]> git.proxmox.com Git - libgit2.git/blobdiff - src/repository.c
New upstream version 1.4.3+dfsg.1
[libgit2.git] / src / repository.c
index 48e27069dc695e505afe3aef998102e9012e9132..6119c1c70b39fac624470a9a76c246a8a8f74d89 100644 (file)
@@ -4,18 +4,20 @@
  * This file is part of libgit2, distributed under the GNU GPL v2 with
  * a Linking Exception. For full terms see the included COPYING file.
  */
+
+#include "repository.h"
+
 #include <ctype.h>
 
 #include "git2/object.h"
-#include "git2/refdb.h"
 #include "git2/sys/repository.h"
 
+#include "buf.h"
 #include "common.h"
-#include "repository.h"
 #include "commit.h"
 #include "tag.h"
 #include "blob.h"
-#include "fileops.h"
+#include "futils.h"
 #include "sysdir.h"
 #include "filebuf.h"
 #include "index.h"
 #include "refs.h"
 #include "filter.h"
 #include "odb.h"
+#include "refdb.h"
 #include "remote.h"
 #include "merge.h"
 #include "diff_driver.h"
 #include "annotated_commit.h"
 #include "submodule.h"
 #include "worktree.h"
-
+#include "path.h"
 #include "strmap.h"
 
 #ifdef GIT_WIN32
 # include "win32/w32_util.h"
 #endif
 
+bool git_repository__validate_ownership = true;
+bool git_repository__fsync_gitdir = false;
+
 static const struct {
     git_repository_item_t parent;
+       git_repository_item_t fallback;
     const char *name;
     bool directory;
 } items[] = {
-       { GIT_REPOSITORY_ITEM_GITDIR, NULL, true },
-       { GIT_REPOSITORY_ITEM_WORKDIR, NULL, true },
-       { GIT_REPOSITORY_ITEM_COMMONDIR, NULL, true },
-       { GIT_REPOSITORY_ITEM_GITDIR, "index", false },
-       { GIT_REPOSITORY_ITEM_COMMONDIR, "objects", true },
-       { GIT_REPOSITORY_ITEM_COMMONDIR, "refs", true },
-       { GIT_REPOSITORY_ITEM_COMMONDIR, "packed-refs", false },
-       { GIT_REPOSITORY_ITEM_COMMONDIR, "remotes", true },
-       { GIT_REPOSITORY_ITEM_COMMONDIR, "config", false },
-       { GIT_REPOSITORY_ITEM_COMMONDIR, "info", true },
-       { GIT_REPOSITORY_ITEM_COMMONDIR, "hooks", true },
-       { GIT_REPOSITORY_ITEM_COMMONDIR, "logs", true },
-       { GIT_REPOSITORY_ITEM_GITDIR, "modules", true },
-       { GIT_REPOSITORY_ITEM_COMMONDIR, "worktrees", true }
+       { GIT_REPOSITORY_ITEM_GITDIR, GIT_REPOSITORY_ITEM__LAST, NULL, true },
+       { GIT_REPOSITORY_ITEM_WORKDIR, GIT_REPOSITORY_ITEM__LAST, NULL, true },
+       { GIT_REPOSITORY_ITEM_COMMONDIR, GIT_REPOSITORY_ITEM__LAST, NULL, true },
+       { GIT_REPOSITORY_ITEM_GITDIR, GIT_REPOSITORY_ITEM__LAST, "index", false },
+       { GIT_REPOSITORY_ITEM_COMMONDIR, GIT_REPOSITORY_ITEM_GITDIR, "objects", true },
+       { GIT_REPOSITORY_ITEM_COMMONDIR, GIT_REPOSITORY_ITEM_GITDIR, "refs", true },
+       { GIT_REPOSITORY_ITEM_COMMONDIR, GIT_REPOSITORY_ITEM_GITDIR, "packed-refs", false },
+       { GIT_REPOSITORY_ITEM_COMMONDIR, GIT_REPOSITORY_ITEM_GITDIR, "remotes", true },
+       { GIT_REPOSITORY_ITEM_COMMONDIR, GIT_REPOSITORY_ITEM_GITDIR, "config", false },
+       { GIT_REPOSITORY_ITEM_COMMONDIR, GIT_REPOSITORY_ITEM_GITDIR, "info", true },
+       { GIT_REPOSITORY_ITEM_COMMONDIR, GIT_REPOSITORY_ITEM_GITDIR, "hooks", true },
+       { GIT_REPOSITORY_ITEM_COMMONDIR, GIT_REPOSITORY_ITEM_GITDIR, "logs", true },
+       { GIT_REPOSITORY_ITEM_GITDIR, GIT_REPOSITORY_ITEM__LAST, "modules", true },
+       { GIT_REPOSITORY_ITEM_COMMONDIR, GIT_REPOSITORY_ITEM_GITDIR, "worktrees", true }
 };
 
-static int check_repositoryformatversion(git_config *config);
+static int check_repositoryformatversion(int *version, git_config *config);
+static int check_extensions(git_config *config, int version);
+static int load_global_config(git_config **config);
 
 #define GIT_COMMONDIR_FILE "commondir"
 #define GIT_GITDIR_FILE "gitdir"
 
 #define GIT_FILE_CONTENT_PREFIX "gitdir:"
 
-#define GIT_BRANCH_MASTER "master"
+#define GIT_BRANCH_DEFAULT "master"
 
 #define GIT_REPO_VERSION 0
+#define GIT_REPO_MAX_VERSION 1
 
-git_buf git_repository__reserved_names_win32[] = {
+git_str git_repository__reserved_names_win32[] = {
        { DOT_GIT, 0, CONST_STRLEN(DOT_GIT) },
        { GIT_DIR_SHORTNAME, 0, CONST_STRLEN(GIT_DIR_SHORTNAME) }
 };
 size_t git_repository__reserved_names_win32_len = 2;
 
-git_buf git_repository__reserved_names_posix[] = {
+git_str git_repository__reserved_names_posix[] = {
        { DOT_GIT, 0, CONST_STRLEN(DOT_GIT) },
 };
 size_t git_repository__reserved_names_posix_len = 1;
@@ -86,7 +96,7 @@ static void set_odb(git_repository *repo, git_odb *odb)
                GIT_REFCOUNT_INC(odb);
        }
 
-       if ((odb = git__swap(repo->_odb, odb)) != NULL) {
+       if ((odb = git_atomic_swap(repo->_odb, odb)) != NULL) {
                GIT_REFCOUNT_OWN(odb, NULL);
                git_odb_free(odb);
        }
@@ -99,7 +109,7 @@ static void set_refdb(git_repository *repo, git_refdb *refdb)
                GIT_REFCOUNT_INC(refdb);
        }
 
-       if ((refdb = git__swap(repo->_refdb, refdb)) != NULL) {
+       if ((refdb = git_atomic_swap(repo->_refdb, refdb)) != NULL) {
                GIT_REFCOUNT_OWN(refdb, NULL);
                git_refdb_free(refdb);
        }
@@ -112,12 +122,12 @@ static void set_config(git_repository *repo, git_config *config)
                GIT_REFCOUNT_INC(config);
        }
 
-       if ((config = git__swap(repo->_config, config)) != NULL) {
+       if ((config = git_atomic_swap(repo->_config, config)) != NULL) {
                GIT_REFCOUNT_OWN(config, NULL);
                git_config_free(config);
        }
 
-       git_repository__cvar_cache_clear(repo);
+       git_repository__configmap_lookup_cache_clear(repo);
 }
 
 static void set_index(git_repository *repo, git_index *index)
@@ -127,15 +137,15 @@ static void set_index(git_repository *repo, git_index *index)
                GIT_REFCOUNT_INC(index);
        }
 
-       if ((index = git__swap(repo->_index, index)) != NULL) {
+       if ((index = git_atomic_swap(repo->_index, index)) != NULL) {
                GIT_REFCOUNT_OWN(index, NULL);
                git_index_free(index);
        }
 }
 
-void git_repository__cleanup(git_repository *repo)
+int git_repository__cleanup(git_repository *repo)
 {
-       assert(repo);
+       GIT_ASSERT_ARG(repo);
 
        git_repository_submodule_cache_clear(repo);
        git_cache_clear(&repo->objects);
@@ -145,6 +155,8 @@ void git_repository__cleanup(git_repository *repo)
        set_index(repo, NULL);
        set_odb(repo, NULL);
        set_refdb(repo, NULL);
+
+       return 0;
 }
 
 void git_repository_free(git_repository *repo)
@@ -156,13 +168,13 @@ void git_repository_free(git_repository *repo)
 
        git_repository__cleanup(repo);
 
-       git_cache_free(&repo->objects);
+       git_cache_dispose(&repo->objects);
 
        git_diff_driver_registry_free(repo->diff_drivers);
        repo->diff_drivers = NULL;
 
        for (i = 0; i < repo->reserved_names.size; i++)
-               git_buf_free(git_array_get(repo->reserved_names, i));
+               git_str_dispose(git_array_get(repo->reserved_names, i));
        git_array_clear(repo->reserved_names);
 
        git__free(repo->gitlink);
@@ -177,49 +189,96 @@ void git_repository_free(git_repository *repo)
        git__free(repo);
 }
 
+/* Check if we have a separate commondir (e.g. we have a worktree) */
+static int lookup_commondir(bool *separate, git_str *commondir, git_str *repository_path)
+{
+       git_str common_link  = GIT_STR_INIT;
+       int error;
+
+       /*
+        * If there's no commondir file, the repository path is the
+        * common path, but it needs a trailing slash.
+        */
+       if (!git_fs_path_contains_file(repository_path, GIT_COMMONDIR_FILE)) {
+               if ((error = git_str_set(commondir, repository_path->ptr, repository_path->size)) == 0)
+                   error = git_fs_path_to_dir(commondir);
+
+               *separate = false;
+               goto done;
+       }
+
+       *separate = true;
+
+       if ((error = git_str_joinpath(&common_link, repository_path->ptr, GIT_COMMONDIR_FILE)) < 0 ||
+           (error = git_futils_readbuffer(&common_link, common_link.ptr)) < 0)
+               goto done;
+
+       git_str_rtrim(&common_link);
+       if (git_fs_path_is_relative(common_link.ptr)) {
+               if ((error = git_str_joinpath(commondir, repository_path->ptr, common_link.ptr)) < 0)
+                       goto done;
+       } else {
+               git_str_swap(commondir, &common_link);
+       }
+
+       git_str_dispose(&common_link);
+
+       /* Make sure the commondir path always has a trailing slash */
+       error = git_fs_path_prettify_dir(commondir, commondir->ptr, NULL);
+
+done:
+       return error;
+}
+
+GIT_INLINE(int) validate_repo_path(git_str *path)
+{
+       /*
+        * The longest static path in a repository (or commondir) is the
+        * packed refs file.  (Loose refs may be longer since they
+        * include the reference name, but will be validated when the
+        * path is constructed.)
+        */
+       static size_t suffix_len =
+               CONST_STRLEN("objects/pack/pack-.pack.lock") +
+               GIT_OID_HEXSZ;
+
+       return git_fs_path_validate_str_length_with_suffix(
+               path, suffix_len);
+}
+
 /*
  * Git repository open methods
  *
  * Open a repository object from its path
  */
-static bool valid_repository_path(git_buf *repository_path, git_buf *common_path)
+static int is_valid_repository_path(bool *out, git_str *repository_path, git_str *common_path)
 {
-       /* Check if we have a separate commondir (e.g. we have a
-        * worktree) */
-       if (git_path_contains_file(repository_path, GIT_COMMONDIR_FILE)) {
-               git_buf common_link  = GIT_BUF_INIT;
-               git_buf_joinpath(&common_link, repository_path->ptr, GIT_COMMONDIR_FILE);
-
-               git_futils_readbuffer(&common_link, common_link.ptr);
-               git_buf_rtrim(&common_link);
-
-               if (git_path_is_relative(common_link.ptr)) {
-                       git_buf_joinpath(common_path, repository_path->ptr, common_link.ptr);
-               } else {
-                       git_buf_swap(common_path, &common_link);
-               }
+       bool separate_commondir = false;
+       int error;
 
-               git_buf_free(&common_link);
-       }
-       else {
-               git_buf_set(common_path, repository_path->ptr, repository_path->size);
-       }
+       *out = false;
 
-       /* Make sure the commondir path always has a trailing * slash */
-       if (git_buf_rfind(common_path, '/') != (ssize_t)common_path->size - 1)
-               git_buf_putc(common_path, '/');
+       if ((error = lookup_commondir(&separate_commondir, common_path, repository_path)) < 0)
+               return error;
 
        /* Ensure HEAD file exists */
-       if (git_path_contains_file(repository_path, GIT_HEAD_FILE) == false)
-               return false;
+       if (git_fs_path_contains_file(repository_path, GIT_HEAD_FILE) == false)
+               return 0;
 
        /* Check files in common dir */
-       if (git_path_contains_dir(common_path, GIT_OBJECTS_DIR) == false)
-               return false;
-       if (git_path_contains_dir(common_path, GIT_REFS_DIR) == false)
-               return false;
+       if (git_fs_path_contains_dir(common_path, GIT_OBJECTS_DIR) == false)
+               return 0;
+       if (git_fs_path_contains_dir(common_path, GIT_REFS_DIR) == false)
+               return 0;
 
-       return true;
+       /* Ensure the repo (and commondir) are valid paths */
+       if ((error = validate_repo_path(common_path)) < 0 ||
+           (separate_commondir &&
+            (error = validate_repo_path(repository_path)) < 0))
+               return error;
+
+       *out = true;
+       return 0;
 }
 
 static git_repository *repository_alloc(void)
@@ -234,14 +293,14 @@ static git_repository *repository_alloc(void)
        if (!repo->reserved_names.ptr)
                goto on_error;
 
-       /* set all the entries in the cvar cache to `unset` */
-       git_repository__cvar_cache_clear(repo);
+       /* set all the entries in the configmap cache to `unset` */
+       git_repository__configmap_lookup_cache_clear(repo);
 
        return repo;
 
 on_error:
        if (repo)
-               git_cache_free(&repo->objects);
+               git_cache_dispose(&repo->objects);
 
        git__free(repo);
        return NULL;
@@ -252,7 +311,7 @@ int git_repository_new(git_repository **out)
        git_repository *repo;
 
        *out = repo = repository_alloc();
-       GITERR_CHECK_ALLOC(repo);
+       GIT_ERROR_CHECK_ALLOC(repo);
 
        repo->is_bare = 1;
        repo->is_worktree = 0;
@@ -264,21 +323,25 @@ static int load_config_data(git_repository *repo, const git_config *config)
 {
        int is_bare;
 
+       int err = git_config_get_bool(&is_bare, config, "core.bare");
+       if (err < 0 && err != GIT_ENOTFOUND)
+               return err;
+
        /* Try to figure out if it's bare, default to non-bare if it's not set */
-       if (git_config_get_bool(&is_bare, config, "core.bare") < 0)
-               repo->is_bare = 0;
+       if (err != GIT_ENOTFOUND)
+               repo->is_bare = is_bare && !repo->is_worktree;
        else
-               repo->is_bare = is_bare;
+               repo->is_bare = 0;
 
        return 0;
 }
 
-static int load_workdir(git_repository *repo, git_config *config, git_buf *parent_path)
+static int load_workdir(git_repository *repo, git_config *config, git_str *parent_path)
 {
        int error;
        git_config_entry *ce;
-       git_buf worktree = GIT_BUF_INIT;
-       git_buf path = GIT_BUF_INIT;
+       git_str worktree = GIT_STR_INIT;
+       git_str path = GIT_STR_INIT;
 
        if (repo->is_bare)
                return 0;
@@ -294,38 +357,38 @@ static int load_workdir(git_repository *repo, git_config *config, git_buf *paren
                        goto cleanup;
                }
 
-               git_buf_attach(&worktree, gitlink, 0);
+               git_str_attach(&worktree, gitlink, 0);
 
-               if ((git_path_dirname_r(&worktree, worktree.ptr)) < 0 ||
-                   git_path_to_dir(&worktree) < 0) {
+               if ((git_fs_path_dirname_r(&worktree, worktree.ptr)) < 0 ||
+                   git_fs_path_to_dir(&worktree) < 0) {
                        error = -1;
                        goto cleanup;
                }
 
-               repo->workdir = git_buf_detach(&worktree);
+               repo->workdir = git_str_detach(&worktree);
        }
        else if (ce && ce->value) {
-               if ((error = git_path_prettify_dir(
+               if ((error = git_fs_path_prettify_dir(
                                &worktree, ce->value, repo->gitdir)) < 0)
                        goto cleanup;
 
-               repo->workdir = git_buf_detach(&worktree);
+               repo->workdir = git_str_detach(&worktree);
        }
-       else if (parent_path && git_path_isdir(parent_path->ptr))
-               repo->workdir = git_buf_detach(parent_path);
+       else if (parent_path && git_fs_path_isdir(parent_path->ptr))
+               repo->workdir = git_str_detach(parent_path);
        else {
-               if (git_path_dirname_r(&worktree, repo->gitdir) < 0 ||
-                   git_path_to_dir(&worktree) < 0) {
+               if (git_fs_path_dirname_r(&worktree, repo->gitdir) < 0 ||
+                   git_fs_path_to_dir(&worktree) < 0) {
                        error = -1;
                        goto cleanup;
                }
 
-               repo->workdir = git_buf_detach(&worktree);
+               repo->workdir = git_str_detach(&worktree);
        }
 
-       GITERR_CHECK_ALLOC(repo->workdir);
+       GIT_ERROR_CHECK_ALLOC(repo->workdir);
 cleanup:
-       git_buf_free(&path);
+       git_str_dispose(&path);
        git_config_entry_free(ce);
        return error;
 }
@@ -334,7 +397,7 @@ cleanup:
  * This function returns furthest offset into path where a ceiling dir
  * is found, so we can stop processing the path at that point.
  *
- * Note: converting this to use git_bufs instead of GIT_PATH_MAX buffers on
+ * Note: converting this to use git_strs instead of GIT_PATH_MAX buffers on
  * the stack could remove directories name limits, but at the cost of doing
  * repeated malloc/frees inside the loop below, so let's not do it now.
  */
@@ -347,9 +410,9 @@ static size_t find_ceiling_dir_offset(
        const char *ceil, *sep;
        size_t len, max_len = 0, min_len;
 
-       assert(path);
+       GIT_ASSERT_ARG(path);
 
-       min_len = (size_t)(git_path_root(path) + 1);
+       min_len = (size_t)(git_fs_path_root(path) + 1);
 
        if (ceiling_directories == NULL || min_len == 0)
                return min_len;
@@ -358,7 +421,7 @@ static size_t find_ceiling_dir_offset(
                for (sep = ceil; *sep && *sep != GIT_PATH_LIST_SEPARATOR; sep++);
                len = sep - ceil;
 
-               if (len == 0 || len >= sizeof(buf) || git_path_root(ceil) == -1)
+               if (len == 0 || len >= sizeof(buf) || git_fs_path_root(ceil) == -1)
                        continue;
 
                strncpy(buf, ceil, len);
@@ -387,62 +450,120 @@ static size_t find_ceiling_dir_offset(
  * it points to.  Before calling, set `path_out` to the base directory that
  * should be used if the contents of `file_path` are a relative path.
  */
-static int read_gitfile(git_buf *path_out, const char *file_path)
+static int read_gitfile(git_str *path_out, const char *file_path)
 {
        int     error = 0;
-       git_buf file = GIT_BUF_INIT;
+       git_str file = GIT_STR_INIT;
        size_t  prefix_len = strlen(GIT_FILE_CONTENT_PREFIX);
 
-       assert(path_out && file_path);
+       GIT_ASSERT_ARG(path_out);
+       GIT_ASSERT_ARG(file_path);
 
        if (git_futils_readbuffer(&file, file_path) < 0)
                return -1;
 
-       git_buf_rtrim(&file);
+       git_str_rtrim(&file);
        /* apparently on Windows, some people use backslashes in paths */
-       git_path_mkposix(file.ptr);
+       git_fs_path_mkposix(file.ptr);
 
-       if (git_buf_len(&file) <= prefix_len ||
-               memcmp(git_buf_cstr(&file), GIT_FILE_CONTENT_PREFIX, prefix_len) != 0)
+       if (git_str_len(&file) <= prefix_len ||
+               memcmp(git_str_cstr(&file), GIT_FILE_CONTENT_PREFIX, prefix_len) != 0)
        {
-               giterr_set(GITERR_REPOSITORY,
+               git_error_set(GIT_ERROR_REPOSITORY,
                        "the `.git` file at '%s' is malformed", file_path);
                error = -1;
        }
-       else if ((error = git_path_dirname_r(path_out, file_path)) >= 0) {
-               const char *gitlink = git_buf_cstr(&file) + prefix_len;
+       else if ((error = git_fs_path_dirname_r(path_out, file_path)) >= 0) {
+               const char *gitlink = git_str_cstr(&file) + prefix_len;
                while (*gitlink && git__isspace(*gitlink)) gitlink++;
 
-               error = git_path_prettify_dir(
-                       path_out, gitlink, git_buf_cstr(path_out));
+               error = git_fs_path_prettify_dir(
+                       path_out, gitlink, git_str_cstr(path_out));
+       }
+
+       git_str_dispose(&file);
+       return error;
+}
+
+typedef struct {
+       const char *repo_path;
+       git_str tmp;
+       bool is_safe;
+} validate_ownership_data;
+
+static int validate_ownership_cb(const git_config_entry *entry, void *payload)
+{
+       validate_ownership_data *data = payload;
+
+       if (strcmp(entry->value, "") == 0)
+               data->is_safe = false;
+
+       if (git_fs_path_prettify_dir(&data->tmp, entry->value, NULL) == 0 &&
+           strcmp(data->tmp.ptr, data->repo_path) == 0)
+               data->is_safe = true;
+
+       return 0;
+}
+
+static int validate_ownership(const char *repo_path)
+{
+       git_config *config = NULL;
+       validate_ownership_data data = { repo_path, GIT_STR_INIT, false };
+       bool is_safe;
+       int error;
+
+       if ((error = git_fs_path_owner_is_current_user(&is_safe, repo_path)) < 0) {
+               if (error == GIT_ENOTFOUND)
+                       error = 0;
+
+               goto done;
        }
 
-       git_buf_free(&file);
+       if (is_safe) {
+               error = 0;
+               goto done;
+       }
+
+       if (load_global_config(&config) == 0) {
+               error = git_config_get_multivar_foreach(config, "safe.directory", NULL, validate_ownership_cb, &data);
+
+               if (!error && data.is_safe)
+                       goto done;
+       }
+
+       git_error_set(GIT_ERROR_CONFIG,
+               "repository path '%s' is not owned by current user",
+               repo_path);
+       error = GIT_EOWNER;
+
+done:
+       git_config_free(config);
+       git_str_dispose(&data.tmp);
        return error;
 }
 
 static int find_repo(
-       git_buf *repo_path,
-       git_buf *parent_path,
-       git_buf *link_path,
-       git_buf *common_path,
+       git_str *gitdir_path,
+       git_str *workdir_path,
+       git_str *gitlink_path,
+       git_str *commondir_path,
        const char *start_path,
        uint32_t flags,
        const char *ceiling_dirs)
 {
-       int error;
-       git_buf path = GIT_BUF_INIT;
-       git_buf repo_link = GIT_BUF_INIT;
-       git_buf common_link = GIT_BUF_INIT;
+       git_str path = GIT_STR_INIT;
+       git_str repo_link = GIT_STR_INIT;
+       git_str common_link = GIT_STR_INIT;
        struct stat st;
        dev_t initial_device = 0;
        int min_iterations;
-       bool in_dot_git;
+       bool in_dot_git, is_valid;
        size_t ceiling_offset = 0;
+       int error;
 
-       git_buf_free(repo_path);
+       git_str_clear(gitdir_path);
 
-       error = git_path_prettify(&path, start_path, NULL);
+       error = git_fs_path_prettify(&path, start_path, NULL);
        if (error < 0)
                return error;
 
@@ -464,9 +585,8 @@ static int find_repo(
        for (;;) {
                if (!(flags & GIT_REPOSITORY_OPEN_NO_DOTGIT)) {
                        if (!in_dot_git) {
-                               error = git_buf_joinpath(&path, path.ptr, DOT_GIT);
-                               if (error < 0)
-                                       break;
+                               if ((error = git_str_joinpath(&path, path.ptr, DOT_GIT)) < 0)
+                                       goto out;
                        }
                        in_dot_git = !in_dot_git;
                }
@@ -480,30 +600,35 @@ static int find_repo(
                                break;
 
                        if (S_ISDIR(st.st_mode)) {
-                               if (valid_repository_path(&path, &common_link)) {
-                                       git_path_to_dir(&path);
-                                       git_buf_set(repo_path, path.ptr, path.size);
+                               if ((error = is_valid_repository_path(&is_valid, &path, &common_link)) < 0)
+                                       goto out;
+
+                               if (is_valid) {
+                                       if ((error = git_fs_path_to_dir(&path)) < 0 ||
+                                           (error = git_str_set(gitdir_path, path.ptr, path.size)) < 0)
+                                               goto out;
 
-                                       if (link_path)
-                                               git_buf_attach(link_path,
-                                                       git_worktree__read_link(path.ptr, GIT_GITDIR_FILE), 0);
-                                       if (common_path)
-                                               git_buf_swap(&common_link, common_path);
+                                       if (gitlink_path)
+                                               if ((error = git_str_attach(gitlink_path, git_worktree__read_link(path.ptr, GIT_GITDIR_FILE), 0)) < 0)
+                                                       goto out;
+                                       if (commondir_path)
+                                               git_str_swap(&common_link, commondir_path);
 
                                        break;
                                }
-                       }
-                       else if (S_ISREG(st.st_mode) && git__suffixcmp(path.ptr, "/" DOT_GIT) == 0) {
-                               error = read_gitfile(&repo_link, path.ptr);
-                               if (error < 0)
-                                       break;
-                               if (valid_repository_path(&repo_link, &common_link)) {
-                                       git_buf_swap(repo_path, &repo_link);
-
-                                       if (link_path)
-                                               error = git_buf_put(link_path, path.ptr, path.size);
-                                       if (common_path)
-                                               git_buf_swap(&common_link, common_path);
+                       } else if (S_ISREG(st.st_mode) && git__suffixcmp(path.ptr, "/" DOT_GIT) == 0) {
+                               if ((error = read_gitfile(&repo_link, path.ptr)) < 0 ||
+                                   (error = is_valid_repository_path(&is_valid, &repo_link, &common_link)) < 0)
+                                       goto out;
+
+                               if (is_valid) {
+                                       git_str_swap(gitdir_path, &repo_link);
+
+                                       if (gitlink_path)
+                                               if ((error = git_str_put(gitlink_path, path.ptr, path.size)) < 0)
+                                                       goto out;
+                                       if (commondir_path)
+                                               git_str_swap(&common_link, commondir_path);
                                }
                                break;
                        }
@@ -512,10 +637,8 @@ static int find_repo(
                /* Move up one directory. If we're in_dot_git, we'll search the
                 * parent itself next. If we're !in_dot_git, we'll search .git
                 * in the parent directory next (added at the top of the loop). */
-               if (git_path_dirname_r(&path, path.ptr) < 0) {
-                       error = -1;
-                       break;
-               }
+               if ((error = git_fs_path_dirname_r(&path, path.ptr)) < 0)
+                       goto out;
 
                /* Once we've checked the directory (and .git if applicable),
                 * find the ceiling for a search. */
@@ -523,34 +646,31 @@ static int find_repo(
                        ceiling_offset = find_ceiling_dir_offset(path.ptr, ceiling_dirs);
 
                /* Check if we should stop searching here. */
-               if (min_iterations == 0
-                   && (path.ptr[ceiling_offset] == 0
-                       || (flags & GIT_REPOSITORY_OPEN_NO_SEARCH)))
+               if (min_iterations == 0 &&
+                   (path.ptr[ceiling_offset] == 0 || (flags & GIT_REPOSITORY_OPEN_NO_SEARCH)))
                        break;
        }
 
-       if (!error && parent_path && !(flags & GIT_REPOSITORY_OPEN_BARE)) {
-               if (!git_buf_len(repo_path))
-                       git_buf_clear(parent_path);
-               else {
-                       git_path_dirname_r(parent_path, path.ptr);
-                       git_path_to_dir(parent_path);
-               }
-               if (git_buf_oom(parent_path))
-                       return -1;
+       if (workdir_path && !(flags & GIT_REPOSITORY_OPEN_BARE)) {
+               if (!git_str_len(gitdir_path))
+                       git_str_clear(workdir_path);
+               else if ((error = git_fs_path_dirname_r(workdir_path, path.ptr)) < 0 ||
+                        (error = git_fs_path_to_dir(workdir_path)) < 0)
+                       goto out;
        }
 
        /* If we didn't find the repository, and we don't have any other error
         * to report, report that. */
-       if (!git_buf_len(repo_path) && !error) {
-               giterr_set(GITERR_REPOSITORY,
-                       "could not find repository from '%s'", start_path);
+       if (!git_str_len(gitdir_path)) {
+               git_error_set(GIT_ERROR_REPOSITORY, "could not find repository from '%s'", start_path);
                error = GIT_ENOTFOUND;
+               goto out;
        }
 
-       git_buf_free(&path);
-       git_buf_free(&repo_link);
-       git_buf_free(&common_link);
+out:
+       git_str_dispose(&path);
+       git_str_dispose(&repo_link);
+       git_str_dispose(&common_link);
        return error;
 }
 
@@ -558,27 +678,29 @@ int git_repository_open_bare(
        git_repository **repo_ptr,
        const char *bare_path)
 {
-       int error;
-       git_buf path = GIT_BUF_INIT, common_path = GIT_BUF_INIT;
+       git_str path = GIT_STR_INIT, common_path = GIT_STR_INIT;
        git_repository *repo = NULL;
+       bool is_valid;
+       int error;
 
-       if ((error = git_path_prettify_dir(&path, bare_path, NULL)) < 0)
+       if ((error = git_fs_path_prettify_dir(&path, bare_path, NULL)) < 0 ||
+           (error = is_valid_repository_path(&is_valid, &path, &common_path)) < 0)
                return error;
 
-       if (!valid_repository_path(&path, &common_path)) {
-               git_buf_free(&path);
-               git_buf_free(&common_path);
-               giterr_set(GITERR_REPOSITORY, "path is not a repository: %s", bare_path);
+       if (!is_valid) {
+               git_str_dispose(&path);
+               git_str_dispose(&common_path);
+               git_error_set(GIT_ERROR_REPOSITORY, "path is not a repository: %s", bare_path);
                return GIT_ENOTFOUND;
        }
 
        repo = repository_alloc();
-       GITERR_CHECK_ALLOC(repo);
+       GIT_ERROR_CHECK_ALLOC(repo);
 
-       repo->gitdir = git_buf_detach(&path);
-       GITERR_CHECK_ALLOC(repo->gitdir);
-       repo->commondir = git_buf_detach(&common_path);
-       GITERR_CHECK_ALLOC(repo->commondir);
+       repo->gitdir = git_str_detach(&path);
+       GIT_ERROR_CHECK_ALLOC(repo->gitdir);
+       repo->commondir = git_str_detach(&common_path);
+       GIT_ERROR_CHECK_ALLOC(repo->commondir);
 
        /* of course we're bare! */
        repo->is_bare = 1;
@@ -596,15 +718,15 @@ static int _git_repository_open_ext_from_env(
        git_repository *repo = NULL;
        git_index *index = NULL;
        git_odb *odb = NULL;
-       git_buf dir_buf = GIT_BUF_INIT;
-       git_buf ceiling_dirs_buf = GIT_BUF_INIT;
-       git_buf across_fs_buf = GIT_BUF_INIT;
-       git_buf index_file_buf = GIT_BUF_INIT;
-       git_buf namespace_buf = GIT_BUF_INIT;
-       git_buf object_dir_buf = GIT_BUF_INIT;
-       git_buf alts_buf = GIT_BUF_INIT;
-       git_buf work_tree_buf = GIT_BUF_INIT;
-       git_buf common_dir_buf = GIT_BUF_INIT;
+       git_str dir_buf = GIT_STR_INIT;
+       git_str ceiling_dirs_buf = GIT_STR_INIT;
+       git_str across_fs_buf = GIT_STR_INIT;
+       git_str index_file_buf = GIT_STR_INIT;
+       git_str namespace_buf = GIT_STR_INIT;
+       git_str object_dir_buf = GIT_STR_INIT;
+       git_str alts_buf = GIT_STR_INIT;
+       git_str work_tree_buf = GIT_STR_INIT;
+       git_str common_dir_buf = GIT_STR_INIT;
        const char *ceiling_dirs = NULL;
        unsigned flags = 0;
        int error;
@@ -612,12 +734,12 @@ static int _git_repository_open_ext_from_env(
        if (!start_path) {
                error = git__getenv(&dir_buf, "GIT_DIR");
                if (error == GIT_ENOTFOUND) {
-                       giterr_clear();
+                       git_error_clear();
                        start_path = ".";
                } else if (error < 0)
                        goto error;
                else {
-                       start_path = git_buf_cstr(&dir_buf);
+                       start_path = git_str_cstr(&dir_buf);
                        flags |= GIT_REPOSITORY_OPEN_NO_SEARCH;
                        flags |= GIT_REPOSITORY_OPEN_NO_DOTGIT;
                }
@@ -625,20 +747,20 @@ static int _git_repository_open_ext_from_env(
 
        error = git__getenv(&ceiling_dirs_buf, "GIT_CEILING_DIRECTORIES");
        if (error == GIT_ENOTFOUND)
-               giterr_clear();
+               git_error_clear();
        else if (error < 0)
                goto error;
        else
-               ceiling_dirs = git_buf_cstr(&ceiling_dirs_buf);
+               ceiling_dirs = git_str_cstr(&ceiling_dirs_buf);
 
        error = git__getenv(&across_fs_buf, "GIT_DISCOVERY_ACROSS_FILESYSTEM");
        if (error == GIT_ENOTFOUND)
-               giterr_clear();
+               git_error_clear();
        else if (error < 0)
                goto error;
        else {
                int across_fs = 0;
-               error = git_config_parse_bool(&across_fs, git_buf_cstr(&across_fs_buf));
+               error = git_config_parse_bool(&across_fs, git_str_cstr(&across_fs_buf));
                if (error < 0)
                        goto error;
                if (across_fs)
@@ -647,50 +769,50 @@ static int _git_repository_open_ext_from_env(
 
        error = git__getenv(&index_file_buf, "GIT_INDEX_FILE");
        if (error == GIT_ENOTFOUND)
-               giterr_clear();
+               git_error_clear();
        else if (error < 0)
                goto error;
        else {
-               error = git_index_open(&index, git_buf_cstr(&index_file_buf));
+               error = git_index_open(&index, git_str_cstr(&index_file_buf));
                if (error < 0)
                        goto error;
        }
 
        error = git__getenv(&namespace_buf, "GIT_NAMESPACE");
        if (error == GIT_ENOTFOUND)
-               giterr_clear();
+               git_error_clear();
        else if (error < 0)
                goto error;
 
        error = git__getenv(&object_dir_buf, "GIT_OBJECT_DIRECTORY");
        if (error == GIT_ENOTFOUND)
-               giterr_clear();
+               git_error_clear();
        else if (error < 0)
                goto error;
        else {
-               error = git_odb_open(&odb, git_buf_cstr(&object_dir_buf));
+               error = git_odb_open(&odb, git_str_cstr(&object_dir_buf));
                if (error < 0)
                        goto error;
        }
 
        error = git__getenv(&work_tree_buf, "GIT_WORK_TREE");
        if (error == GIT_ENOTFOUND)
-               giterr_clear();
+               git_error_clear();
        else if (error < 0)
                goto error;
        else {
-               giterr_set(GITERR_INVALID, "GIT_WORK_TREE unimplemented");
+               git_error_set(GIT_ERROR_INVALID, "GIT_WORK_TREE unimplemented");
                error = GIT_ERROR;
                goto error;
        }
 
        error = git__getenv(&work_tree_buf, "GIT_COMMON_DIR");
        if (error == GIT_ENOTFOUND)
-               giterr_clear();
+               git_error_clear();
        else if (error < 0)
                goto error;
        else {
-               giterr_set(GITERR_INVALID, "GIT_COMMON_DIR unimplemented");
+               git_error_set(GIT_ERROR_INVALID, "GIT_COMMON_DIR unimplemented");
                error = GIT_ERROR;
                goto error;
        }
@@ -704,7 +826,7 @@ static int _git_repository_open_ext_from_env(
 
        error = git__getenv(&alts_buf, "GIT_ALTERNATE_OBJECT_DIRECTORIES");
        if (error == GIT_ENOTFOUND) {
-               giterr_clear();
+               git_error_clear();
                error = 0;
        } else if (error < 0)
                goto error;
@@ -717,7 +839,7 @@ static int _git_repository_open_ext_from_env(
                                goto error;
                }
 
-               end = git_buf_cstr(&alts_buf) + git_buf_len(&alts_buf);
+               end = git_str_cstr(&alts_buf) + git_str_len(&alts_buf);
                for (sep = alt = alts_buf.ptr; sep != end; alt = sep+1) {
                        for (sep = alt; *sep && *sep != GIT_PATH_LIST_SEPARATOR; sep++)
                                ;
@@ -729,8 +851,8 @@ static int _git_repository_open_ext_from_env(
                }
        }
 
-       if (git_buf_len(&namespace_buf)) {
-               error = git_repository_set_namespace(repo, git_buf_cstr(&namespace_buf));
+       if (git_str_len(&namespace_buf)) {
+               error = git_repository_set_namespace(repo, git_str_cstr(&namespace_buf));
                if (error < 0)
                        goto error;
        }
@@ -746,15 +868,38 @@ error:
 success:
        git_odb_free(odb);
        git_index_free(index);
-       git_buf_free(&common_dir_buf);
-       git_buf_free(&work_tree_buf);
-       git_buf_free(&alts_buf);
-       git_buf_free(&object_dir_buf);
-       git_buf_free(&namespace_buf);
-       git_buf_free(&index_file_buf);
-       git_buf_free(&across_fs_buf);
-       git_buf_free(&ceiling_dirs_buf);
-       git_buf_free(&dir_buf);
+       git_str_dispose(&common_dir_buf);
+       git_str_dispose(&work_tree_buf);
+       git_str_dispose(&alts_buf);
+       git_str_dispose(&object_dir_buf);
+       git_str_dispose(&namespace_buf);
+       git_str_dispose(&index_file_buf);
+       git_str_dispose(&across_fs_buf);
+       git_str_dispose(&ceiling_dirs_buf);
+       git_str_dispose(&dir_buf);
+       return error;
+}
+
+static int repo_is_worktree(unsigned *out, const git_repository *repo)
+{
+       git_str gitdir_link = GIT_STR_INIT;
+       int error;
+
+       /* Worktrees cannot have the same commondir and gitdir */
+       if (repo->commondir && repo->gitdir
+           && !strcmp(repo->commondir, repo->gitdir)) {
+               *out = 0;
+               return 0;
+       }
+
+       if ((error = git_str_joinpath(&gitdir_link, repo->gitdir, "gitdir")) < 0)
+               return -1;
+
+       /* A 'gitdir' file inside a git directory is currently
+        * only used when the repository is a working tree. */
+       *out = !!git_fs_path_exists(gitdir_link.ptr);
+
+       git_str_dispose(&gitdir_link);
        return error;
 }
 
@@ -765,10 +910,13 @@ int git_repository_open_ext(
        const char *ceiling_dirs)
 {
        int error;
-       git_buf path = GIT_BUF_INIT, parent = GIT_BUF_INIT,
-               link_path = GIT_BUF_INIT, common_path = GIT_BUF_INIT;
-       git_repository *repo;
+       unsigned is_worktree;
+       git_str gitdir = GIT_STR_INIT, workdir = GIT_STR_INIT,
+               gitlink = GIT_STR_INIT, commondir = GIT_STR_INIT;
+       git_repository *repo = NULL;
        git_config *config = NULL;
+       const char *validation_path;
+       int version = 0;
 
        if (flags & GIT_REPOSITORY_OPEN_FROM_ENV)
                return _git_repository_open_ext_from_env(repo_ptr, start_path);
@@ -777,32 +925,29 @@ int git_repository_open_ext(
                *repo_ptr = NULL;
 
        error = find_repo(
-               &path, &parent, &link_path, &common_path, start_path, flags, ceiling_dirs);
+               &gitdir, &workdir, &gitlink, &commondir, start_path, flags, ceiling_dirs);
 
        if (error < 0 || !repo_ptr)
-               return error;
+               goto cleanup;
 
        repo = repository_alloc();
-       GITERR_CHECK_ALLOC(repo);
+       GIT_ERROR_CHECK_ALLOC(repo);
 
-       repo->gitdir = git_buf_detach(&path);
-       GITERR_CHECK_ALLOC(repo->gitdir);
+       repo->gitdir = git_str_detach(&gitdir);
+       GIT_ERROR_CHECK_ALLOC(repo->gitdir);
 
-       if (link_path.size) {
-               repo->gitlink = git_buf_detach(&link_path);
-               GITERR_CHECK_ALLOC(repo->gitlink);
+       if (gitlink.size) {
+               repo->gitlink = git_str_detach(&gitlink);
+               GIT_ERROR_CHECK_ALLOC(repo->gitlink);
        }
-       if (common_path.size) {
-               repo->commondir = git_buf_detach(&common_path);
-               GITERR_CHECK_ALLOC(repo->commondir);
+       if (commondir.size) {
+               repo->commondir = git_str_detach(&commondir);
+               GIT_ERROR_CHECK_ALLOC(repo->commondir);
        }
 
-       if ((error = git_buf_joinpath(&path, repo->gitdir, "gitdir")) < 0)
+       if ((error = repo_is_worktree(&is_worktree, repo)) < 0)
                goto cleanup;
-       /* A 'gitdir' file inside a git directory is currently
-        * only used when the repository is a working tree. */
-       if (git_path_exists(path.ptr))
-               repo->is_worktree = 1;
+       repo->is_worktree = is_worktree;
 
        /*
         * We'd like to have the config, but git doesn't particularly
@@ -813,27 +958,40 @@ int git_repository_open_ext(
        if (error < 0 && error != GIT_ENOTFOUND)
                goto cleanup;
 
-       if (config && (error = check_repositoryformatversion(config)) < 0)
+       if (config && (error = check_repositoryformatversion(&version, config)) < 0)
                goto cleanup;
 
-       if ((flags & GIT_REPOSITORY_OPEN_BARE) != 0)
-               repo->is_bare = 1;
-       else {
+       if ((error = check_extensions(config, version)) < 0)
+               goto cleanup;
 
+       if ((flags & GIT_REPOSITORY_OPEN_BARE) != 0) {
+               repo->is_bare = 1;
+       } else {
                if (config &&
                    ((error = load_config_data(repo, config)) < 0 ||
-                    (error = load_workdir(repo, config, &parent)) < 0))
+                    (error = load_workdir(repo, config, &workdir)) < 0))
                        goto cleanup;
        }
 
+       /*
+        * Ensure that the git directory is owned by the current user.
+        */
+       validation_path = repo->is_bare ? repo->gitdir : repo->workdir;
+
+       if (git_repository__validate_ownership &&
+           (error = validate_ownership(validation_path)) < 0)
+               goto cleanup;
+
 cleanup:
-       git_buf_free(&path);
-       git_buf_free(&parent);
+       git_str_dispose(&gitdir);
+       git_str_dispose(&workdir);
+       git_str_dispose(&gitlink);
+       git_str_dispose(&commondir);
        git_config_free(config);
 
        if (error < 0)
                git_repository_free(repo);
-       else
+       else if (repo_ptr)
                *repo_ptr = repo;
 
        return error;
@@ -847,11 +1005,13 @@ int git_repository_open(git_repository **repo_out, const char *path)
 
 int git_repository_open_from_worktree(git_repository **repo_out, git_worktree *wt)
 {
-       git_buf path = GIT_BUF_INIT;
+       git_str path = GIT_STR_INIT;
        git_repository *repo = NULL;
-       int len, err;
+       size_t len;
+       int err;
 
-       assert(repo_out && wt);
+       GIT_ASSERT_ARG(repo_out);
+       GIT_ASSERT_ARG(wt);
 
        *repo_out = NULL;
        len = strlen(wt->gitlink_path);
@@ -861,7 +1021,7 @@ int git_repository_open_from_worktree(git_repository **repo_out, git_worktree *w
                goto out;
        }
 
-       if ((err = git_buf_set(&path, wt->gitlink_path, len - 4)) < 0)
+       if ((err = git_str_set(&path, wt->gitlink_path, len - 4)) < 0)
                goto out;
 
        if ((err = git_repository_open(&repo, path.ptr)) < 0)
@@ -870,7 +1030,7 @@ int git_repository_open_from_worktree(git_repository **repo_out, git_worktree *w
        *repo_out = repo;
 
 out:
-       git_buf_free(&path);
+       git_str_dispose(&path);
 
        return err;
 }
@@ -880,7 +1040,7 @@ int git_repository_wrap_odb(git_repository **repo_out, git_odb *odb)
        git_repository *repo;
 
        repo = repository_alloc();
-       GITERR_CHECK_ALLOC(repo);
+       GIT_ERROR_CHECK_ALLOC(repo);
 
        git_repository_set_odb(repo, odb);
        *repo_out = repo;
@@ -896,11 +1056,9 @@ int git_repository_discover(
 {
        uint32_t flags = across_fs ? GIT_REPOSITORY_OPEN_CROSS_FS : 0;
 
-       assert(start_path);
+       GIT_ASSERT_ARG(start_path);
 
-       git_buf_sanitize(out);
-
-       return find_repo(out, NULL, NULL, NULL, start_path, flags, ceiling_dirs);
+       GIT_BUF_WRAP_PRIVATE(out, find_repo, NULL, NULL, NULL, start_path, flags, ceiling_dirs);
 }
 
 static int load_config(
@@ -912,64 +1070,63 @@ static int load_config(
        const char *programdata_path)
 {
        int error;
-       git_buf config_path = GIT_BUF_INIT;
+       git_str config_path = GIT_STR_INIT;
        git_config *cfg = NULL;
 
-       assert(repo && out);
+       GIT_ASSERT_ARG(out);
 
        if ((error = git_config_new(&cfg)) < 0)
                return error;
 
-       error = git_repository_item_path(&config_path, repo, GIT_REPOSITORY_ITEM_CONFIG);
-       if (error < 0)
-               goto on_error;
+       if (repo) {
+               if ((error = git_repository__item_path(&config_path, repo, GIT_REPOSITORY_ITEM_CONFIG)) == 0)
+                       error = git_config_add_file_ondisk(cfg, config_path.ptr, GIT_CONFIG_LEVEL_LOCAL, repo, 0);
 
-       if ((error = git_config_add_file_ondisk(
-                       cfg, config_path.ptr, GIT_CONFIG_LEVEL_LOCAL, 0)) < 0 &&
-               error != GIT_ENOTFOUND)
-               goto on_error;
+               if (error && error != GIT_ENOTFOUND)
+                       goto on_error;
 
-       git_buf_free(&config_path);
+               git_str_dispose(&config_path);
+       }
 
        if (global_config_path != NULL &&
                (error = git_config_add_file_ondisk(
-                       cfg, global_config_path, GIT_CONFIG_LEVEL_GLOBAL, 0)) < 0 &&
+                       cfg, global_config_path, GIT_CONFIG_LEVEL_GLOBAL, repo, 0)) < 0 &&
                error != GIT_ENOTFOUND)
                goto on_error;
 
        if (xdg_config_path != NULL &&
                (error = git_config_add_file_ondisk(
-                       cfg, xdg_config_path, GIT_CONFIG_LEVEL_XDG, 0)) < 0 &&
+                       cfg, xdg_config_path, GIT_CONFIG_LEVEL_XDG, repo, 0)) < 0 &&
                error != GIT_ENOTFOUND)
                goto on_error;
 
        if (system_config_path != NULL &&
                (error = git_config_add_file_ondisk(
-                       cfg, system_config_path, GIT_CONFIG_LEVEL_SYSTEM, 0)) < 0 &&
+                       cfg, system_config_path, GIT_CONFIG_LEVEL_SYSTEM, repo, 0)) < 0 &&
                error != GIT_ENOTFOUND)
                goto on_error;
 
        if (programdata_path != NULL &&
                (error = git_config_add_file_ondisk(
-                       cfg, programdata_path, GIT_CONFIG_LEVEL_PROGRAMDATA, 0)) < 0 &&
+                       cfg, programdata_path, GIT_CONFIG_LEVEL_PROGRAMDATA, repo, 0)) < 0 &&
                error != GIT_ENOTFOUND)
                goto on_error;
 
-       giterr_clear(); /* clear any lingering ENOTFOUND errors */
+       git_error_clear(); /* clear any lingering ENOTFOUND errors */
 
        *out = cfg;
        return 0;
 
 on_error:
-       git_buf_free(&config_path);
+       git_str_dispose(&config_path);
        git_config_free(cfg);
        *out = NULL;
        return error;
 }
 
-static const char *path_unless_empty(git_buf *buf)
+static const char *path_unless_empty(git_str *buf)
 {
-       return git_buf_len(buf) > 0 ? git_buf_cstr(buf) : NULL;
+       return git_str_len(buf) > 0 ? git_str_cstr(buf) : NULL;
 }
 
 int git_repository_config__weakptr(git_config **out, git_repository *repo)
@@ -977,19 +1134,19 @@ int git_repository_config__weakptr(git_config **out, git_repository *repo)
        int error = 0;
 
        if (repo->_config == NULL) {
-               git_buf global_buf = GIT_BUF_INIT;
-               git_buf xdg_buf = GIT_BUF_INIT;
-               git_buf system_buf = GIT_BUF_INIT;
-               git_buf programdata_buf = GIT_BUF_INIT;
+               git_str global_buf = GIT_STR_INIT;
+               git_str xdg_buf = GIT_STR_INIT;
+               git_str system_buf = GIT_STR_INIT;
+               git_str programdata_buf = GIT_STR_INIT;
                git_config *config;
 
-               git_config_find_global(&global_buf);
-               git_config_find_xdg(&xdg_buf);
-               git_config_find_system(&system_buf);
-               git_config_find_programdata(&programdata_buf);
+               git_config__find_global(&global_buf);
+               git_config__find_xdg(&xdg_buf);
+               git_config__find_system(&system_buf);
+               git_config__find_programdata(&programdata_buf);
 
                /* If there is no global file, open a backend for it anyway */
-               if (git_buf_len(&global_buf) == 0)
+               if (git_str_len(&global_buf) == 0)
                        git_config__global_location(&global_buf);
 
                error = load_config(
@@ -1001,17 +1158,16 @@ int git_repository_config__weakptr(git_config **out, git_repository *repo)
                if (!error) {
                        GIT_REFCOUNT_OWN(config, repo);
 
-                       config = git__compare_and_swap(&repo->_config, NULL, config);
-                       if (config != NULL) {
+                       if (git_atomic_compare_and_swap(&repo->_config, NULL, config) != NULL) {
                                GIT_REFCOUNT_OWN(config, NULL);
                                git_config_free(config);
                        }
                }
 
-               git_buf_free(&global_buf);
-               git_buf_free(&xdg_buf);
-               git_buf_free(&system_buf);
-               git_buf_free(&programdata_buf);
+               git_str_dispose(&global_buf);
+               git_str_dispose(&xdg_buf);
+               git_str_dispose(&system_buf);
+               git_str_dispose(&programdata_buf);
        }
 
        *out = repo->_config;
@@ -1038,23 +1194,28 @@ int git_repository_config_snapshot(git_config **out, git_repository *repo)
        return git_config_snapshot(out, weak);
 }
 
-void git_repository_set_config(git_repository *repo, git_config *config)
+int git_repository_set_config(git_repository *repo, git_config *config)
 {
-       assert(repo && config);
+       GIT_ASSERT_ARG(repo);
+       GIT_ASSERT_ARG(config);
+
        set_config(repo, config);
+       return 0;
 }
 
 int git_repository_odb__weakptr(git_odb **out, git_repository *repo)
 {
        int error = 0;
 
-       assert(repo && out);
+       GIT_ASSERT_ARG(repo);
+       GIT_ASSERT_ARG(out);
 
-       if (repo->_odb == NULL) {
-               git_buf odb_path = GIT_BUF_INIT;
+       *out = git_atomic_load(repo->_odb);
+       if (*out == NULL) {
+               git_str odb_path = GIT_STR_INIT;
                git_odb *odb;
 
-               if ((error = git_repository_item_path(&odb_path, repo,
+               if ((error = git_repository__item_path(&odb_path, repo,
                                GIT_REPOSITORY_ITEM_OBJECTS)) < 0 ||
                        (error = git_odb_new(&odb)) < 0)
                        return error;
@@ -1067,16 +1228,15 @@ int git_repository_odb__weakptr(git_odb **out, git_repository *repo)
                        return error;
                }
 
-               odb = git__compare_and_swap(&repo->_odb, NULL, odb);
-               if (odb != NULL) {
+               if (git_atomic_compare_and_swap(&repo->_odb, NULL, odb) != NULL) {
                        GIT_REFCOUNT_OWN(odb, NULL);
                        git_odb_free(odb);
                }
 
-               git_buf_free(&odb_path);
+               git_str_dispose(&odb_path);
+               *out = git_atomic_load(repo->_odb);
        }
 
-       *out = repo->_odb;
        return error;
 }
 
@@ -1089,17 +1249,21 @@ int git_repository_odb(git_odb **out, git_repository *repo)
        return 0;
 }
 
-void git_repository_set_odb(git_repository *repo, git_odb *odb)
+int git_repository_set_odb(git_repository *repo, git_odb *odb)
 {
-       assert(repo && odb);
+       GIT_ASSERT_ARG(repo);
+       GIT_ASSERT_ARG(odb);
+
        set_odb(repo, odb);
+       return 0;
 }
 
 int git_repository_refdb__weakptr(git_refdb **out, git_repository *repo)
 {
        int error = 0;
 
-       assert(out && repo);
+       GIT_ASSERT_ARG(out);
+       GIT_ASSERT_ARG(repo);
 
        if (repo->_refdb == NULL) {
                git_refdb *refdb;
@@ -1108,8 +1272,7 @@ int git_repository_refdb__weakptr(git_refdb **out, git_repository *repo)
                if (!error) {
                        GIT_REFCOUNT_OWN(refdb, repo);
 
-                       refdb = git__compare_and_swap(&repo->_refdb, NULL, refdb);
-                       if (refdb != NULL) {
+                       if (git_atomic_compare_and_swap(&repo->_refdb, NULL, refdb) != NULL) {
                                GIT_REFCOUNT_OWN(refdb, NULL);
                                git_refdb_free(refdb);
                        }
@@ -1129,39 +1292,43 @@ int git_repository_refdb(git_refdb **out, git_repository *repo)
        return 0;
 }
 
-void git_repository_set_refdb(git_repository *repo, git_refdb *refdb)
+int git_repository_set_refdb(git_repository *repo, git_refdb *refdb)
 {
-       assert(repo && refdb);
+       GIT_ASSERT_ARG(repo);
+       GIT_ASSERT_ARG(refdb);
+
        set_refdb(repo, refdb);
+       return 0;
 }
 
 int git_repository_index__weakptr(git_index **out, git_repository *repo)
 {
        int error = 0;
 
-       assert(out && repo);
+       GIT_ASSERT_ARG(out);
+       GIT_ASSERT_ARG(repo);
 
        if (repo->_index == NULL) {
-               git_buf index_path = GIT_BUF_INIT;
+               git_str index_path = GIT_STR_INIT;
                git_index *index;
 
-               if ((error = git_buf_joinpath(&index_path, repo->gitdir, GIT_INDEX_FILE)) < 0)
+               if ((error = git_str_joinpath(&index_path, repo->gitdir, GIT_INDEX_FILE)) < 0)
                        return error;
 
                error = git_index_open(&index, index_path.ptr);
                if (!error) {
                        GIT_REFCOUNT_OWN(index, repo);
 
-                       index = git__compare_and_swap(&repo->_index, NULL, index);
-                       if (index != NULL) {
+                       if (git_atomic_compare_and_swap(&repo->_index, NULL, index) != NULL) {
                                GIT_REFCOUNT_OWN(index, NULL);
                                git_index_free(index);
                        }
 
-                       error = git_index_set_caps(repo->_index, GIT_INDEXCAP_FROM_OWNER);
+                       error = git_index_set_caps(repo->_index,
+                                                  GIT_INDEX_CAPABILITY_FROM_OWNER);
                }
 
-               git_buf_free(&index_path);
+               git_str_dispose(&index_path);
        }
 
        *out = repo->_index;
@@ -1177,10 +1344,11 @@ int git_repository_index(git_index **out, git_repository *repo)
        return 0;
 }
 
-void git_repository_set_index(git_repository *repo, git_index *index)
+int git_repository_set_index(git_repository *repo, git_index *index)
 {
-       assert(repo);
+       GIT_ASSERT_ARG(repo);
        set_index(repo, index);
+       return 0;
 }
 
 int git_repository_set_namespace(git_repository *repo, const char *namespace)
@@ -1208,14 +1376,14 @@ static int reserved_names_add8dot3(git_repository *repo, const char *path)
        const char *def_dot_git = DOT_GIT;
        size_t name_len, def_len = CONST_STRLEN(GIT_DIR_SHORTNAME);
        size_t def_dot_git_len = CONST_STRLEN(DOT_GIT);
-       git_buf *buf;
+       git_str *buf;
 
        if (!name)
                return 0;
 
        name_len = strlen(name);
 
-       if ((name_len == def_len && memcmp(name, def, def_len) == 0) || 
+       if ((name_len == def_len && memcmp(name, def, def_len) == 0) ||
                (name_len == def_dot_git_len && memcmp(name, def_dot_git, def_dot_git_len) == 0)) {
                git__free(name);
                return 0;
@@ -1224,17 +1392,17 @@ static int reserved_names_add8dot3(git_repository *repo, const char *path)
        if ((buf = git_array_alloc(repo->reserved_names)) == NULL)
                return -1;
 
-       git_buf_attach(buf, name, name_len);
+       git_str_attach(buf, name, name_len);
        return true;
 }
 
 bool git_repository__reserved_names(
-       git_buf **out, size_t *outlen, git_repository *repo, bool include_ntfs)
+       git_str **out, size_t *outlen, git_repository *repo, bool include_ntfs)
 {
        GIT_UNUSED(include_ntfs);
 
        if (repo->reserved_names.size == 0) {
-               git_buf *buf;
+               git_str *buf;
                size_t i;
 
                /* Add the static defaults */
@@ -1256,8 +1424,8 @@ bool git_repository__reserved_names(
                        int (*prefixcmp)(const char *, const char *);
                        int error, ignorecase;
 
-                       error = git_repository__cvar(
-                               &ignorecase, repo, GIT_CVAR_IGNORECASE);
+                       error = git_repository__configmap_lookup(
+                               &ignorecase, repo, GIT_CONFIGMAP_IGNORECASE);
                        prefixcmp = (error || ignorecase) ? git__prefixcmp_icase :
                                git__prefixcmp;
 
@@ -1286,7 +1454,7 @@ on_error:
 }
 #else
 bool git_repository__reserved_names(
-       git_buf **out, size_t *outlen, git_repository *repo, bool include_ntfs)
+       git_str **out, size_t *outlen, git_repository *repo, bool include_ntfs)
 {
        GIT_UNUSED(repo);
 
@@ -1302,11 +1470,11 @@ bool git_repository__reserved_names(
 }
 #endif
 
-static int check_repositoryformatversion(git_config *config)
+static int check_repositoryformatversion(int *version, git_config *config)
 {
-       int version, error;
+       int error;
 
-       error = git_config_get_int32(&version, config, "core.repositoryformatversion");
+       error = git_config_get_int32(version, config, "core.repositoryformatversion");
        /* git ignores this if the config variable isn't there */
        if (error == GIT_ENOTFOUND)
                return 0;
@@ -1314,45 +1482,168 @@ static int check_repositoryformatversion(git_config *config)
        if (error < 0)
                return -1;
 
-       if (GIT_REPO_VERSION < version) {
-               giterr_set(GITERR_REPOSITORY,
-                       "unsupported repository version %d. Only versions up to %d are supported.",
-                       version, GIT_REPO_VERSION);
+       if (GIT_REPO_MAX_VERSION < *version) {
+               git_error_set(GIT_ERROR_REPOSITORY,
+                       "unsupported repository version %d; only versions up to %d are supported",
+                       *version, GIT_REPO_MAX_VERSION);
                return -1;
        }
 
        return 0;
 }
 
+static const char *builtin_extensions[] = {
+       "noop"
+};
+
+static git_vector user_extensions = GIT_VECTOR_INIT;
+
+static int check_valid_extension(const git_config_entry *entry, void *payload)
+{
+       git_str cfg = GIT_STR_INIT;
+       bool reject;
+       const char *extension;
+       size_t i;
+       int error = 0;
+
+       GIT_UNUSED(payload);
+
+       git_vector_foreach (&user_extensions, i, extension) {
+               git_str_clear(&cfg);
+
+               /*
+                * Users can specify that they don't want to support an
+                * extension with a '!' prefix.
+                */
+               if ((reject = (extension[0] == '!')) == true)
+                       extension = &extension[1];
+
+               if ((error = git_str_printf(&cfg, "extensions.%s", extension)) < 0)
+                       goto done;
+
+               if (strcmp(entry->name, cfg.ptr) == 0) {
+                       if (reject)
+                               goto fail;
+
+                       goto done;
+               }
+       }
+
+       for (i = 0; i < ARRAY_SIZE(builtin_extensions); i++) {
+               extension = builtin_extensions[i];
+
+               if ((error = git_str_printf(&cfg, "extensions.%s", extension)) < 0)
+                       goto done;
+
+               if (strcmp(entry->name, cfg.ptr) == 0)
+                       goto done;
+       }
+
+fail:
+       git_error_set(GIT_ERROR_REPOSITORY, "unsupported extension name %s", entry->name);
+       error = -1;
+
+done:
+       git_str_dispose(&cfg);
+       return error;
+}
+
+static int check_extensions(git_config *config, int version)
+{
+       if (version < 1)
+               return 0;
+
+       return git_config_foreach_match(config, "^extensions\\.", check_valid_extension, NULL);
+}
+
+int git_repository__extensions(char ***out, size_t *out_len)
+{
+       git_vector extensions;
+       const char *builtin, *user;
+       char *extension;
+       size_t i, j;
+
+       if (git_vector_init(&extensions, 8, NULL) < 0)
+               return -1;
+
+       for (i = 0; i < ARRAY_SIZE(builtin_extensions); i++) {
+               bool match = false;
+
+               builtin = builtin_extensions[i];
+
+               git_vector_foreach (&user_extensions, j, user) {
+                       if (user[0] == '!' && strcmp(builtin, &user[1]) == 0) {
+                               match = true;
+                               break;
+                       }
+               }
+
+               if (match)
+                       continue;
+
+               if ((extension = git__strdup(builtin)) == NULL ||
+                   git_vector_insert(&extensions, extension) < 0)
+                       return -1;
+       }
+
+       git_vector_foreach (&user_extensions, i, user) {
+               if (user[0] == '!')
+                       continue;
+
+               if ((extension = git__strdup(user)) == NULL ||
+                   git_vector_insert(&extensions, extension) < 0)
+                       return -1;
+       }
+
+       *out = (char **)git_vector_detach(out_len, NULL, &extensions);
+       return 0;
+}
+
+int git_repository__set_extensions(const char **extensions, size_t len)
+{
+       char *extension;
+       size_t i;
+
+       git_repository__free_extensions();
+
+       for (i = 0; i < len; i++) {
+               if ((extension = git__strdup(extensions[i])) == NULL ||
+                   git_vector_insert(&user_extensions, extension) < 0)
+                       return -1;
+       }
+
+       return 0;
+}
+
+void git_repository__free_extensions(void)
+{
+       git_vector_free_deep(&user_extensions);
+}
+
 int git_repository_create_head(const char *git_dir, const char *ref_name)
 {
-       git_buf ref_path = GIT_BUF_INIT;
+       git_str ref_path = GIT_STR_INIT;
        git_filebuf ref = GIT_FILEBUF_INIT;
        const char *fmt;
+       int error;
 
-       if (git_buf_joinpath(&ref_path, git_dir, GIT_HEAD_FILE) < 0 ||
-               git_filebuf_open(&ref, ref_path.ptr, 0, GIT_REFS_FILE_MODE) < 0)
-               goto fail;
-
-       if (!ref_name)
-               ref_name = GIT_BRANCH_MASTER;
+       if ((error = git_str_joinpath(&ref_path, git_dir, GIT_HEAD_FILE)) < 0 ||
+           (error = git_filebuf_open(&ref, ref_path.ptr, 0, GIT_REFS_FILE_MODE)) < 0)
+               goto out;
 
        if (git__prefixcmp(ref_name, GIT_REFS_DIR) == 0)
                fmt = "ref: %s\n";
        else
                fmt = "ref: " GIT_REFS_HEADS_DIR "%s\n";
 
-       if (git_filebuf_printf(&ref, fmt, ref_name) < 0 ||
-               git_filebuf_commit(&ref) < 0)
-               goto fail;
-
-       git_buf_free(&ref_path);
-       return 0;
+       if ((error = git_filebuf_printf(&ref, fmt, ref_name)) < 0 ||
+           (error = git_filebuf_commit(&ref)) < 0)
+               goto out;
 
-fail:
-       git_buf_free(&ref_path);
+out:
+       git_str_dispose(&ref_path);
        git_filebuf_cleanup(&ref);
-       return -1;
+       return error;
 }
 
 static bool is_chmod_supported(const char *file_path)
@@ -1373,36 +1664,72 @@ static bool is_chmod_supported(const char *file_path)
 
 static bool is_filesystem_case_insensitive(const char *gitdir_path)
 {
-       git_buf path = GIT_BUF_INIT;
+       git_str path = GIT_STR_INIT;
        int is_insensitive = -1;
 
-       if (!git_buf_joinpath(&path, gitdir_path, "CoNfIg"))
-               is_insensitive = git_path_exists(git_buf_cstr(&path));
+       if (!git_str_joinpath(&path, gitdir_path, "CoNfIg"))
+               is_insensitive = git_fs_path_exists(git_str_cstr(&path));
 
-       git_buf_free(&path);
+       git_str_dispose(&path);
        return is_insensitive;
 }
 
+/*
+ * Return a configuration object with only the global and system
+ * configurations; no repository-level configuration.
+ */
+static int load_global_config(git_config **config)
+{
+       git_str global_buf = GIT_STR_INIT;
+       git_str xdg_buf = GIT_STR_INIT;
+       git_str system_buf = GIT_STR_INIT;
+       git_str programdata_buf = GIT_STR_INIT;
+       int error;
+
+       git_config__find_global(&global_buf);
+       git_config__find_xdg(&xdg_buf);
+       git_config__find_system(&system_buf);
+       git_config__find_programdata(&programdata_buf);
+
+       error = load_config(config, NULL,
+                           path_unless_empty(&global_buf),
+                           path_unless_empty(&xdg_buf),
+                           path_unless_empty(&system_buf),
+                           path_unless_empty(&programdata_buf));
+
+       git_str_dispose(&global_buf);
+       git_str_dispose(&xdg_buf);
+       git_str_dispose(&system_buf);
+       git_str_dispose(&programdata_buf);
+
+       return error;
+}
+
 static bool are_symlinks_supported(const char *wd_path)
 {
-       git_buf path = GIT_BUF_INIT;
-       int fd;
-       struct stat st;
-       int symlinks_supported = -1;
-
-       if ((fd = git_futils_mktmp(&path, wd_path, 0666)) < 0 ||
-               p_close(fd) < 0 ||
-               p_unlink(path.ptr) < 0 ||
-               p_symlink("testing", path.ptr) < 0 ||
-               p_lstat(path.ptr, &st) < 0)
-               symlinks_supported = false;
-       else
-               symlinks_supported = (S_ISLNK(st.st_mode) != 0);
+       git_config *config = NULL;
+       int symlinks = 0;
+
+       /*
+        * To emulate Git for Windows, symlinks on Windows must be explicitly
+        * opted-in.  We examine the system configuration for a core.symlinks
+        * set to true.  If found, we then examine the filesystem to see if
+        * symlinks are _actually_ supported by the current user.  If that is
+        * _not_ set, then we do not test or enable symlink support.
+        */
+#ifdef GIT_WIN32
+       if (load_global_config(&config) < 0 ||
+           git_config_get_bool(&symlinks, config, "core.symlinks") < 0 ||
+           !symlinks)
+               goto done;
+#endif
 
-       (void)p_unlink(path.ptr);
-       git_buf_free(&path);
+       if (!(symlinks = git_fs_path_supports_symlinks(wd_path)))
+               goto done;
 
-       return symlinks_supported;
+done:
+       git_config_free(config);
+       return symlinks != 0;
 }
 
 static int create_empty_file(const char *path, mode_t mode)
@@ -1410,12 +1737,12 @@ static int create_empty_file(const char *path, mode_t mode)
        int fd;
 
        if ((fd = p_creat(path, mode)) < 0) {
-               giterr_set(GITERR_OS, "error while creating '%s'", path);
+               git_error_set(GIT_ERROR_OS, "error while creating '%s'", path);
                return -1;
        }
 
        if (p_close(fd) < 0) {
-               giterr_set(GITERR_OS, "error while closing '%s'", path);
+               git_error_set(GIT_ERROR_OS, "error while closing '%s'", path);
                return -1;
        }
 
@@ -1424,7 +1751,7 @@ static int create_empty_file(const char *path, mode_t mode)
 
 static int repo_local_config(
        git_config **out,
-       git_buf *config_dir,
+       git_str *config_dir,
        git_repository *repo,
        const char *repo_dir)
 {
@@ -1432,12 +1759,12 @@ static int repo_local_config(
        git_config *parent;
        const char *cfg_path;
 
-       if (git_buf_joinpath(config_dir, repo_dir, GIT_CONFIG_FILENAME_INREPO) < 0)
+       if (git_str_joinpath(config_dir, repo_dir, GIT_CONFIG_FILENAME_INREPO) < 0)
                return -1;
-       cfg_path = git_buf_cstr(config_dir);
+       cfg_path = git_str_cstr(config_dir);
 
        /* make LOCAL config if missing */
-       if (!git_path_isfile(cfg_path) &&
+       if (!git_fs_path_isfile(cfg_path) &&
                (error = create_empty_file(cfg_path, GIT_CONFIG_FILE_MODE)) < 0)
                return error;
 
@@ -1450,10 +1777,10 @@ static int repo_local_config(
                return error;
 
        if (git_config_open_level(out, parent, GIT_CONFIG_LEVEL_LOCAL) < 0) {
-               giterr_clear();
+               git_error_clear();
 
                if (!(error = git_config_add_file_ondisk(
-                               parent, cfg_path, GIT_CONFIG_LEVEL_LOCAL, false)))
+                               parent, cfg_path, GIT_CONFIG_LEVEL_LOCAL, repo, false)))
                        error = git_config_open_level(out, parent, GIT_CONFIG_LEVEL_LOCAL);
        }
 
@@ -1482,20 +1809,20 @@ static int repo_init_fs_configs(
                if ((error = git_config_set_bool(cfg, "core.symlinks", false)) < 0)
                        return error;
        } else if (git_config_delete_entry(cfg, "core.symlinks") < 0)
-               giterr_clear();
+               git_error_clear();
 
        if (update_ignorecase) {
                if (is_filesystem_case_insensitive(repo_dir)) {
                        if ((error = git_config_set_bool(cfg, "core.ignorecase", true)) < 0)
                                return error;
                } else if (git_config_delete_entry(cfg, "core.ignorecase") < 0)
-                       giterr_clear();
+                       git_error_clear();
        }
 
 #ifdef GIT_USE_ICONV
        if ((error = git_config_set_bool(
                        cfg, "core.precomposeunicode",
-                       git_path_does_fs_decompose_unicode(work_dir))) < 0)
+                       git_fs_path_does_decompose_unicode(work_dir))) < 0)
                return error;
        /* on non-iconv platforms, don't even set core.precomposeunicode */
 #endif
@@ -1510,15 +1837,19 @@ static int repo_init_config(
        uint32_t mode)
 {
        int error = 0;
-       git_buf cfg_path = GIT_BUF_INIT, worktree_path = GIT_BUF_INIT;
+       git_str cfg_path = GIT_STR_INIT, worktree_path = GIT_STR_INIT;
        git_config *config = NULL;
        bool is_bare = ((flags & GIT_REPOSITORY_INIT_BARE) != 0);
        bool is_reinit = ((flags & GIT_REPOSITORY_INIT__IS_REINIT) != 0);
+       int version = 0;
 
        if ((error = repo_local_config(&config, &cfg_path, NULL, repo_dir)) < 0)
                goto cleanup;
 
-       if (is_reinit && (error = check_repositoryformatversion(config)) < 0)
+       if (is_reinit && (error = check_repositoryformatversion(&version, config)) < 0)
+               goto cleanup;
+
+       if ((error = check_extensions(config, version)) < 0)
                goto cleanup;
 
 #define SET_REPO_CONFIG(TYPE, NAME, VAL) do { \
@@ -1536,17 +1867,17 @@ static int repo_init_config(
                SET_REPO_CONFIG(bool, "core.logallrefupdates", true);
 
                if (!(flags & GIT_REPOSITORY_INIT__NATURAL_WD)) {
-                       if ((error = git_buf_sets(&worktree_path, work_dir)) < 0)
+                       if ((error = git_str_sets(&worktree_path, work_dir)) < 0)
                                goto cleanup;
 
                        if ((flags & GIT_REPOSITORY_INIT_RELATIVE_GITLINK))
-                               if ((error = git_path_make_relative(&worktree_path, repo_dir)) < 0)
+                               if ((error = git_fs_path_make_relative(&worktree_path, repo_dir)) < 0)
                                        goto cleanup;
 
                        SET_REPO_CONFIG(string, "core.worktree", worktree_path.ptr);
                } else if (is_reinit) {
                        if (git_config_delete_entry(config, "core.worktree") < 0)
-                               giterr_clear();
+                               git_error_clear();
                }
        }
 
@@ -1560,8 +1891,8 @@ static int repo_init_config(
        }
 
 cleanup:
-       git_buf_free(&cfg_path);
-       git_buf_free(&worktree_path);
+       git_str_dispose(&cfg_path);
+       git_str_dispose(&worktree_path);
        git_config_free(config);
 
        return error;
@@ -1574,7 +1905,7 @@ static int repo_reinit_submodule_fs(git_submodule *sm, const char *n, void *p)
 
        if (git_submodule_open(&smrepo, sm) < 0 ||
                git_repository_reinit_filesystem(smrepo, true) < 0)
-               giterr_clear();
+               git_error_clear();
        git_repository_free(smrepo);
 
        return 0;
@@ -1583,7 +1914,7 @@ static int repo_reinit_submodule_fs(git_submodule *sm, const char *n, void *p)
 int git_repository_reinit_filesystem(git_repository *repo, int recurse)
 {
        int error = 0;
-       git_buf path = GIT_BUF_INIT;
+       git_str path = GIT_STR_INIT;
        git_config *config = NULL;
        const char *repo_dir = git_repository_path(repo);
 
@@ -1592,9 +1923,9 @@ int git_repository_reinit_filesystem(git_repository *repo, int recurse)
                        config, path.ptr, repo_dir, git_repository_workdir(repo), true);
 
        git_config_free(config);
-       git_buf_free(&path);
+       git_str_dispose(&path);
 
-       git_repository__cvar_cache_clear(repo);
+       git_repository__configmap_lookup_cache_clear(repo);
 
        if (!repo->is_bare && recurse)
                (void)git_submodule_foreach(repo, repo_reinit_submodule_fs, NULL);
@@ -1610,10 +1941,10 @@ static int repo_write_template(
        bool hidden,
        const char *content)
 {
-       git_buf path = GIT_BUF_INIT;
+       git_str path = GIT_STR_INIT;
        int fd, error = 0, flags;
 
-       if (git_buf_joinpath(&path, git_dir, file) < 0)
+       if (git_str_joinpath(&path, git_dir, file) < 0)
                return -1;
 
        if (allow_overwrite)
@@ -1621,7 +1952,7 @@ static int repo_write_template(
        else
                flags = O_WRONLY | O_CREAT | O_EXCL;
 
-       fd = p_open(git_buf_cstr(&path), flags, mode);
+       fd = p_open(git_str_cstr(&path), flags, mode);
 
        if (fd >= 0) {
                error = p_write(fd, content, strlen(content));
@@ -1640,10 +1971,10 @@ static int repo_write_template(
        GIT_UNUSED(hidden);
 #endif
 
-       git_buf_free(&path);
+       git_str_dispose(&path);
 
        if (error)
-               giterr_set(GITERR_OS,
+               git_error_set(GIT_ERROR_OS,
                        "failed to initialize repository with template '%s'", file);
 
        return error;
@@ -1653,13 +1984,13 @@ static int repo_write_gitlink(
        const char *in_dir, const char *to_repo, bool use_relative_path)
 {
        int error;
-       git_buf buf = GIT_BUF_INIT;
-       git_buf path_to_repo = GIT_BUF_INIT;
+       git_str buf = GIT_STR_INIT;
+       git_str path_to_repo = GIT_STR_INIT;
        struct stat st;
 
-       git_path_dirname_r(&buf, to_repo);
-       git_path_to_dir(&buf);
-       if (git_buf_oom(&buf))
+       git_fs_path_dirname_r(&buf, to_repo);
+       git_fs_path_to_dir(&buf);
+       if (git_str_oom(&buf))
                return -1;
 
        /* don't write gitlink to natural workdir */
@@ -1670,32 +2001,32 @@ static int repo_write_gitlink(
                goto cleanup;
        }
 
-       if ((error = git_buf_joinpath(&buf, in_dir, DOT_GIT)) < 0)
+       if ((error = git_str_joinpath(&buf, in_dir, DOT_GIT)) < 0)
                goto cleanup;
 
        if (!p_stat(buf.ptr, &st) && !S_ISREG(st.st_mode)) {
-               giterr_set(GITERR_REPOSITORY,
+               git_error_set(GIT_ERROR_REPOSITORY,
                        "cannot overwrite gitlink file into path '%s'", in_dir);
                error = GIT_EEXISTS;
                goto cleanup;
        }
 
-       git_buf_clear(&buf);
+       git_str_clear(&buf);
 
-       error = git_buf_sets(&path_to_repo, to_repo);
+       error = git_str_sets(&path_to_repo, to_repo);
 
        if (!error && use_relative_path)
-               error = git_path_make_relative(&path_to_repo, in_dir);
+               error = git_fs_path_make_relative(&path_to_repo, in_dir);
 
        if (!error)
-               error = git_buf_join(&buf, ' ', GIT_FILE_CONTENT_PREFIX, path_to_repo.ptr);
+               error = git_str_join(&buf, ' ', GIT_FILE_CONTENT_PREFIX, path_to_repo.ptr);
 
        if (!error)
                error = repo_write_template(in_dir, true, DOT_GIT, 0666, true, buf.ptr);
 
 cleanup:
-       git_buf_free(&buf);
-       git_buf_free(&path_to_repo);
+       git_str_dispose(&buf);
+       git_str_dispose(&path_to_repo);
        return error;
 }
 
@@ -1728,7 +2059,7 @@ static int repo_init_structure(
 #ifdef GIT_WIN32
        if ((opts->flags & GIT_REPOSITORY_INIT__HAS_DOTGIT) != 0) {
                if (git_win32__set_hidden(repo_dir, true) < 0) {
-                       giterr_set(GITERR_OS,
+                       git_error_set(GIT_ERROR_OS,
                                "failed to mark Git repository folder as hidden");
                        return -1;
                }
@@ -1748,14 +2079,14 @@ static int repo_init_structure(
                git_config *cfg = NULL;
                const char *tdir = NULL;
                bool default_template = false;
-               git_buf template_buf = GIT_BUF_INIT;
+               git_str template_buf = GIT_STR_INIT;
 
                if (opts->template_path)
                        tdir = opts->template_path;
                else if ((error = git_config_open_default(&cfg)) >= 0) {
-                       if (!git_config_get_path(&template_buf, cfg, "init.templatedir"))
+                       if (!git_config__get_path(&template_buf, cfg, "init.templatedir"))
                                tdir = template_buf.ptr;
-                       giterr_clear();
+                       git_error_clear();
                }
 
                if (!tdir) {
@@ -1764,7 +2095,13 @@ static int repo_init_structure(
                        default_template = true;
                }
 
-               if (tdir) {
+               /*
+                * If tdir was the empty string, treat it like tdir was a path to an
+                * empty directory (so, don't do any copying). This is the behavior
+                * that git(1) exhibits, although it doesn't seem to be officially
+                * documented.
+                */
+               if (tdir && git__strcmp(tdir, "") != 0) {
                        uint32_t cpflags = GIT_CPDIR_COPY_SYMLINKS |
                                GIT_CPDIR_SIMPLE_TO_MODE |
                                GIT_CPDIR_COPY_DOTFILES;
@@ -1773,15 +2110,20 @@ static int repo_init_structure(
                        error = git_futils_cp_r(tdir, repo_dir, cpflags, dmode);
                }
 
-               git_buf_free(&template_buf);
+               git_str_dispose(&template_buf);
                git_config_free(cfg);
 
+               /* If tdir does not exist, then do not error out. This matches the
+                * behaviour of git(1), which just prints a warning and continues.
+                * TODO: issue warning when warning API is available.
+                * `git` prints to stderr: 'warning: templates not found in /path/to/tdir'
+                */
                if (error < 0) {
-                       if (!default_template)
+                       if (!default_template && error != GIT_ENOTFOUND)
                                return error;
 
                        /* if template was default, ignore error and use internal */
-                       giterr_clear();
+                       git_error_clear();
                        external_tpl = false;
                        error = 0;
                }
@@ -1814,7 +2156,7 @@ static int repo_init_structure(
        return error;
 }
 
-static int mkdir_parent(git_buf *buf, uint32_t mode, bool skip2)
+static int mkdir_parent(git_str *buf, uint32_t mode, bool skip2)
 {
        /* When making parent directories during repository initialization
         * don't try to set gid or grant world write access
@@ -1826,8 +2168,8 @@ static int mkdir_parent(git_buf *buf, uint32_t mode, bool skip2)
 }
 
 static int repo_init_directories(
-       git_buf *repo_path,
-       git_buf *wd_path,
+       git_str *repo_path,
+       git_str *wd_path,
        const char *given_repo,
        git_repository_init_options *opts)
 {
@@ -1865,7 +2207,7 @@ static int repo_init_directories(
                git__suffixcmp(given_repo, "/" DOT_GIT) != 0 &&
                git__suffixcmp(given_repo, "/" GIT_DIR) != 0;
 
-       if (git_buf_joinpath(repo_path, given_repo, add_dotgit ? GIT_DIR : "") < 0)
+       if (git_str_joinpath(repo_path, given_repo, add_dotgit ? GIT_DIR : "") < 0)
                return -1;
 
        has_dotgit = (git__suffixcmp(repo_path->ptr, "/" GIT_DIR) == 0);
@@ -1876,22 +2218,22 @@ static int repo_init_directories(
 
        if (!is_bare) {
                if (opts->workdir_path) {
-                       if (git_path_join_unrooted(
+                       if (git_fs_path_join_unrooted(
                                        wd_path, opts->workdir_path, repo_path->ptr, NULL) < 0)
                                return -1;
                } else if (has_dotgit) {
-                       if (git_path_dirname_r(wd_path, repo_path->ptr) < 0)
+                       if (git_fs_path_dirname_r(wd_path, repo_path->ptr) < 0)
                                return -1;
                } else {
-                       giterr_set(GITERR_REPOSITORY, "cannot pick working directory"
+                       git_error_set(GIT_ERROR_REPOSITORY, "cannot pick working directory"
                                " for non-bare repository that isn't a '.git' directory");
                        return -1;
                }
 
-               if (git_path_to_dir(wd_path) < 0)
+               if (git_fs_path_to_dir(wd_path) < 0)
                        return -1;
        } else {
-               git_buf_clear(wd_path);
+               git_str_clear(wd_path);
        }
 
        natural_wd =
@@ -1948,12 +2290,50 @@ static int repo_init_directories(
        /* prettify both directories now that they are created */
 
        if (!error) {
-               error = git_path_prettify_dir(repo_path, repo_path->ptr, NULL);
+               error = git_fs_path_prettify_dir(repo_path, repo_path->ptr, NULL);
 
                if (!error && wd_path->size > 0)
-                       error = git_path_prettify_dir(wd_path, wd_path->ptr, NULL);
+                       error = git_fs_path_prettify_dir(wd_path, wd_path->ptr, NULL);
+       }
+
+       return error;
+}
+
+static int repo_init_head(const char *repo_dir, const char *given)
+{
+       git_config *cfg = NULL;
+       git_str head_path = GIT_STR_INIT, cfg_branch = GIT_STR_INIT;
+       const char *initial_head = NULL;
+       int error;
+
+       if ((error = git_str_joinpath(&head_path, repo_dir, GIT_HEAD_FILE)) < 0)
+               goto out;
+
+       /*
+        * A template may have set a HEAD; use that unless it's been
+        * overridden by the caller's given initial head setting.
+        */
+       if (git_fs_path_exists(head_path.ptr) && !given)
+               goto out;
+
+       if (given) {
+               initial_head = given;
+       } else if ((error = git_config_open_default(&cfg)) >= 0 &&
+                  (error = git_config__get_string_buf(&cfg_branch, cfg, "init.defaultbranch")) >= 0 &&
+                  *cfg_branch.ptr) {
+               initial_head = cfg_branch.ptr;
        }
 
+       if (!initial_head)
+               initial_head = GIT_BRANCH_DEFAULT;
+
+       error = git_repository_create_head(repo_dir, initial_head);
+
+out:
+       git_config_free(cfg);
+       git_str_dispose(&head_path);
+       git_str_dispose(&cfg_branch);
+
        return error;
 }
 
@@ -1986,56 +2366,58 @@ int git_repository_init_ext(
        const char *given_repo,
        git_repository_init_options *opts)
 {
-       int error;
-       git_buf repo_path = GIT_BUF_INIT, wd_path = GIT_BUF_INIT,
-               common_path = GIT_BUF_INIT;
+       git_str repo_path = GIT_STR_INIT, wd_path = GIT_STR_INIT,
+               common_path = GIT_STR_INIT;
        const char *wd;
+       bool is_valid;
+       int error;
 
-       assert(out && given_repo && opts);
+       GIT_ASSERT_ARG(out);
+       GIT_ASSERT_ARG(given_repo);
+       GIT_ASSERT_ARG(opts);
 
-       GITERR_CHECK_VERSION(opts, GIT_REPOSITORY_INIT_OPTIONS_VERSION, "git_repository_init_options");
+       GIT_ERROR_CHECK_VERSION(opts, GIT_REPOSITORY_INIT_OPTIONS_VERSION, "git_repository_init_options");
 
-       error = repo_init_directories(&repo_path, &wd_path, given_repo, opts);
-       if (error < 0)
-               goto cleanup;
+       if ((error = repo_init_directories(&repo_path, &wd_path, given_repo, opts)) < 0)
+               goto out;
+
+       wd = (opts->flags & GIT_REPOSITORY_INIT_BARE) ? NULL : git_str_cstr(&wd_path);
 
-       wd = (opts->flags & GIT_REPOSITORY_INIT_BARE) ? NULL : git_buf_cstr(&wd_path);
-       if (valid_repository_path(&repo_path, &common_path)) {
+       if ((error = is_valid_repository_path(&is_valid, &repo_path, &common_path)) < 0)
+               goto out;
 
+       if (is_valid) {
                if ((opts->flags & GIT_REPOSITORY_INIT_NO_REINIT) != 0) {
-                       giterr_set(GITERR_REPOSITORY,
+                       git_error_set(GIT_ERROR_REPOSITORY,
                                "attempt to reinitialize '%s'", given_repo);
                        error = GIT_EEXISTS;
-                       goto cleanup;
+                       goto out;
                }
 
                opts->flags |= GIT_REPOSITORY_INIT__IS_REINIT;
 
-               error = repo_init_config(
-                       repo_path.ptr, wd, opts->flags, opts->mode);
+               if ((error = repo_init_config(repo_path.ptr, wd, opts->flags, opts->mode)) < 0)
+                       goto out;
 
                /* TODO: reinitialize the templates */
+       } else {
+               if ((error = repo_init_structure(repo_path.ptr, wd, opts)) < 0 ||
+                   (error = repo_init_config(repo_path.ptr, wd, opts->flags, opts->mode)) < 0 ||
+                   (error = repo_init_head(repo_path.ptr, opts->initial_head)) < 0)
+                       goto out;
        }
-       else {
-               if (!(error = repo_init_structure(
-                               repo_path.ptr, wd, opts)) &&
-                       !(error = repo_init_config(
-                               repo_path.ptr, wd, opts->flags, opts->mode)))
-                       error = git_repository_create_head(
-                               repo_path.ptr, opts->initial_head);
-       }
-       if (error < 0)
-               goto cleanup;
 
-       error = git_repository_open(out, repo_path.ptr);
+       if ((error = git_repository_open(out, repo_path.ptr)) < 0)
+               goto out;
 
-       if (!error && opts->origin_url)
-               error = repo_init_create_origin(*out, opts->origin_url);
+       if (opts->origin_url &&
+           (error = repo_init_create_origin(*out, opts->origin_url)) < 0)
+               goto out;
 
-cleanup:
-       git_buf_free(&common_path);
-       git_buf_free(&repo_path);
-       git_buf_free(&wd_path);
+out:
+       git_str_dispose(&common_path);
+       git_str_dispose(&repo_path);
+       git_str_dispose(&wd_path);
 
        return error;
 }
@@ -2052,7 +2434,7 @@ int git_repository_head_detached(git_repository *repo)
        if (git_reference_lookup(&ref, repo, GIT_HEAD_FILE) < 0)
                return -1;
 
-       if (git_reference_type(ref) == GIT_REF_SYMBOLIC) {
+       if (git_reference_type(ref) == GIT_REFERENCE_SYMBOLIC) {
                git_reference_free(ref);
                return 0;
        }
@@ -2063,23 +2445,18 @@ int git_repository_head_detached(git_repository *repo)
        return exists;
 }
 
-static int get_worktree_file_path(git_buf *out, git_repository *repo, const char *worktree, const char *file)
-{
-       git_buf_clear(out);
-       return git_buf_printf(out, "%s/worktrees/%s/%s", repo->commondir, worktree, file);
-}
-
 int git_repository_head_detached_for_worktree(git_repository *repo, const char *name)
 {
        git_reference *ref = NULL;
        int error;
 
-       assert(repo && name);
+       GIT_ASSERT_ARG(repo);
+       GIT_ASSERT_ARG(name);
 
        if ((error = git_repository_head_for_worktree(&ref, repo, name)) < 0)
                goto out;
 
-       error = (git_reference_type(ref) != GIT_REF_SYMBOLIC);
+       error = (git_reference_type(ref) != GIT_REFERENCE_SYMBOLIC);
 out:
        git_reference_free(ref);
 
@@ -2091,10 +2468,12 @@ int git_repository_head(git_reference **head_out, git_repository *repo)
        git_reference *head;
        int error;
 
+       GIT_ASSERT_ARG(head_out);
+
        if ((error = git_reference_lookup(&head, repo, GIT_HEAD_FILE)) < 0)
                return error;
 
-       if (git_reference_type(head) == GIT_REF_OID) {
+       if (git_reference_type(head) == GIT_REFERENCE_DIRECT) {
                *head_out = head;
                return 0;
        }
@@ -2107,66 +2486,85 @@ int git_repository_head(git_reference **head_out, git_repository *repo)
 
 int git_repository_head_for_worktree(git_reference **out, git_repository *repo, const char *name)
 {
-       git_buf path = GIT_BUF_INIT;
+       git_repository *worktree_repo = NULL;
+       git_worktree *worktree = NULL;
        git_reference *head = NULL;
        int error;
 
-       assert(out && repo && name);
+       GIT_ASSERT_ARG(out);
+       GIT_ASSERT_ARG(repo);
+       GIT_ASSERT_ARG(name);
 
        *out = NULL;
 
-       if ((error = get_worktree_file_path(&path, repo, name, GIT_HEAD_FILE)) < 0 ||
-           (error = git_reference__read_head(&head, repo, path.ptr)) < 0)
+       if ((error = git_worktree_lookup(&worktree, repo, name)) < 0 ||
+           (error = git_repository_open_from_worktree(&worktree_repo, worktree)) < 0 ||
+           (error = git_reference_lookup(&head, worktree_repo, GIT_HEAD_FILE)) < 0)
                goto out;
 
-       if (git_reference_type(head) != GIT_REF_OID) {
-               git_reference *resolved;
-
-               error = git_reference_lookup_resolved(&resolved, repo, git_reference_symbolic_target(head), -1);
-               git_reference_free(head);
-               head = resolved;
+       if (git_reference_type(head) != GIT_REFERENCE_DIRECT) {
+               if ((error = git_reference_lookup_resolved(out, worktree_repo, git_reference_symbolic_target(head), -1)) < 0)
+                       goto out;
+       } else {
+               *out = head;
+               head = NULL;
        }
 
-       *out = head;
-
 out:
-       if (error)
-               git_reference_free(head);
-
-       git_buf_free(&path);
-
+       git_reference_free(head);
+       git_worktree_free(worktree);
+       git_repository_free(worktree_repo);
        return error;
 }
 
-int git_repository_foreach_head(git_repository *repo, git_repository_foreach_head_cb cb, void *payload)
+int git_repository_foreach_worktree(git_repository *repo,
+                                   git_repository_foreach_worktree_cb cb,
+                                   void *payload)
 {
-       git_strarray worktrees = GIT_VECTOR_INIT;
-       git_buf path = GIT_BUF_INIT;
+       git_strarray worktrees = {0};
+       git_repository *worktree_repo = NULL;
+       git_worktree *worktree = NULL;
        int error;
        size_t i;
 
-       /* Execute callback for HEAD of commondir */
-       if ((error = git_buf_joinpath(&path, repo->commondir, GIT_HEAD_FILE)) < 0 ||
-           (error = cb(repo, path.ptr, payload) != 0))
+       /* apply operation to repository supplied when commondir is empty, implying there's
+        * no linked worktrees to iterate, which can occur when using custom odb/refdb
+        */
+       if (!repo->commondir)
+               return cb(repo, payload);
+
+       if ((error = git_repository_open(&worktree_repo, repo->commondir)) < 0 ||
+           (error = cb(worktree_repo, payload) != 0))
                goto out;
 
-       if ((error = git_worktree_list(&worktrees, repo)) < 0) {
-               error = 0;
+       git_repository_free(worktree_repo);
+       worktree_repo = NULL;
+
+       if ((error = git_worktree_list(&worktrees, repo)) < 0)
                goto out;
-       }
 
-       /* Execute callback for all worktree HEADs */
        for (i = 0; i < worktrees.count; i++) {
-               if (get_worktree_file_path(&path, repo, worktrees.strings[i], GIT_HEAD_FILE) < 0)
+               git_repository_free(worktree_repo);
+               worktree_repo = NULL;
+               git_worktree_free(worktree);
+               worktree = NULL;
+
+               if ((error = git_worktree_lookup(&worktree, repo, worktrees.strings[i]) < 0) ||
+                   (error = git_repository_open_from_worktree(&worktree_repo, worktree)) < 0) {
+                       if (error != GIT_ENOTFOUND)
+                               goto out;
+                       error = 0;
                        continue;
+               }
 
-               if ((error = cb(repo, path.ptr, payload)) != 0)
+               if ((error = cb(worktree_repo, payload)) != 0)
                        goto out;
        }
 
 out:
-       git_buf_free(&path);
-       git_strarray_free(&worktrees);
+       git_strarray_dispose(&worktrees);
+       git_repository_free(worktree_repo);
+       git_worktree_free(worktree);
        return error;
 }
 
@@ -2179,7 +2577,7 @@ int git_repository_head_unborn(git_repository *repo)
        git_reference_free(ref);
 
        if (error == GIT_EUNBORNBRANCH) {
-               giterr_clear();
+               git_error_clear();
                return 1;
        }
 
@@ -2189,50 +2587,86 @@ int git_repository_head_unborn(git_repository *repo)
        return 0;
 }
 
-static int at_least_one_cb(const char *refname, void *payload)
+static int repo_contains_no_reference(git_repository *repo)
 {
-       GIT_UNUSED(refname);
-       GIT_UNUSED(payload);
-       return GIT_PASSTHROUGH;
+       git_reference_iterator *iter;
+       const char *refname;
+       int error;
+
+       if ((error = git_reference_iterator_new(&iter, repo)) < 0)
+               return error;
+
+       error = git_reference_next_name(&refname, iter);
+       git_reference_iterator_free(iter);
+
+       if (error == GIT_ITEROVER)
+               return 1;
+
+       return error;
 }
 
-static int repo_contains_no_reference(git_repository *repo)
+int git_repository_initialbranch(git_str *out, git_repository *repo)
 {
-       int error = git_reference_foreach_name(repo, &at_least_one_cb, NULL);
+       git_config *config;
+       git_config_entry *entry = NULL;
+       const char *branch;
+       int valid, error;
 
-       if (error == GIT_PASSTHROUGH)
-               return 0;
+       if ((error = git_repository_config__weakptr(&config, repo)) < 0)
+               return error;
 
-       if (!error)
-               return 1;
+       if ((error = git_config_get_entry(&entry, config, "init.defaultbranch")) == 0 &&
+               *entry->value) {
+               branch = entry->value;
+       }
+       else if (!error || error == GIT_ENOTFOUND) {
+               branch = GIT_BRANCH_DEFAULT;
+       }
+       else {
+               goto done;
+       }
+
+       if ((error = git_str_puts(out, GIT_REFS_HEADS_DIR)) < 0 ||
+           (error = git_str_puts(out, branch)) < 0 ||
+           (error = git_reference_name_is_valid(&valid, out->ptr)) < 0)
+           goto done;
+
+       if (!valid) {
+               git_error_set(GIT_ERROR_INVALID, "the value of init.defaultBranch is not a valid branch name");
+               error = -1;
+       }
 
+done:
+       git_config_entry_free(entry);
        return error;
 }
 
 int git_repository_is_empty(git_repository *repo)
 {
        git_reference *head = NULL;
-       int is_empty = 0;
+       git_str initialbranch = GIT_STR_INIT;
+       int result = 0;
 
-       if (git_reference_lookup(&head, repo, GIT_HEAD_FILE) < 0)
-               return -1;
+       if ((result = git_reference_lookup(&head, repo, GIT_HEAD_FILE)) < 0 ||
+           (result = git_repository_initialbranch(&initialbranch, repo)) < 0)
+               goto done;
 
-       if (git_reference_type(head) == GIT_REF_SYMBOLIC)
-               is_empty =
-                       (strcmp(git_reference_symbolic_target(head),
-                                       GIT_REFS_HEADS_DIR "master") == 0) &&
-                       repo_contains_no_reference(repo);
+       result = (git_reference_type(head) == GIT_REFERENCE_SYMBOLIC &&
+                 strcmp(git_reference_symbolic_target(head), initialbranch.ptr) == 0 &&
+                 repo_contains_no_reference(repo));
 
+done:
        git_reference_free(head);
+       git_str_dispose(&initialbranch);
 
-       return is_empty;
+       return result;
 }
 
-int git_repository_item_path(git_buf *out, git_repository *repo, git_repository_item_t item)
+static const char *resolved_parent_path(const git_repository *repo, git_repository_item_t item, git_repository_item_t fallback)
 {
        const char *parent;
 
-       switch (items[item].parent) {
+       switch (item) {
                case GIT_REPOSITORY_ITEM_GITDIR:
                        parent = git_repository_path(repo);
                        break;
@@ -2243,40 +2677,59 @@ int git_repository_item_path(git_buf *out, git_repository *repo, git_repository_
                        parent = git_repository_commondir(repo);
                        break;
                default:
-                       giterr_set(GITERR_INVALID, "Invalid item directory");
-                       return -1;
+                       git_error_set(GIT_ERROR_INVALID, "invalid item directory");
+                       return NULL;
        }
+       if (!parent && fallback != GIT_REPOSITORY_ITEM__LAST)
+               return resolved_parent_path(repo, fallback, GIT_REPOSITORY_ITEM__LAST);
+
+       return parent;
+}
 
+int git_repository_item_path(
+       git_buf *out,
+       const git_repository *repo,
+       git_repository_item_t item)
+{
+       GIT_BUF_WRAP_PRIVATE(out, git_repository__item_path, repo, item);
+}
+
+int git_repository__item_path(
+       git_str *out,
+       const git_repository *repo,
+       git_repository_item_t item)
+{
+       const char *parent = resolved_parent_path(repo, items[item].parent, items[item].fallback);
        if (parent == NULL) {
-               giterr_set(GITERR_INVALID, "Path cannot exist in repository");
-               return -1;
+               git_error_set(GIT_ERROR_INVALID, "path cannot exist in repository");
+               return GIT_ENOTFOUND;
        }
 
-       if (git_buf_sets(out, parent) < 0)
+       if (git_str_sets(out, parent) < 0)
                return -1;
 
        if (items[item].name) {
-               if (git_buf_joinpath(out, parent, items[item].name) < 0)
+               if (git_str_joinpath(out, parent, items[item].name) < 0)
                        return -1;
        }
 
        if (items[item].directory) {
-               if (git_path_to_dir(out) < 0)
+               if (git_fs_path_to_dir(out) < 0)
                        return -1;
        }
 
        return 0;
 }
 
-const char *git_repository_path(git_repository *repo)
+const char *git_repository_path(const git_repository *repo)
 {
-       assert(repo);
+       GIT_ASSERT_ARG_WITH_RETVAL(repo, NULL);
        return repo->gitdir;
 }
 
-const char *git_repository_workdir(git_repository *repo)
+const char *git_repository_workdir(const git_repository *repo)
 {
-       assert(repo);
+       GIT_ASSERT_ARG_WITH_RETVAL(repo, NULL);
 
        if (repo->is_bare)
                return NULL;
@@ -2284,9 +2737,25 @@ const char *git_repository_workdir(git_repository *repo)
        return repo->workdir;
 }
 
-const char *git_repository_commondir(git_repository *repo)
+int git_repository_workdir_path(
+       git_str *out, git_repository *repo, const char *path)
+{
+       int error;
+
+       if (!repo->workdir) {
+               git_error_set(GIT_ERROR_REPOSITORY, "repository has no working directory");
+               return GIT_EBAREREPO;
+       }
+
+       if (!(error = git_str_joinpath(out, repo->workdir, path)))
+               error = git_path_validate_str_length(repo, out);
+
+       return error;
+}
+
+const char *git_repository_commondir(const git_repository *repo)
 {
-       assert(repo);
+       GIT_ASSERT_ARG_WITH_RETVAL(repo, NULL);
        return repo->commondir;
 }
 
@@ -2294,11 +2763,12 @@ int git_repository_set_workdir(
        git_repository *repo, const char *workdir, int update_gitlink)
 {
        int error = 0;
-       git_buf path = GIT_BUF_INIT;
+       git_str path = GIT_STR_INIT;
 
-       assert(repo && workdir);
+       GIT_ASSERT_ARG(repo);
+       GIT_ASSERT_ARG(workdir);
 
-       if (git_path_prettify_dir(&path, workdir, NULL) < 0)
+       if (git_fs_path_prettify_dir(&path, workdir, NULL) < 0)
                return -1;
 
        if (repo->workdir && strcmp(repo->workdir, path.ptr) == 0)
@@ -2325,7 +2795,7 @@ int git_repository_set_workdir(
        if (!error) {
                char *old_workdir = repo->workdir;
 
-               repo->workdir = git_buf_detach(&path);
+               repo->workdir = git_str_detach(&path);
                repo->is_bare = 0;
 
                git__free(old_workdir);
@@ -2334,15 +2804,15 @@ int git_repository_set_workdir(
        return error;
 }
 
-int git_repository_is_bare(git_repository *repo)
+int git_repository_is_bare(const git_repository *repo)
 {
-       assert(repo);
+       GIT_ASSERT_ARG(repo);
        return repo->is_bare;
 }
 
-int git_repository_is_worktree(git_repository *repo)
+int git_repository_is_worktree(const git_repository *repo)
 {
-       assert(repo);
+       GIT_ASSERT_ARG(repo);
        return repo->is_worktree;
 }
 
@@ -2351,7 +2821,7 @@ int git_repository_set_bare(git_repository *repo)
        int error;
        git_config *config;
 
-       assert(repo);
+       GIT_ASSERT_ARG(repo);
 
        if (repo->is_bare)
                return 0;
@@ -2381,7 +2851,7 @@ int git_repository_head_tree(git_tree **tree, git_repository *repo)
        if ((error = git_repository_head(&head, repo)) < 0)
                return error;
 
-       if ((error = git_reference_peel(&obj, head, GIT_OBJ_TREE)) < 0)
+       if ((error = git_reference_peel(&obj, head, GIT_OBJECT_TREE)) < 0)
                goto cleanup;
 
        *tree = (git_tree *)obj;
@@ -2394,59 +2864,62 @@ cleanup:
 int git_repository__set_orig_head(git_repository *repo, const git_oid *orig_head)
 {
        git_filebuf file = GIT_FILEBUF_INIT;
-       git_buf file_path = GIT_BUF_INIT;
+       git_str file_path = GIT_STR_INIT;
        char orig_head_str[GIT_OID_HEXSZ];
        int error = 0;
 
        git_oid_fmt(orig_head_str, orig_head);
 
-       if ((error = git_buf_joinpath(&file_path, repo->gitdir, GIT_ORIG_HEAD_FILE)) == 0 &&
-               (error = git_filebuf_open(&file, file_path.ptr, GIT_FILEBUF_FORCE, GIT_MERGE_FILE_MODE)) == 0 &&
+       if ((error = git_str_joinpath(&file_path, repo->gitdir, GIT_ORIG_HEAD_FILE)) == 0 &&
+               (error = git_filebuf_open(&file, file_path.ptr, GIT_FILEBUF_CREATE_LEADING_DIRS, GIT_MERGE_FILE_MODE)) == 0 &&
                (error = git_filebuf_printf(&file, "%.*s\n", GIT_OID_HEXSZ, orig_head_str)) == 0)
                error = git_filebuf_commit(&file);
 
        if (error < 0)
                git_filebuf_cleanup(&file);
 
-       git_buf_free(&file_path);
+       git_str_dispose(&file_path);
 
        return error;
 }
 
-int git_repository_message(git_buf *out, git_repository *repo)
+static int git_repository__message(git_str *out, git_repository *repo)
 {
-       git_buf path = GIT_BUF_INIT;
+       git_str path = GIT_STR_INIT;
        struct stat st;
        int error;
 
-       git_buf_sanitize(out);
-
-       if (git_buf_joinpath(&path, repo->gitdir, GIT_MERGE_MSG_FILE) < 0)
+       if (git_str_joinpath(&path, repo->gitdir, GIT_MERGE_MSG_FILE) < 0)
                return -1;
 
-       if ((error = p_stat(git_buf_cstr(&path), &st)) < 0) {
+       if ((error = p_stat(git_str_cstr(&path), &st)) < 0) {
                if (errno == ENOENT)
                        error = GIT_ENOTFOUND;
-               giterr_set(GITERR_OS, "could not access message file");
+               git_error_set(GIT_ERROR_OS, "could not access message file");
        } else {
-               error = git_futils_readbuffer(out, git_buf_cstr(&path));
+               error = git_futils_readbuffer(out, git_str_cstr(&path));
        }
 
-       git_buf_free(&path);
+       git_str_dispose(&path);
 
        return error;
 }
 
+int git_repository_message(git_buf *out, git_repository *repo)
+{
+       GIT_BUF_WRAP_PRIVATE(out, git_repository__message, repo);
+}
+
 int git_repository_message_remove(git_repository *repo)
 {
-       git_buf path = GIT_BUF_INIT;
+       git_str path = GIT_STR_INIT;
        int error;
 
-       if (git_buf_joinpath(&path, repo->gitdir, GIT_MERGE_MSG_FILE) < 0)
+       if (git_str_joinpath(&path, repo->gitdir, GIT_MERGE_MSG_FILE) < 0)
                return -1;
 
-       error = p_unlink(git_buf_cstr(&path));
-       git_buf_free(&path);
+       error = p_unlink(git_str_cstr(&path));
+       git_str_dispose(&path);
 
        return error;
 }
@@ -2455,39 +2928,44 @@ int git_repository_hashfile(
        git_oid *out,
        git_repository *repo,
        const char *path,
-       git_otype type,
+       git_object_t type,
        const char *as_path)
 {
        int error;
        git_filter_list *fl = NULL;
        git_file fd = -1;
-       git_off_t len;
-       git_buf full_path = GIT_BUF_INIT;
-
-       assert(out && path && repo); /* as_path can be NULL */
+       uint64_t len;
+       git_str full_path = GIT_STR_INIT;
+       const char *workdir = git_repository_workdir(repo);
 
-       /* At some point, it would be nice if repo could be NULL to just
-        * apply filter rules defined in system and global files, but for
-        * now that is not possible because git_filters_load() needs it.
-        */
+        /* as_path can be NULL */
+       GIT_ASSERT_ARG(out);
+       GIT_ASSERT_ARG(path);
+       GIT_ASSERT_ARG(repo);
 
-       error = git_path_join_unrooted(
-               &full_path, path, git_repository_workdir(repo), NULL);
-       if (error < 0)
+       if ((error = git_fs_path_join_unrooted(&full_path, path, workdir, NULL)) < 0 ||
+           (error = git_path_validate_str_length(repo, &full_path)) < 0)
                return error;
 
-       if (!as_path)
-               as_path = path;
+       /*
+        * NULL as_path means that we should derive it from the
+        * given path.
+        */
+       if (!as_path) {
+               if (workdir && !git__prefixcmp(full_path.ptr, workdir))
+                       as_path = full_path.ptr + strlen(workdir);
+               else
+                       as_path = "";
+       }
 
        /* passing empty string for "as_path" indicated --no-filters */
        if (strlen(as_path) > 0) {
                error = git_filter_list_load(
                        &fl, repo, NULL, as_path,
                        GIT_FILTER_TO_ODB, GIT_FILTER_DEFAULT);
+
                if (error < 0)
                        return error;
-       } else {
-               error = 0;
        }
 
        /* at this point, error is a count of the number of loaded filters */
@@ -2498,14 +2976,11 @@ int git_repository_hashfile(
                goto cleanup;
        }
 
-       len = git_futils_filesize(fd);
-       if (len < 0) {
-               error = (int)len;
+       if ((error = git_futils_filesize(&len, fd)) < 0)
                goto cleanup;
-       }
 
        if (!git__is_sizet(len)) {
-               giterr_set(GITERR_OS, "file size overflow for 32-bit systems");
+               git_error_set(GIT_ERROR_OS, "file size overflow for 32-bit systems");
                error = -1;
                goto cleanup;
        }
@@ -2516,30 +2991,30 @@ cleanup:
        if (fd >= 0)
                p_close(fd);
        git_filter_list_free(fl);
-       git_buf_free(&full_path);
+       git_str_dispose(&full_path);
 
        return error;
 }
 
-static int checkout_message(git_buf *out, git_reference *old, const char *new)
+static int checkout_message(git_str *out, git_reference *old, const char *new)
 {
-       git_buf_puts(out, "checkout: moving from ");
+       git_str_puts(out, "checkout: moving from ");
 
-       if (git_reference_type(old) == GIT_REF_SYMBOLIC)
-               git_buf_puts(out, git_reference__shorthand(git_reference_symbolic_target(old)));
+       if (git_reference_type(old) == GIT_REFERENCE_SYMBOLIC)
+               git_str_puts(out, git_reference__shorthand(git_reference_symbolic_target(old)));
        else
-               git_buf_puts(out, git_oid_tostr_s(git_reference_target(old)));
+               git_str_puts(out, git_oid_tostr_s(git_reference_target(old)));
 
-       git_buf_puts(out, " to ");
+       git_str_puts(out, " to ");
 
        if (git_reference__is_branch(new) ||
                git_reference__is_tag(new) ||
                git_reference__is_remote(new))
-               git_buf_puts(out, git_reference__shorthand(new));
+               git_str_puts(out, git_reference__shorthand(new));
        else
-               git_buf_puts(out, new);
+               git_str_puts(out, new);
 
-       if (git_buf_oom(out))
+       if (git_str_oom(out))
                return -1;
 
        return 0;
@@ -2548,19 +3023,20 @@ static int checkout_message(git_buf *out, git_reference *old, const char *new)
 static int detach(git_repository *repo, const git_oid *id, const char *new)
 {
        int error;
-       git_buf log_message = GIT_BUF_INIT;
+       git_str log_message = GIT_STR_INIT;
        git_object *object = NULL, *peeled = NULL;
        git_reference *new_head = NULL, *current = NULL;
 
-       assert(repo && id);
+       GIT_ASSERT_ARG(repo);
+       GIT_ASSERT_ARG(id);
 
        if ((error = git_reference_lookup(&current, repo, GIT_HEAD_FILE)) < 0)
                return error;
 
-       if ((error = git_object_lookup(&object, repo, id, GIT_OBJ_ANY)) < 0)
+       if ((error = git_object_lookup(&object, repo, id, GIT_OBJECT_ANY)) < 0)
                goto cleanup;
 
-       if ((error = git_object_peel(&peeled, object, GIT_OBJ_COMMIT)) < 0)
+       if ((error = git_object_peel(&peeled, object, GIT_OBJECT_COMMIT)) < 0)
                goto cleanup;
 
        if (new == NULL)
@@ -2569,10 +3045,10 @@ static int detach(git_repository *repo, const git_oid *id, const char *new)
        if ((error = checkout_message(&log_message, current, new)) < 0)
                goto cleanup;
 
-       error = git_reference_create(&new_head, repo, GIT_HEAD_FILE, git_object_id(peeled), true, git_buf_cstr(&log_message));
+       error = git_reference_create(&new_head, repo, GIT_HEAD_FILE, git_object_id(peeled), true, git_str_cstr(&log_message));
 
 cleanup:
-       git_buf_free(&log_message);
+       git_str_dispose(&log_message);
        git_object_free(object);
        git_object_free(peeled);
        git_reference_free(current);
@@ -2581,14 +3057,15 @@ cleanup:
 }
 
 int git_repository_set_head(
-       git_repositoryrepo,
-       const charrefname)
+       git_repository *repo,
+       const char *refname)
 {
        git_reference *ref = NULL, *current = NULL, *new_head = NULL;
-       git_buf log_message = GIT_BUF_INIT;
+       git_str log_message = GIT_STR_INIT;
        int error;
 
-       assert(repo && refname);
+       GIT_ASSERT_ARG(repo);
+       GIT_ASSERT_ARG(refname);
 
        if ((error = git_reference_lookup(&current, repo, GIT_HEAD_FILE)) < 0)
                return error;
@@ -2600,9 +3077,9 @@ int git_repository_set_head(
        if (error < 0 && error != GIT_ENOTFOUND)
                goto cleanup;
 
-       if (ref && current->type == GIT_REF_SYMBOLIC && git__strcmp(current->target.symbolic, ref->name) &&
+       if (ref && current->type == GIT_REFERENCE_SYMBOLIC && git__strcmp(current->target.symbolic, ref->name) &&
            git_reference_is_branch(ref) && git_branch_is_checked_out(ref)) {
-               giterr_set(GITERR_REPOSITORY, "cannot set HEAD to reference '%s' as it is the current HEAD "
+               git_error_set(GIT_ERROR_REPOSITORY, "cannot set HEAD to reference '%s' as it is the current HEAD "
                        "of a linked repository.", git_reference_name(ref));
                error = -1;
                goto cleanup;
@@ -2611,18 +3088,18 @@ int git_repository_set_head(
        if (!error) {
                if (git_reference_is_branch(ref)) {
                        error = git_reference_symbolic_create(&new_head, repo, GIT_HEAD_FILE,
-                                       git_reference_name(ref), true, git_buf_cstr(&log_message));
+                                       git_reference_name(ref), true, git_str_cstr(&log_message));
                } else {
                        error = detach(repo, git_reference_target(ref),
                                git_reference_is_tag(ref) || git_reference_is_remote(ref) ? refname : NULL);
                }
        } else if (git_reference__is_branch(refname)) {
                error = git_reference_symbolic_create(&new_head, repo, GIT_HEAD_FILE, refname,
-                               true, git_buf_cstr(&log_message));
+                               true, git_str_cstr(&log_message));
        }
 
 cleanup:
-       git_buf_free(&log_message);
+       git_str_dispose(&log_message);
        git_reference_free(current);
        git_reference_free(ref);
        git_reference_free(new_head);
@@ -2630,29 +3107,30 @@ cleanup:
 }
 
 int git_repository_set_head_detached(
-       git_repositoryrepo,
-       const git_oid* commitish)
+       git_repository *repo,
+       const git_oid *committish)
 {
-       return detach(repo, commitish, NULL);
+       return detach(repo, committish, NULL);
 }
 
 int git_repository_set_head_detached_from_annotated(
        git_repository *repo,
-       const git_annotated_commit *commitish)
+       const git_annotated_commit *committish)
 {
-       assert(repo && commitish);
+       GIT_ASSERT_ARG(repo);
+       GIT_ASSERT_ARG(committish);
 
-       return detach(repo, git_annotated_commit_id(commitish), commitish->description);
+       return detach(repo, git_annotated_commit_id(committish), committish->description);
 }
 
-int git_repository_detach_head(git_repositoryrepo)
+int git_repository_detach_head(git_repository *repo)
 {
        git_reference *old_head = NULL, *new_head = NULL, *current = NULL;
        git_object *object = NULL;
-       git_buf log_message = GIT_BUF_INIT;
+       git_str log_message = GIT_STR_INIT;
        int error;
 
-       assert(repo);
+       GIT_ASSERT_ARG(repo);
 
        if ((error = git_reference_lookup(&current, repo, GIT_HEAD_FILE)) < 0)
                return error;
@@ -2660,17 +3138,17 @@ int git_repository_detach_head(git_repository* repo)
        if ((error = git_repository_head(&old_head, repo)) < 0)
                goto cleanup;
 
-       if ((error = git_object_lookup(&object, repo, git_reference_target(old_head), GIT_OBJ_COMMIT)) < 0)
+       if ((error = git_object_lookup(&object, repo, git_reference_target(old_head), GIT_OBJECT_COMMIT)) < 0)
                goto cleanup;
 
        if ((error = checkout_message(&log_message, current, git_oid_tostr_s(git_object_id(object)))) < 0)
                goto cleanup;
 
        error = git_reference_create(&new_head, repo, GIT_HEAD_FILE, git_reference_target(old_head),
-                       1, git_buf_cstr(&log_message));
+                       1, git_str_cstr(&log_message));
 
 cleanup:
-       git_buf_free(&log_message);
+       git_str_dispose(&log_message);
        git_object_free(object);
        git_reference_free(old_head);
        git_reference_free(new_head);
@@ -2684,69 +3162,69 @@ cleanup:
  */
 int git_repository_state(git_repository *repo)
 {
-       git_buf repo_path = GIT_BUF_INIT;
+       git_str repo_path = GIT_STR_INIT;
        int state = GIT_REPOSITORY_STATE_NONE;
 
-       assert(repo);
+       GIT_ASSERT_ARG(repo);
 
-       if (git_buf_puts(&repo_path, repo->gitdir) < 0)
+       if (git_str_puts(&repo_path, repo->gitdir) < 0)
                return -1;
 
-       if (git_path_contains_file(&repo_path, GIT_REBASE_MERGE_INTERACTIVE_FILE))
+       if (git_fs_path_contains_file(&repo_path, GIT_REBASE_MERGE_INTERACTIVE_FILE))
                state = GIT_REPOSITORY_STATE_REBASE_INTERACTIVE;
-       else if (git_path_contains_dir(&repo_path, GIT_REBASE_MERGE_DIR))
+       else if (git_fs_path_contains_dir(&repo_path, GIT_REBASE_MERGE_DIR))
                state = GIT_REPOSITORY_STATE_REBASE_MERGE;
-       else if (git_path_contains_file(&repo_path, GIT_REBASE_APPLY_REBASING_FILE))
+       else if (git_fs_path_contains_file(&repo_path, GIT_REBASE_APPLY_REBASING_FILE))
                state = GIT_REPOSITORY_STATE_REBASE;
-       else if (git_path_contains_file(&repo_path, GIT_REBASE_APPLY_APPLYING_FILE))
+       else if (git_fs_path_contains_file(&repo_path, GIT_REBASE_APPLY_APPLYING_FILE))
                state = GIT_REPOSITORY_STATE_APPLY_MAILBOX;
-       else if (git_path_contains_dir(&repo_path, GIT_REBASE_APPLY_DIR))
+       else if (git_fs_path_contains_dir(&repo_path, GIT_REBASE_APPLY_DIR))
                state = GIT_REPOSITORY_STATE_APPLY_MAILBOX_OR_REBASE;
-       else if (git_path_contains_file(&repo_path, GIT_MERGE_HEAD_FILE))
+       else if (git_fs_path_contains_file(&repo_path, GIT_MERGE_HEAD_FILE))
                state = GIT_REPOSITORY_STATE_MERGE;
-       else if (git_path_contains_file(&repo_path, GIT_REVERT_HEAD_FILE)) {
+       else if (git_fs_path_contains_file(&repo_path, GIT_REVERT_HEAD_FILE)) {
                state = GIT_REPOSITORY_STATE_REVERT;
-               if (git_path_contains_file(&repo_path, GIT_SEQUENCER_TODO_FILE)) {
+               if (git_fs_path_contains_file(&repo_path, GIT_SEQUENCER_TODO_FILE)) {
                        state = GIT_REPOSITORY_STATE_REVERT_SEQUENCE;
                }
-       } else if (git_path_contains_file(&repo_path, GIT_CHERRYPICK_HEAD_FILE)) {
+       } else if (git_fs_path_contains_file(&repo_path, GIT_CHERRYPICK_HEAD_FILE)) {
                state = GIT_REPOSITORY_STATE_CHERRYPICK;
-               if (git_path_contains_file(&repo_path, GIT_SEQUENCER_TODO_FILE)) {
+               if (git_fs_path_contains_file(&repo_path, GIT_SEQUENCER_TODO_FILE)) {
                        state = GIT_REPOSITORY_STATE_CHERRYPICK_SEQUENCE;
                }
-       } else if (git_path_contains_file(&repo_path, GIT_BISECT_LOG_FILE))
+       } else if (git_fs_path_contains_file(&repo_path, GIT_BISECT_LOG_FILE))
                state = GIT_REPOSITORY_STATE_BISECT;
 
-       git_buf_free(&repo_path);
+       git_str_dispose(&repo_path);
        return state;
 }
 
 int git_repository__cleanup_files(
        git_repository *repo, const char *files[], size_t files_len)
 {
-       git_buf buf = GIT_BUF_INIT;
+       git_str buf = GIT_STR_INIT;
        size_t i;
        int error;
 
        for (error = 0, i = 0; !error && i < files_len; ++i) {
                const char *path;
 
-               if (git_buf_joinpath(&buf, repo->gitdir, files[i]) < 0)
+               if (git_str_joinpath(&buf, repo->gitdir, files[i]) < 0)
                        return -1;
 
-               path = git_buf_cstr(&buf);
+               path = git_str_cstr(&buf);
 
-               if (git_path_isfile(path)) {
+               if (git_fs_path_isfile(path)) {
                        error = p_unlink(path);
-               } else if (git_path_isdir(path)) {
+               } else if (git_fs_path_isdir(path)) {
                        error = git_futils_rmdir_r(path, NULL,
                                GIT_RMDIR_REMOVE_FILES | GIT_RMDIR_REMOVE_BLOCKERS);
                }
-                       
-               git_buf_clear(&buf);
+
+               git_str_clear(&buf);
        }
 
-       git_buf_free(&buf);
+       git_str_dispose(&buf);
        return error;
 }
 
@@ -2764,25 +3242,25 @@ static const char *state_files[] = {
 
 int git_repository_state_cleanup(git_repository *repo)
 {
-       assert(repo);
+       GIT_ASSERT_ARG(repo);
 
        return git_repository__cleanup_files(repo, state_files, ARRAY_SIZE(state_files));
 }
 
 int git_repository_is_shallow(git_repository *repo)
 {
-       git_buf path = GIT_BUF_INIT;
+       git_str path = GIT_STR_INIT;
        struct stat st;
        int error;
 
-       if ((error = git_buf_joinpath(&path, repo->gitdir, "shallow")) < 0)
+       if ((error = git_str_joinpath(&path, repo->gitdir, "shallow")) < 0)
                return error;
 
-       error = git_path_lstat(path.ptr, &st);
-       git_buf_free(&path);
+       error = git_fs_path_lstat(path.ptr, &st);
+       git_str_dispose(&path);
 
        if (error == GIT_ENOTFOUND) {
-               giterr_clear();
+               git_error_clear();
                return 0;
        }
 
@@ -2791,7 +3269,7 @@ int git_repository_is_shallow(git_repository *repo)
        return st.st_size == 0 ? 0 : 1;
 }
 
-int git_repository_init_init_options(
+int git_repository_init_options_init(
        git_repository_init_options *opts, unsigned int version)
 {
        GIT_INIT_STRUCTURE_FROM_TEMPLATE(
@@ -2800,6 +3278,14 @@ int git_repository_init_init_options(
        return 0;
 }
 
+#ifndef GIT_DEPRECATE_HARD
+int git_repository_init_init_options(
+       git_repository_init_options *opts, unsigned int version)
+{
+       return git_repository_init_options_init(opts, version);
+}
+#endif
+
 int git_repository_ident(const char **name, const char **email, const git_repository *repo)
 {
        *name = repo->ident_name;
@@ -2814,16 +3300,16 @@ int git_repository_set_ident(git_repository *repo, const char *name, const char
 
        if (name) {
                tmp_name = git__strdup(name);
-               GITERR_CHECK_ALLOC(tmp_name);
+               GIT_ERROR_CHECK_ALLOC(tmp_name);
        }
 
        if (email) {
                tmp_email = git__strdup(email);
-               GITERR_CHECK_ALLOC(tmp_email);
+               GIT_ERROR_CHECK_ALLOC(tmp_email);
        }
 
-       tmp_name = git__swap(repo->ident_name, tmp_name);
-       tmp_email = git__swap(repo->ident_email, tmp_email);
+       tmp_name = git_atomic_swap(repo->ident_name, tmp_name);
+       tmp_email = git_atomic_swap(repo->ident_email, tmp_email);
 
        git__free(tmp_name);
        git__free(tmp_email);
@@ -2833,28 +3319,16 @@ int git_repository_set_ident(git_repository *repo, const char *name, const char
 
 int git_repository_submodule_cache_all(git_repository *repo)
 {
-       int error;
-
-       assert(repo);
-
-       if ((error = git_strmap_alloc(&repo->submodule_cache)))
-               return error;
-
-       error = git_submodule__map(repo, repo->submodule_cache);
-       return error;
+       GIT_ASSERT_ARG(repo);
+       return git_submodule_cache_init(&repo->submodule_cache, repo);
 }
 
 int git_repository_submodule_cache_clear(git_repository *repo)
 {
-       git_submodule *sm;
-       assert(repo);
-       if (repo->submodule_cache == NULL) {
-               return 0;
-       }
-       git_strmap_foreach_value(repo->submodule_cache, sm, {
-               git_submodule_free(sm);
-       });
-       git_strmap_free(repo->submodule_cache);
-       repo->submodule_cache = 0;
-       return 0;
+       int error = 0;
+       GIT_ASSERT_ARG(repo);
+
+       error = git_submodule_cache_free(repo->submodule_cache);
+       repo->submodule_cache = NULL;
+       return error;
 }