode = 0;
2243
	}
2244
	git_config_set("core.filemode", filemode ? "true" : "false");
2245

2246
	if (is_bare_repository())
2247
		git_config_set("core.bare", "true");
2248
	else {
2249
		git_config_set("core.bare", "false");
2250
		/* allow template config file to override the default */
2251
		if (log_all_ref_updates == LOG_REFS_UNSET)
2252
			git_config_set("core.logallrefupdates", "true");
2253
		if (needs_work_tree_config(original_git_dir, work_tree))
2254
			git_config_set("core.worktree", work_tree);
2255
	}
2256

2257
	if (!reinit) {
2258
		/* Check if symlink is supported in the work tree */
2259
		path = git_path_buf(&buf, "tXXXXXX");
2260
		if (!close(xmkstemp(path)) &&
2261
		    !unlink(path) &&
2262
		    !symlink("testing", path) &&
2263
		    !lstat(path, &st1) &&
2264
		    S_ISLNK(st1.st_mode))
2265
			unlink(path); /* good */
2266
		else
2267
			git_config_set("core.symlinks", "false");
2268

2269
		/* Check if the filesystem is case-insensitive */
2270
		path = git_path_buf(&buf, "CoNfIg");
2271
		if (!access(path, F_OK))
2272
			git_config_set("core.ignorecase", "true");
2273
		probe_utf8_pathname_composition();
2274
	}
2275

2276
	strbuf_release(&buf);
2277
	return reinit;
2278
}
2279

2280
static void create_object_directory(void)
2281
{
2282
	struct strbuf path = STRBUF_INIT;
2283
	size_t baselen;
2284

2285
	strbuf_addstr(&path, get_object_directory());
2286
	baselen = path.len;
2287

2288
	safe_create_dir(path.buf, 1);
2289

2290
	strbuf_setlen(&path, baselen);
2291
	strbuf_addstr(&path, "/pack");
2292
	safe_create_dir(path.buf, 1);
2293

2294
	strbuf_setlen(&path, baselen);
2295
	strbuf_addstr(&path, "/info");
2296
	safe_create_dir(path.buf, 1);
2297

2298
	strbuf_release(&path);
2299
}
2300

2301
static void separate_git_dir(const char *git_dir, const char *git_link)
2302
{
2303
	struct stat st;
2304

2305
	if (!stat(git_link, &st)) {
2306
		const char *src;
2307

2308
		if (S_ISREG(st.st_mode))
2309
			src = read_gitfile(git_link);
2310
		else if (S_ISDIR(st.st_mode))
2311
			src = git_link;
2312
		else
2313
			die(_("unable to handle file type %d"), (int)st.st_mode);
2314

2315
		if (rename(src, git_dir))
2316
			die_errno(_("unable to move %s to %s"), src, git_dir);
2317
		repair_worktrees(NULL, NULL);
2318
	}
2319

2320
	write_file(git_link, "gitdir: %s", git_dir);
2321
}
2322

2323
struct default_format_config {
2324
	int hash;
2325
	enum ref_storage_format ref_format;
2326
};
2327

2328
static int read_default_format_config(const char *key, const char *value,
2329
				      const struct config_context *ctx UNUSED,
2330
				      void *payload)
2331
{
2332
	struct default_format_config *cfg = payload;
2333
	char *str = NULL;
2334
	int ret;
2335

2336
	if (!strcmp(key, "init.defaultobjectformat")) {
2337
		ret = git_config_string(&str, key, value);
2338
		if (ret)
2339
			goto out;
2340
		cfg->hash = hash_algo_by_name(str);
2341
		if (cfg->hash == GIT_HASH_UNKNOWN)
2342
			warning(_("unknown hash algorithm '%s'"), str);
2343
		goto out;
2344
	}
2345

2346
	if (!strcmp(key, "init.defaultrefformat")) {
2347
		ret = git_config_string(&str, key, value);
2348
		if (ret)
2349
			goto out;
2350
		cfg->ref_format = ref_storage_format_by_name(str);
2351
		if (cfg->ref_format == REF_STORAGE_FORMAT_UNKNOWN)
2352
			warning(_("unknown ref storage format '%s'"), str);
2353
		goto out;
2354
	}
2355

2356
	ret = 0;
2357
out:
2358
	free(str);
2359
	return ret;
2360
}
2361

2362
static void repository_format_configure(struct repository_format *repo_fmt,
2363
					int hash, enum ref_storage_format ref_format)
2364
{
2365
	struct default_format_config cfg = {
2366
		.hash = GIT_HASH_UNKNOWN,
2367
		.ref_format = REF_STORAGE_FORMAT_UNKNOWN,
2368
	};
2369
	struct config_options opts = {
2370
		.respect_includes = 1,
2371
		.ignore_repo = 1,
2372
		.ignore_worktree = 1,
2373
	};
2374
	const char *env;
2375

2376
	config_with_options(read_default_format_config, &cfg, NULL, NULL, &opts);
2377

2378
	/*
2379
	 * If we already have an initialized repo, don't allow the user to
2380
	 * specify a different algorithm, as that could cause corruption.
2381
	 * Otherwise, if the user has specified one on the command line, use it.
2382
	 */
2383
	env = getenv(GIT_DEFAULT_HASH_ENVIRONMENT);
2384
	if (repo_fmt->version >= 0 && hash != GIT_HASH_UNKNOWN && hash != repo_fmt->hash_algo)
2385
		die(_("attempt to reinitialize repository with different hash"));
2386
	else if (hash != GIT_HASH_UNKNOWN)
2387
		repo_fmt->hash_algo = hash;
2388
	else if (env) {
2389
		int env_algo = hash_algo_by_name(env);
2390
		if (env_algo == GIT_HASH_UNKNOWN)
2391
			die(_("unknown hash algorithm '%s'"), env);
2392
		repo_fmt->hash_algo = env_algo;
2393
	} else if (cfg.hash != GIT_HASH_UNKNOWN) {
2394
		repo_fmt->hash_algo = cfg.hash;
2395
	}
2396
	repo_set_hash_algo(the_repository, repo_fmt->hash_algo);
2397

2398
	env = getenv("GIT_DEFAULT_REF_FORMAT");
2399
	if (repo_fmt->version >= 0 &&
2400
	    ref_format != REF_STORAGE_FORMAT_UNKNOWN &&
2401
	    ref_format != repo_fmt->ref_storage_format) {
2402
		die(_("attempt to reinitialize repository with different reference storage format"));
2403
	} else if (ref_format != REF_STORAGE_FORMAT_UNKNOWN) {
2404
		repo_fmt->ref_storage_format = ref_format;
2405
	} else if (env) {
2406
		ref_format = ref_storage_format_by_name(env);
2407
		if (ref_format == REF_STORAGE_FORMAT_UNKNOWN)
2408
			die(_("unknown ref storage format '%s'"), env);
2409
		repo_fmt->ref_storage_format = ref_format;
2410
	} else if (cfg.ref_format != REF_STORAGE_FORMAT_UNKNOWN) {
2411
		repo_fmt->ref_storage_format = cfg.ref_format;
2412
	}
2413
	repo_set_ref_storage_format(the_repository, repo_fmt->ref_storage_format);
2414
}
2415

2416
int init_db(const char *git_dir, const char *real_git_dir,
2417
	    const char *template_dir, int hash,
2418
	    enum ref_storage_format ref_storage_format,
2419
	    const char *initial_branch,
2420
	    int init_shared_repository, unsigned int flags)
2421
{
2422
	int reinit;
2423
	int exist_ok = flags & INIT_DB_EXIST_OK;
2424
	char *original_git_dir = real_pathdup(git_dir, 1);
2425
	struct repository_format repo_fmt = REPOSITORY_FORMAT_INIT;
2426

2427
	if (real_git_dir) {
2428
		struct stat st;
2429

2430
		if (!exist_ok && !stat(git_dir, &st))
2431
			die(_("%s already exists"), git_dir);
2432

2433
		if (!exist_ok && !stat(real_git_dir, &st))
2434
			die(_("%s already exists"), real_git_dir);
2435

2436
		set_git_dir(real_git_dir, 1);
2437
		git_dir = get_git_dir();
2438
		separate_git_dir(git_dir, original_git_dir);
2439
	}
2440
	else {
2441
		set_git_dir(git_dir, 1);
2442
		git_dir = get_git_dir();
2443
	}
2444
	startup_info->have_repository = 1;
2445

2446
	/*
2447
	 * Check to see if the repository version is right.
2448
	 * Note that a newly created repository does not have
2449
	 * config file, so this will not fail.  What we are catching
2450
	 * is an attempt to reinitialize new repository with an old tool.
2451
	 */
2452
	check_repository_format(&repo_fmt);
2453

2454
	repository_format_configure(&repo_fmt, hash, ref_storage_format);
2455

2456
	/*
2457
	 * Ensure `core.hidedotfiles` is processed. This must happen after we
2458
	 * have set up the repository format such that we can evaluate
2459
	 * includeIf conditions correctly in the case of re-initialization.
2460
	 */
2461
	git_config(platform_core_config, NULL);
2462

2463
	safe_create_dir(git_dir, 0);
2464

2465
	reinit = create_default_files(template_dir, original_git_dir,
2466
				      &repo_fmt, init_shared_repository);
2467

2468
	if (!(flags & INIT_DB_SKIP_REFDB))
2469
		create_reference_database(repo_fmt.ref_storage_format,
2470
					  initial_branch, flags & INIT_DB_QUIET);
2471
	create_object_directory();
2472

2473
	if (get_shared_repository()) {
2474
		char buf[10];
2475
		/* We do not spell "group" and such, so that
2476
		 * the configuration can be read by older version
2477
		 * of git. Note, we use octal numbers for new share modes,
2478
		 * and compatibility values for PERM_GROUP and
2479
		 * PERM_EVERYBODY.
2480
		 */
2481
		if (get_shared_repository() < 0)
2482
			/* force to the mode value */
2483
			xsnprintf(buf, sizeof(buf), "0%o", -get_shared_repository());
2484
		else if (get_shared_repository() == PERM_GROUP)
2485
			xsnprintf(buf, sizeof(buf), "%d", OLD_PERM_GROUP);
2486
		else if (get_shared_repository() == PERM_EVERYBODY)
2487
			xsnprintf(buf, sizeof(buf), "%d", OLD_PERM_EVERYBODY);
2488
		else
2489
			BUG("invalid value for shared_repository");
2490
		git_config_set("core.sharedrepository", buf);
2491
		git_config_set("receive.denyNonFastforwards", "true");
2492
	}
2493

2494
	if (!(flags & INIT_DB_QUIET)) {
2495
		int len = strlen(git_dir);
2496

2497
		if (reinit)
2498
			printf(get_shared_repository()
2499
			       ? _("Reinitialized existing shared Git repository in %s%s\n")
2500
			       : _("Reinitialized existing Git repository in %s%s\n"),
2501
			       git_dir, len && git_dir[len-1] != '/' ? "/" : "");
2502
		else
2503
			printf(get_shared_repository()
2504
			       ? _("Initialized empty shared Git repository in %s%s\n")
2505
			       : _("Initialized empty Git repository in %s%s\n"),
2506
			       git_dir, len && git_dir[len-1] != '/' ? "/" : "");
2507
	}
2508

2509
	clear_repository_format(&repo_fmt);
2510
	free(original_git_dir);
2511
	return 0;
2512
}
2513