index : cgit

/*
 * Serves a commit as a downloadable archive. Writing the archive is git's
 * work, so each format here is only a row in a table, naming the archive
 * format git writes and, for a compressed tar, the compressor its output is
 * piped through. A repository's snapshots mask is one bit per table position,
 * so that order is part of what cgitrc means. When the request carries no
 * revision the file name is worked backwards to find one, so that a link to
 * cgit-1.2.tar.gz can serve the tag it was named after. A name ending in .asc
 * asks for the detached signature kept under refs/notes instead of the archive
 * itself.
 */

#define USE_THE_REPOSITORY_VARIABLE

#include "cgit.h"
#include "filter.h"
#include "html.h"
#include "shared.h"
#include "ui-shared.h"
#include "ui-snapshot.h"

#define SIG_SUFFIX ".asc"

static void write_archive_format(const char *format_arg, const char *hex, const char *prefix)
{
	struct strvec argv = STRVEC_INIT;
	const char **args;

	strvec_push(&argv, "snapshot");
	strvec_push(&argv, format_arg);
	// An empty prefix means none, since the slash added below would root
	// every member of the archive at /.
	if (prefix && *prefix) {
		struct strbuf buf = STRBUF_INIT;

		strbuf_addstr(&buf, prefix);
		strbuf_addch(&buf, '/');
		strvec_push(&argv, "--prefix");
		strvec_push(&argv, buf.buf);
		strbuf_release(&buf);
	}
	strvec_push(&argv, hex);

	// write_archive rearranges the argv it is handed, which would leave
	// strvec_clear leaking or double freeing, so it gets a copy of the
	// pointers, one entry longer than argv.nr for the trailing NULL.
	args = xmalloc(sizeof(char *) * (argv.nr + 1));
	memcpy(args, argv.v, sizeof(char *) * (argv.nr + 1));

	write_archive(argv.nr, args, NULL, the_repository, NULL, 0);
	strvec_clear(&argv);
	free(args);
}

static void write_snapshot(const struct cgit_snapshot_format *format,
	const char *hex, const char *prefix)
{
	struct cgit_exec_filter compressor;
	struct cgit_filter *filter = NULL;

	if (format->compressor) {
		cgit_exec_filter_init(&compressor, format->compressor[0],
			format->compressor);
		filter = &compressor.base;
	}
	cgit_open_filter(filter);
	write_archive_format(format->format_arg, hex, prefix);
	cgit_close_filter(filter);
}

static int program_on_path(const char *program)
{
	const char *path = getenv("PATH");
	struct strbuf defpath = STRBUF_INIT;
	struct strbuf full = STRBUF_INIT;
	int found = 0;

	// A server can run cgit with no PATH at all, and execvp then searches
	// a default path of the system's, which confstr reports.
	if (!path) {
		size_t len = confstr(_CS_PATH, NULL, 0);

		if (!len)
			return 0;
		strbuf_grow(&defpath, len);
		confstr(_CS_PATH, defpath.buf, len);
		strbuf_setlen(&defpath, len - 1);
		path = defpath.buf;
	}
	while (!found) {
		const char *end = strchrnul(path, ':');

		strbuf_reset(&full);
		strbuf_add(&full, path, end - path);
		if (!full.len)
			strbuf_addch(&full, '.');
		strbuf_addf(&full, "/%s", program);
		found = !access(full.buf, X_OK);
		if (!*end)
			break;
		path = end + 1;
	}
	strbuf_release(&full);
	strbuf_release(&defpath);
	return found;
}

static const char *gzip_argv[] = { "gzip", "-n", NULL };
static const char *bzip2_argv[] = { "bzip2", NULL };
static const char *lzip_argv[] = { "lzip", NULL };
// Current xz runs a thread per core unless told otherwise.
static const char *xz_argv[] = { "xz", "-T1", NULL };
// Single-threaded like the other compressors, since -T0 would let one
// request pin every core.
static const char *zstd_argv[] = { "zstd", NULL };

// ui-shared.c reads entry zero as the tar whose signature stands in for every
// tar variant, so this order cannot change.
const struct cgit_snapshot_format cgit_snapshot_formats[] = {
	{ ".tar",     "application/x-tar",   "--format=tar", NULL       },
	{ ".tar.gz",  "application/gzip",    "--format=tar", gzip_argv  },
	{ ".tar.bz2", "application/x-bzip2", "--format=tar", bzip2_argv },
	{ ".tar.lz",  "application/x-lzip",  "--format=tar", lzip_argv  },
	{ ".tar.xz",  "application/x-xz",    "--format=tar", xz_argv    },
	{ ".tar.zst", "application/zstd",    "--format=tar", zstd_argv  },
	{ ".zip",     "application/zip",     "--format=zip", NULL       },
	{ 0 }
};

// Each tree is read the first time a signature for that format is asked for,
// then kept for the life of the process.
static struct notes_tree sig_notes[ARRAY_SIZE(cgit_snapshot_formats)];

static size_t format_index(const struct cgit_snapshot_format *f)
{
	return f - cgit_snapshot_formats;
}

static const struct cgit_snapshot_format *find_format(const char *filename)
{
	const struct cgit_snapshot_format *f;

	for (f = cgit_snapshot_formats; f->suffix; f++) {
		if (ends_with(filename, f->suffix))
			return f;
	}
	return NULL;
}

/*
 * Whether rev names a ref, under refs/tags alone when tags_only is set, and
 * if it does, rev is replaced by the name to archive.
 */
static int resolves(struct strbuf *rev, int tags_only)
{
	struct object_id oid;
	struct strbuf tag = STRBUF_INIT;
	int found = 0;

	// The name goes no further than this lookup, so a leading dash is
	// fine here, while the wider syntax is refused as in cgit_valid_rev.
	if (check_refname_format(rev->buf, REFNAME_ALLOW_ONELEVEL))
		return 0;
	strbuf_addf(&tag, "refs/tags/%s", rev->buf);
	if (!repo_get_oid(the_repository, tag.buf, &oid)) {
		strbuf_swap(rev, &tag);
		found = 1;
	} else if (!tags_only && !repo_get_oid(the_repository, rev->buf, &oid)) {
		found = 1;
	}
	strbuf_release(&tag);
	return found;
}

/*
 * The names a snapshot file could stand for, in the order the link builder
 * prefers them: the whole stem, the stem without the repository's prefix,
 * and that with a leading v or V, since a tag is often written with one the
 * file named after it is not.
 */
static int candidate_resolves(const struct cgit_repo *repo, const char *stem,
	struct strbuf *rev, int tags_only)
{
	const char *repo_prefix = cgit_snapshot_prefix(repo);

	strbuf_reset(rev);
	strbuf_addstr(rev, stem);
	if (resolves(rev, tags_only))
		return 1;

	if (starts_with(rev->buf, repo_prefix)) {
		const char *rest = rev->buf + strlen(repo_prefix);

		while (*rest == '-' || *rest == '_')
			rest++;
		strbuf_splice(rev, 0, rest - rev->buf, "", 0);
	}
	if (resolves(rev, tags_only))
		return 1;

	strbuf_insert(rev, 0, "v", 1);
	if (resolves(rev, tags_only))
		return 1;

	strbuf_splice(rev, 0, 1, "V", 1);
	return resolves(rev, tags_only);
}

/*
 * The links are built from tags, so every candidate is tried as a tag before
 * any is tried as a branch, which a branch spelled like a tag's stem would
 * otherwise win.
 */
static char *ref_from_filename(const struct cgit_repo *repo, const char *stem)
{
	struct strbuf rev = STRBUF_INIT;
	int found = candidate_resolves(repo, stem, &rev, 1) || candidate_resolves(repo, stem, &rev, 0);

	if (!found)
		strbuf_release(&rev);
	return found ? strbuf_detach(&rev, NULL) : NULL;
}

static void send_snapshot(const struct cgit_snapshot_format *format, const char *hex,
	const char *prefix, const char *filename)
{
	struct object_id oid;

	if (repo_get_oid(the_repository, hex, &oid)) {
		cgit_print_error_page(404, "Not Found", "Bad object id: %s", hex);
		return;
	}
	if (!lookup_commit_reference(the_repository, &oid)) {
		cgit_print_error_page(404, "Not Found", "Not a commit: %s", hex);
		return;
	}
	// A compressor that cannot run only shows up as a broken pipe once
	// the tar is under way, so it is looked for while a status can still
	// say so.
	if (format->compressor && !program_on_path(format->compressor[0])) {
		cgit_print_error_page(500, "Internal Server Error", "Unable to run %s",
			format->compressor[0]);
		return;
	}
	ctx.page.mimetype = format->mimetype;
	ctx.page.filename = filename;
	cgit_print_http_headers();
	init_archivers();
	// The archiver reads its arguments as a command line, so it gets the
	// resolved id and never the name.
	write_snapshot(format, oid_to_hex(&oid), prefix);
}

static void send_sig(const struct cgit_snapshot_format *format, const char *hex,
	const char *archive_name, const char *sig_filename)
{
	const struct object_id *note = cgit_snapshot_get_sig(hex, format);
	enum object_type type;
	size_t size;
	char *buf;

	if (!note) {
		cgit_print_error_page(404, "Not Found", "No signature for %s", archive_name);
		return;
	}

	// A note is any blob a pusher stored, so it is held to the same bound
	// as every other blob a page inflates.
	if (odb_read_object_info(the_repository->objects, note, &size) != OBJ_BLOB) {
		cgit_print_error_page(404, "Not Found", "Not found");
		return;
	}
	if (cgit_blob_too_large(size)) {
		cgit_print_blob_too_large(size);
		return;
	}

	buf = odb_read_object(the_repository->objects, note, &type, &size);
	if (!buf) {
		cgit_print_error_page(404, "Not Found", "Not found");
		return;
	}

	ctx.page.untrusted = 1;
	ctx.page.mimetype = "application/pgp-signature";
	ctx.page.filename = sig_filename;
	cgit_print_http_headers();

	html_raw(buf, size);
	free(buf);
}

const struct object_id *cgit_snapshot_get_sig(const char *ref, const struct cgit_snapshot_format *f)
{
	struct notes_tree *tree;
	struct object_id oid;

	if (repo_get_oid(the_repository, ref, &oid))
		return NULL;

	tree = &sig_notes[format_index(f)];
	if (!tree->initialized) {
		struct strbuf notes_ref = STRBUF_INIT;

		// Signatures live under the format suffix with the leading dot
		// dropped, so plain tar is refs/notes/signatures/tar.
		strbuf_addf(&notes_ref, "refs/notes/signatures/%s", f->suffix + 1);

		// A ref that names no tree is passed over, since git would die
		// loading it, and a signature it cannot hold is just absent.
		if (cgit_notes_ref_usable(notes_ref.buf))
			init_notes(tree, notes_ref.buf, combine_notes_ignore, 0);
		else
			init_notes(tree, notes_ref.buf, combine_notes_ignore, NOTES_INIT_EMPTY);
		strbuf_release(&notes_ref);
	}

	return get_note(tree, &oid);
}

unsigned cgit_snapshot_format_bit(const struct cgit_snapshot_format *f)
{
	return 1U << format_index(f);
}

int cgit_parse_snapshots_mask(const char *str)
{
	struct string_list tokens = STRING_LIST_INIT_DUP;
	struct string_list_item *item;
	const struct cgit_snapshot_format *f;
	int mask = 0;

	// A number is the legacy form of this setting and is still taken
	// ahead of the named forms below.
	if (atoi(str))
		return 1;

	if (strcmp(str, "all") == 0)
		return INT_MAX;

	string_list_split(&tokens, str, " ", -1);
	string_list_remove_empty_items(&tokens, 0);

	for_each_string_list_item(item, &tokens) {
		for (f = cgit_snapshot_formats; f->suffix; f++) {
			if (!strcmp(item->string, f->suffix) || !strcmp(item->string, f->suffix + 1)) {
				mask |= cgit_snapshot_format_bit(f);
				break;
			}
		}
	}

	string_list_clear(&tokens, 0);
	return mask;
}

void cgit_print_snapshot(const char *head, const char *hex, const char *filename, int dwim)
{
	const struct cgit_snapshot_format *f;
	const char *sig_filename = NULL;
	char *archive_name = NULL;
	char *prefix = NULL;
	char *ref = NULL;
	size_t len;

	if (!filename) {
		cgit_print_error_page(400, "Bad Request", "No snapshot name specified");
		return;
	}

	if (strip_suffix(filename, SIG_SUFFIX, &len)) {
		sig_filename = filename;
		filename = archive_name = xstrndup(filename, len);
	}

	f = find_format(filename);
	if (!f || (!sig_filename && !(ctx.repo->snapshots & cgit_snapshot_format_bit(f)))) {
		cgit_print_error_page(400, "Bad Request", "Unsupported snapshot format: %s", filename);
		goto done;
	}

	if (!hex && dwim) {
		strip_suffix(filename, f->suffix, &len);
		prefix = xstrndup(filename, len);
		// The stem becomes the prefix of every member of the archive,
		// and a revision expression such as :/pattern could carry a path
		// in it. An empty stem names no revision, though the lookup
		// would settle on a ref called v.
		if (len && !strchr(prefix, '/'))
			hex = ref = ref_from_filename(ctx.repo, prefix);
		if (!hex) {
			cgit_print_error_page(404, "Not Found", "Not found");
			goto done;
		}
	} else {
		prefix = xstrdup(cgit_snapshot_prefix(ctx.repo));
		if (!hex)
			hex = head;
	}

	if (sig_filename)
		send_sig(f, hex, filename, sig_filename);
	else
		send_snapshot(f, hex, prefix, filename);

done:
	free(prefix);
	free(ref);
	free(archive_name);
}