rugged 1.3.1 → 1.6.2

data/vendor/libgit2/src/{path.c → util/fs_path.c}

@@ -5,10 +5,11 @@
  * a Linking Exception. For full terms see the included COPYING file.
  */
 
-#include "path.h"
+#include "fs_path.h"
 
+#include "git2_util.h"
+#include "futils.h"
 #include "posix.h"
-#include "repository.h"
 #ifdef GIT_WIN32
 #include "win32/posix.h"
 #include "win32/w32_buffer.h"
@@ -21,6 +22,13 @@
 #include <stdio.h>
 #include <ctype.h>
 
+#define ensure_error_set(code) do { \
+		const git_error *e = git_error_last(); \
+		if (!e || !e->message) \
+			git_error_set(e ? e->klass : GIT_ERROR_CALLBACK, \
+				"filesystem callback returned %d", code); \
+	} while(0)
+
 static int dos_drive_prefix_length(const char *path)
 {
 	int i;
@@ -93,7 +101,7 @@ static bool looks_like_network_computer_name(const char *path, int pos)
  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
-int git_path_basename_r(git_buf *buffer, const char *path)
+int git_fs_path_basename_r(git_str *buffer, const char *path)
 {
 	const char *endp, *startp;
 	int len, result;
@@ -101,7 +109,7 @@ int git_path_basename_r(git_buf *buffer, const char *path)
 	/* Empty or NULL string gets treated as "." */
 	if (path == NULL || *path == '\0') {
 		startp = ".";
-		len		= 1;
+		len = 1;
 		goto Exit;
 	}
 
@@ -113,7 +121,7 @@ int git_path_basename_r(git_buf *buffer, const char *path)
 	/* All slashes becomes "/" */
 	if (endp == path && *endp == '/') {
 		startp = "/";
-		len	= 1;
+		len = 1;
 		goto Exit;
 	}
 
@@ -128,7 +136,7 @@ int git_path_basename_r(git_buf *buffer, const char *path)
 Exit:
 	result = len;
 
-	if (buffer != NULL && git_buf_set(buffer, startp, len) < 0)
+	if (buffer != NULL && git_str_set(buffer, startp, len) < 0)
 		return -1;
 
 	return result;
@@ -136,7 +144,7 @@ Exit:
 
 /*
  * Determine if the path is a Windows prefix and, if so, returns
- * its actual lentgh. If it is not a prefix, returns -1.
+ * its actual length. If it is not a prefix, returns -1.
  */
 static int win32_prefix_length(const char *path, int len)
 {
@@ -166,7 +174,7 @@ static int win32_prefix_length(const char *path, int len)
  * Based on the Android implementation, BSD licensed.
  * Check http://android.git.kernel.org/
  */
-int git_path_dirname_r(git_buf *buffer, const char *path)
+int git_fs_path_dirname_r(git_str *buffer, const char *path)
 {
 	const char *endp;
 	int is_prefix = 0, len;
@@ -185,8 +193,7 @@ int git_path_dirname_r(git_buf *buffer, const char *path)
 
 	if (endp - path + 1 > INT_MAX) {
 		git_error_set(GIT_ERROR_INVALID, "path too long");
-		len = -1;
-		goto Exit;
+		return -1;
 	}
 
 	if ((len = win32_prefix_length(path, (int)(endp - path + 1))) > 0) {
@@ -211,8 +218,7 @@ int git_path_dirname_r(git_buf *buffer, const char *path)
 
 	if (endp - path + 1 > INT_MAX) {
 		git_error_set(GIT_ERROR_INVALID, "path too long");
-		len = -1;
-		goto Exit;
+		return -1;
 	}
 
 	if ((len = win32_prefix_length(path, (int)(endp - path + 1))) > 0) {
@@ -225,9 +231,9 @@ int git_path_dirname_r(git_buf *buffer, const char *path)
 
 Exit:
 	if (buffer) {
-		if (git_buf_set(buffer, path, len) < 0)
+		if (git_str_set(buffer, path, len) < 0)
 			return -1;
-		if (is_prefix && git_buf_putc(buffer, '/') < 0)
+		if (is_prefix && git_str_putc(buffer, '/') < 0)
 			return -1;
 	}
 
@@ -235,38 +241,38 @@ Exit:
 }
 
 
-char *git_path_dirname(const char *path)
+char *git_fs_path_dirname(const char *path)
 {
-	git_buf buf = GIT_BUF_INIT;
+	git_str buf = GIT_STR_INIT;
 	char *dirname;
 
-	git_path_dirname_r(&buf, path);
-	dirname = git_buf_detach(&buf);
-	git_buf_dispose(&buf); /* avoid memleak if error occurs */
+	git_fs_path_dirname_r(&buf, path);
+	dirname = git_str_detach(&buf);
+	git_str_dispose(&buf); /* avoid memleak if error occurs */
 
 	return dirname;
 }
 
-char *git_path_basename(const char *path)
+char *git_fs_path_basename(const char *path)
 {
-	git_buf buf = GIT_BUF_INIT;
+	git_str buf = GIT_STR_INIT;
 	char *basename;
 
-	git_path_basename_r(&buf, path);
-	basename = git_buf_detach(&buf);
-	git_buf_dispose(&buf); /* avoid memleak if error occurs */
+	git_fs_path_basename_r(&buf, path);
+	basename = git_str_detach(&buf);
+	git_str_dispose(&buf); /* avoid memleak if error occurs */
 
 	return basename;
 }
 
-size_t git_path_basename_offset(git_buf *buffer)
+size_t git_fs_path_basename_offset(git_str *buffer)
 {
 	ssize_t slash;
 
 	if (!buffer || buffer->size <= 0)
 		return 0;
 
-	slash = git_buf_rfind_next(buffer, '/');
+	slash = git_str_rfind_next(buffer, '/');
 
 	if (slash >= 0 && buffer->ptr[slash] == '/')
 		return (size_t)(slash + 1);
@@ -274,7 +280,7 @@ size_t git_path_basename_offset(git_buf *buffer)
 	return 0;
 }
 
-int git_path_root(const char *path)
+int git_fs_path_root(const char *path)
 {
 	int offset = 0, prefix_len;
 
@@ -304,9 +310,9 @@ int git_path_root(const char *path)
 	return -1;	/* Not a real error - signals that path is not rooted */
 }
 
-static void path_trim_slashes(git_buf *path)
+static void path_trim_slashes(git_str *path)
 {
-	int ceiling = git_path_root(path->ptr) + 1;
+	int ceiling = git_fs_path_root(path->ptr) + 1;
 
 	if (ceiling < 0)
 		return;
@@ -320,29 +326,29 @@ static void path_trim_slashes(git_buf *path)
 	}
 }
 
-int git_path_join_unrooted(
-	git_buf *path_out, const char *path, const char *base, ssize_t *root_at)
+int git_fs_path_join_unrooted(
+	git_str *path_out, const char *path, const char *base, ssize_t *root_at)
 {
 	ssize_t root;
 
 	GIT_ASSERT_ARG(path_out);
 	GIT_ASSERT_ARG(path);
 
-	root = (ssize_t)git_path_root(path);
+	root = (ssize_t)git_fs_path_root(path);
 
 	if (base != NULL && root < 0) {
-		if (git_buf_joinpath(path_out, base, path) < 0)
+		if (git_str_joinpath(path_out, base, path) < 0)
 			return -1;
 
 		root = (ssize_t)strlen(base);
 	} else {
-		if (git_buf_sets(path_out, path) < 0)
+		if (git_str_sets(path_out, path) < 0)
 			return -1;
 
 		if (root < 0)
 			root = 0;
 		else if (base)
-			git_path_equal_or_prefixed(base, path, &root);
+			git_fs_path_equal_or_prefixed(base, path, &root);
 	}
 
 	if (root_at)
@@ -351,7 +357,7 @@ int git_path_join_unrooted(
 	return 0;
 }
 
-void git_path_squash_slashes(git_buf *path)
+void git_fs_path_squash_slashes(git_str *path)
 {
 	char *p, *q;
 
@@ -370,7 +376,7 @@ void git_path_squash_slashes(git_buf *path)
 	*p = '\0';
 }
 
-int git_path_prettify(git_buf *path_out, const char *path, const char *base)
+int git_fs_path_prettify(git_str *path_out, const char *path, const char *base)
 {
 	char buf[GIT_PATH_MAX];
 
@@ -378,8 +384,8 @@ int git_path_prettify(git_buf *path_out, const char *path, const char *base)
 	GIT_ASSERT_ARG(path);
 
 	/* construct path if needed */
-	if (base != NULL && git_path_root(path) < 0) {
-		if (git_buf_joinpath(path_out, base, path) < 0)
+	if (base != NULL && git_fs_path_root(path) < 0) {
+		if (git_str_joinpath(path_out, base, path) < 0)
 			return -1;
 		path = path_out->ptr;
 	}
@@ -389,31 +395,31 @@ int git_path_prettify(git_buf *path_out, const char *path, const char *base)
 		int error = (errno == ENOENT || errno == ENOTDIR) ? GIT_ENOTFOUND : -1;
 		git_error_set(GIT_ERROR_OS, "failed to resolve path '%s'", path);
 
-		git_buf_clear(path_out);
+		git_str_clear(path_out);
 
 		return error;
 	}
 
-	return git_buf_sets(path_out, buf);
+	return git_str_sets(path_out, buf);
 }
 
-int git_path_prettify_dir(git_buf *path_out, const char *path, const char *base)
+int git_fs_path_prettify_dir(git_str *path_out, const char *path, const char *base)
 {
-	int error = git_path_prettify(path_out, path, base);
-	return (error < 0) ? error : git_path_to_dir(path_out);
+	int error = git_fs_path_prettify(path_out, path, base);
+	return (error < 0) ? error : git_fs_path_to_dir(path_out);
 }
 
-int git_path_to_dir(git_buf *path)
+int git_fs_path_to_dir(git_str *path)
 {
 	if (path->asize > 0 &&
-		git_buf_len(path) > 0 &&
-		path->ptr[git_buf_len(path) - 1] != '/')
-		git_buf_putc(path, '/');
+		git_str_len(path) > 0 &&
+		path->ptr[git_str_len(path) - 1] != '/')
+		git_str_putc(path, '/');
 
-	return git_buf_oom(path) ? -1 : 0;
+	return git_str_oom(path) ? -1 : 0;
 }
 
-void git_path_string_to_dir(char *path, size_t size)
+void git_fs_path_string_to_dir(char *path, size_t size)
 {
 	size_t end = strlen(path);
 
@@ -423,7 +429,7 @@ void git_path_string_to_dir(char *path, size_t size)
 	}
 }
 
-int git__percent_decode(git_buf *decoded_out, const char *input)
+int git__percent_decode(git_str *decoded_out, const char *input)
 {
 	int len, hi, lo, i;
 
@@ -431,7 +437,7 @@ int git__percent_decode(git_buf *decoded_out, const char *input)
 	GIT_ASSERT_ARG(input);
 
 	len = (int)strlen(input);
-	git_buf_clear(decoded_out);
+	git_str_clear(decoded_out);
 
 	for(i = 0; i < len; i++)
 	{
@@ -453,7 +459,7 @@ int git__percent_decode(git_buf *decoded_out, const char *input)
 		i += 2;
 
 append:
-		if (git_buf_putc(decoded_out, c) < 0)
+		if (git_str_putc(decoded_out, c) < 0)
 			return -1;
 	}
 
@@ -480,12 +486,12 @@ static int local_file_url_prefixlen(const char *file_url)
 	return len;
 }
 
-bool git_path_is_local_file_url(const char *file_url)
+bool git_fs_path_is_local_file_url(const char *file_url)
 {
 	return (local_file_url_prefixlen(file_url) > 0);
 }
 
-int git_path_fromurl(git_buf *local_path_out, const char *file_url)
+int git_fs_path_fromurl(git_str *local_path_out, const char *file_url)
 {
 	int offset;
 
@@ -500,18 +506,18 @@ int git_path_fromurl(git_buf *local_path_out, const char *file_url)
 	offset--;	/* A *nix absolute path starts with a forward slash */
 #endif
 
-	git_buf_clear(local_path_out);
+	git_str_clear(local_path_out);
 	return git__percent_decode(local_path_out, file_url + offset);
 }
 
-int git_path_walk_up(
-	git_buf *path,
+int git_fs_path_walk_up(
+	git_str *path,
 	const char *ceiling,
 	int (*cb)(void *data, const char *),
 	void *data)
 {
 	int error = 0;
-	git_buf iter;
+	git_str iter;
 	ssize_t stop = 0, scan;
 	char oldc = '\0';
 
@@ -522,20 +528,20 @@ int git_path_walk_up(
 		if (git__prefixcmp(path->ptr, ceiling) == 0)
 			stop = (ssize_t)strlen(ceiling);
 		else
-			stop = git_buf_len(path);
+			stop = git_str_len(path);
 	}
-	scan = git_buf_len(path);
+	scan = git_str_len(path);
 
 	/* empty path: yield only once */
 	if (!scan) {
 		error = cb(data, "");
 		if (error)
-			git_error_set_after_callback(error);
+			ensure_error_set(error);
 		return error;
 	}
 
 	iter.ptr = path->ptr;
-	iter.size = git_buf_len(path);
+	iter.size = git_str_len(path);
 	iter.asize = path->asize;
 
 	while (scan >= stop) {
@@ -543,11 +549,11 @@ int git_path_walk_up(
 		iter.ptr[scan] = oldc;
 
 		if (error) {
-			git_error_set_after_callback(error);
+			ensure_error_set(error);
 			break;
 		}
 
-		scan = git_buf_rfind_next(&iter, '/');
+		scan = git_str_rfind_next(&iter, '/');
 		if (scan >= 0) {
 			scan++;
 			oldc = iter.ptr[scan];
@@ -563,19 +569,19 @@ int git_path_walk_up(
 	if (!error && stop == 0 && iter.ptr[0] != '/') {
 		error = cb(data, "");
 		if (error)
-			git_error_set_after_callback(error);
+			ensure_error_set(error);
 	}
 
 	return error;
 }
 
-bool git_path_exists(const char *path)
+bool git_fs_path_exists(const char *path)
 {
 	GIT_ASSERT_ARG_WITH_RETVAL(path, false);
 	return p_access(path, F_OK) == 0;
 }
 
-bool git_path_isdir(const char *path)
+bool git_fs_path_isdir(const char *path)
 {
 	struct stat st;
 	if (p_stat(path, &st) < 0)
@@ -584,7 +590,7 @@ bool git_path_isdir(const char *path)
 	return S_ISDIR(st.st_mode) != 0;
 }
 
-bool git_path_isfile(const char *path)
+bool git_fs_path_isfile(const char *path)
 {
 	struct stat st;
 
@@ -595,7 +601,7 @@ bool git_path_isfile(const char *path)
 	return S_ISREG(st.st_mode) != 0;
 }
 
-bool git_path_islink(const char *path)
+bool git_fs_path_islink(const char *path)
 {
 	struct stat st;
 
@@ -608,7 +614,7 @@ bool git_path_islink(const char *path)
 
 #ifdef GIT_WIN32
 
-bool git_path_is_empty_dir(const char *path)
+bool git_fs_path_is_empty_dir(const char *path)
 {
 	git_win32_path filter_w;
 	bool empty = false;
@@ -627,7 +633,7 @@ bool git_path_is_empty_dir(const char *path)
 		 * (a mount point).
 		 */
 		if (hFind == INVALID_HANDLE_VALUE)
-			return git_path_isdir(path);
+			return git_fs_path_isdir(path);
 
 		/* If the find handle was created successfully, then it's a directory */
 		empty = true;
@@ -637,7 +643,7 @@ bool git_path_is_empty_dir(const char *path)
 			 * empty. In the special case of drive roots (i.e. C:\) where . and
 			 * .. do not occur, we can still consider the path to be an empty
 			 * directory if there's nothing there. */
-			if (!git_path_is_dot_or_dotdotW(findData.cFileName)) {
+			if (!git_fs_path_is_dot_or_dotdotW(findData.cFileName)) {
 				empty = false;
 				break;
 			}
@@ -651,33 +657,33 @@ bool git_path_is_empty_dir(const char *path)
 
 #else
 
-static int path_found_entry(void *payload, git_buf *path)
+static int path_found_entry(void *payload, git_str *path)
 {
 	GIT_UNUSED(payload);
-	return !git_path_is_dot_or_dotdot(path->ptr);
+	return !git_fs_path_is_dot_or_dotdot(path->ptr);
 }
 
-bool git_path_is_empty_dir(const char *path)
+bool git_fs_path_is_empty_dir(const char *path)
 {
 	int error;
-	git_buf dir = GIT_BUF_INIT;
+	git_str dir = GIT_STR_INIT;
 
-	if (!git_path_isdir(path))
+	if (!git_fs_path_isdir(path))
 		return false;
 
-	if ((error = git_buf_sets(&dir, path)) != 0)
+	if ((error = git_str_sets(&dir, path)) != 0)
 		git_error_clear();
 	else
-		error = git_path_direach(&dir, 0, path_found_entry, NULL);
+		error = git_fs_path_direach(&dir, 0, path_found_entry, NULL);
 
-	git_buf_dispose(&dir);
+	git_str_dispose(&dir);
 
 	return !error;
 }
 
 #endif
 
-int git_path_set_error(int errno_value, const char *path, const char *action)
+int git_fs_path_set_error(int errno_value, const char *path, const char *action)
 {
 	switch (errno_value) {
 	case ENOENT:
@@ -704,87 +710,87 @@ int git_path_set_error(int errno_value, const char *path, const char *action)
 	}
 }
 
-int git_path_lstat(const char *path, struct stat *st)
+int git_fs_path_lstat(const char *path, struct stat *st)
 {
 	if (p_lstat(path, st) == 0)
 		return 0;
 
-	return git_path_set_error(errno, path, "stat");
+	return git_fs_path_set_error(errno, path, "stat");
 }
 
 static bool _check_dir_contents(
-	git_buf *dir,
+	git_str *dir,
 	const char *sub,
 	bool (*predicate)(const char *))
 {
 	bool result;
-	size_t dir_size = git_buf_len(dir);
+	size_t dir_size = git_str_len(dir);
 	size_t sub_size = strlen(sub);
 	size_t alloc_size;
 
 	/* leave base valid even if we could not make space for subdir */
 	if (GIT_ADD_SIZET_OVERFLOW(&alloc_size, dir_size, sub_size) ||
 		GIT_ADD_SIZET_OVERFLOW(&alloc_size, alloc_size, 2) ||
-		git_buf_try_grow(dir, alloc_size, false) < 0)
+		git_str_try_grow(dir, alloc_size, false) < 0)
 		return false;
 
 	/* save excursion */
-	if (git_buf_joinpath(dir, dir->ptr, sub) < 0)
+	if (git_str_joinpath(dir, dir->ptr, sub) < 0)
 		return false;
 
 	result = predicate(dir->ptr);
 
 	/* restore path */
-	git_buf_truncate(dir, dir_size);
+	git_str_truncate(dir, dir_size);
 	return result;
 }
 
-bool git_path_contains(git_buf *dir, const char *item)
+bool git_fs_path_contains(git_str *dir, const char *item)
 {
-	return _check_dir_contents(dir, item, &git_path_exists);
+	return _check_dir_contents(dir, item, &git_fs_path_exists);
 }
 
-bool git_path_contains_dir(git_buf *base, const char *subdir)
+bool git_fs_path_contains_dir(git_str *base, const char *subdir)
 {
-	return _check_dir_contents(base, subdir, &git_path_isdir);
+	return _check_dir_contents(base, subdir, &git_fs_path_isdir);
 }
 
-bool git_path_contains_file(git_buf *base, const char *file)
+bool git_fs_path_contains_file(git_str *base, const char *file)
 {
-	return _check_dir_contents(base, file, &git_path_isfile);
+	return _check_dir_contents(base, file, &git_fs_path_isfile);
 }
 
-int git_path_find_dir(git_buf *dir)
+int git_fs_path_find_dir(git_str *dir)
 {
 	int error = 0;
 	char buf[GIT_PATH_MAX];
 
 	if (p_realpath(dir->ptr, buf) != NULL)
-		error = git_buf_sets(dir, buf);
+		error = git_str_sets(dir, buf);
 
 	/* call dirname if this is not a directory */
-	if (!error) /* && git_path_isdir(dir->ptr) == false) */
-		error = (git_path_dirname_r(dir, dir->ptr) < 0) ? -1 : 0;
+	if (!error) /* && git_fs_path_isdir(dir->ptr) == false) */
+		error = (git_fs_path_dirname_r(dir, dir->ptr) < 0) ? -1 : 0;
 
 	if (!error)
-		error = git_path_to_dir(dir);
+		error = git_fs_path_to_dir(dir);
 
 	return error;
 }
 
-int git_path_resolve_relative(git_buf *path, size_t ceiling)
+int git_fs_path_resolve_relative(git_str *path, size_t ceiling)
 {
 	char *base, *to, *from, *next;
 	size_t len;
 
-	GIT_ERROR_CHECK_ALLOC_BUF(path);
+	GIT_ERROR_CHECK_ALLOC_STR(path);
 
 	if (ceiling > path->size)
 		ceiling = path->size;
 
 	/* recognize drive prefixes, etc. that should not be backed over */
 	if (ceiling == 0)
-		ceiling = git_path_root(path->ptr) + 1;
+		ceiling = git_fs_path_root(path->ptr) + 1;
 
 	/* recognize URL prefixes that should not be backed over */
 	if (ceiling == 0) {
@@ -851,13 +857,13 @@ int git_path_resolve_relative(git_buf *path, size_t ceiling)
 	return 0;
 }
 
-int git_path_apply_relative(git_buf *target, const char *relpath)
+int git_fs_path_apply_relative(git_str *target, const char *relpath)
 {
-	return git_buf_joinpath(target, git_buf_cstr(target), relpath) ||
-	    git_path_resolve_relative(target, 0);
+	return git_str_joinpath(target, git_str_cstr(target), relpath) ||
+	    git_fs_path_resolve_relative(target, 0);
 }
 
-int git_path_cmp(
+int git_fs_path_cmp(
 	const char *name1, size_t len1, int isdir1,
 	const char *name2, size_t len2, int isdir2,
 	int (*compare)(const char *, const char *, size_t))
@@ -882,7 +888,7 @@ int git_path_cmp(
 	return (c1 < c2) ? -1 : (c1 > c2) ? 1 : 0;
 }
 
-size_t git_path_common_dirlen(const char *one, const char *two)
+size_t git_fs_path_common_dirlen(const char *one, const char *two)
 {
 	const char *p, *q, *dirsep = NULL;
 
@@ -896,7 +902,7 @@ size_t git_path_common_dirlen(const char *one, const char *two)
 	return dirsep ? (dirsep - one) + 1 : 0;
 }
 
-int git_path_make_relative(git_buf *path, const char *parent)
+int git_fs_path_make_relative(git_str *path, const char *parent)
 {
 	const char *p, *q, *p_dirsep, *q_dirsep;
 	size_t plen = path->size, newlen, alloclen, depth = 1, i, offset;
@@ -923,7 +929,7 @@ int git_path_make_relative(git_buf *path, const char *parent)
 	else if (!*p && *q == '/')
 		q++;
 	else if (!*p && !*q)
-		return git_buf_clear(path), 0;
+		return git_str_clear(path), 0;
 	else {
 		p = p_dirsep + 1;
 		q = q_dirsep + 1;
@@ -932,7 +938,7 @@ int git_path_make_relative(git_buf *path, const char *parent)
 	plen -= (p - path->ptr);
 
 	if (!*q)
-		return git_buf_set(path, p, plen);
+		return git_str_set(path, p, plen);
 
 	for (; (q = strchr(q, '/')) && *(q + 1); q++)
 		depth++;
@@ -944,7 +950,7 @@ int git_path_make_relative(git_buf *path, const char *parent)
 
 	/* save the offset as we might realllocate the pointer */
 	offset = p - path->ptr;
-	if (git_buf_try_grow(path, alloclen, 1) < 0)
+	if (git_str_try_grow(path, alloclen, 1) < 0)
 		return -1;
 	p = path->ptr + offset;
 
@@ -957,7 +963,7 @@ int git_path_make_relative(git_buf *path, const char *parent)
 	return 0;
 }
 
-bool git_path_has_non_ascii(const char *path, size_t pathlen)
+bool git_fs_path_has_non_ascii(const char *path, size_t pathlen)
 {
 	const uint8_t *scan = (const uint8_t *)path, *end;
 
@@ -970,37 +976,37 @@ bool git_path_has_non_ascii(const char *path, size_t pathlen)
 
 #ifdef GIT_USE_ICONV
 
-int git_path_iconv_init_precompose(git_path_iconv_t *ic)
+int git_fs_path_iconv_init_precompose(git_fs_path_iconv_t *ic)
 {
-	git_buf_init(&ic->buf, 0);
+	git_str_init(&ic->buf, 0);
 	ic->map = iconv_open(GIT_PATH_REPO_ENCODING, GIT_PATH_NATIVE_ENCODING);
 	return 0;
 }
 
-void git_path_iconv_clear(git_path_iconv_t *ic)
+void git_fs_path_iconv_clear(git_fs_path_iconv_t *ic)
 {
 	if (ic) {
 		if (ic->map != (iconv_t)-1)
 			iconv_close(ic->map);
-		git_buf_dispose(&ic->buf);
+		git_str_dispose(&ic->buf);
 	}
 }
 
-int git_path_iconv(git_path_iconv_t *ic, const char **in, size_t *inlen)
+int git_fs_path_iconv(git_fs_path_iconv_t *ic, const char **in, size_t *inlen)
 {
 	char *nfd = (char*)*in, *nfc;
 	size_t nfdlen = *inlen, nfclen, wantlen = nfdlen, alloclen, rv;
 	int retry = 1;
 
 	if (!ic || ic->map == (iconv_t)-1 ||
-		!git_path_has_non_ascii(*in, *inlen))
+		!git_fs_path_has_non_ascii(*in, *inlen))
 		return 0;
 
-	git_buf_clear(&ic->buf);
+	git_str_clear(&ic->buf);
 
 	while (1) {
 		GIT_ERROR_CHECK_ALLOC_ADD(&alloclen, wantlen, 1);
-		if (git_buf_grow(&ic->buf, alloclen) < 0)
+		if (git_str_grow(&ic->buf, alloclen) < 0)
 			return -1;
 
 		nfc    = ic->buf.ptr   + ic->buf.size;
@@ -1040,8 +1046,8 @@ fail:
 	return -1;
 }
 
-static const char *nfc_file = "\xC3\x85\x73\x74\x72\xC3\xB6\x6D.XXXXXX";
-static const char *nfd_file = "\x41\xCC\x8A\x73\x74\x72\x6F\xCC\x88\x6D.XXXXXX";
+static const char *nfc_file = "\xC3\x85\x73\x74\x72\xC3\xB6\x6D";
+static const char *nfd_file = "\x41\xCC\x8A\x73\x74\x72\x6F\xCC\x88\x6D";
 
 /* Check if the platform is decomposing unicode data for us.  We will
  * emulate core Git and prefer to use precomposed unicode data internally
@@ -1052,47 +1058,50 @@ static const char *nfd_file = "\x41\xCC\x8A\x73\x74\x72\x6F\xCC\x88\x6D.XXXXXX";
  * return decomposed unicode from readdir() even when the actual
  * filesystem is storing precomposed unicode.
  */
-bool git_path_does_fs_decompose_unicode(const char *root)
+bool git_fs_path_does_decompose_unicode(const char *root)
 {
-	git_buf path = GIT_BUF_INIT;
+	git_str nfc_path = GIT_STR_INIT;
+	git_str nfd_path = GIT_STR_INIT;
 	int fd;
 	bool found_decomposed = false;
-	char tmp[6];
+	size_t orig_len;
+	const char *trailer;
 
 	/* Create a file using a precomposed path and then try to find it
 	 * using the decomposed name.  If the lookup fails, then we will mark
 	 * that we should precompose unicode for this repository.
 	 */
-	if (git_buf_joinpath(&path, root, nfc_file) < 0 ||
-		(fd = p_mkstemp(path.ptr)) < 0)
+	if (git_str_joinpath(&nfc_path, root, nfc_file) < 0)
+		goto done;
+
+	/* record original path length before trailer */
+	orig_len = nfc_path.size;
+
+	if ((fd = git_futils_mktmp(&nfc_path, nfc_path.ptr, 0666)) < 0)
 		goto done;
 	p_close(fd);
 
-	/* record trailing digits generated by mkstemp */
-	memcpy(tmp, path.ptr + path.size - sizeof(tmp), sizeof(tmp));
+	trailer = nfc_path.ptr + orig_len;
 
 	/* try to look up as NFD path */
-	if (git_buf_joinpath(&path, root, nfd_file) < 0)
+	if (git_str_joinpath(&nfd_path, root, nfd_file) < 0 ||
+	    git_str_puts(&nfd_path, trailer) < 0)
 		goto done;
-	memcpy(path.ptr + path.size - sizeof(tmp), tmp, sizeof(tmp));
 
-	found_decomposed = git_path_exists(path.ptr);
+	found_decomposed = git_fs_path_exists(nfd_path.ptr);
 
 	/* remove temporary file (using original precomposed path) */
-	if (git_buf_joinpath(&path, root, nfc_file) < 0)
-		goto done;
-	memcpy(path.ptr + path.size - sizeof(tmp), tmp, sizeof(tmp));
-
-	(void)p_unlink(path.ptr);
+	(void)p_unlink(nfc_path.ptr);
 
 done:
-	git_buf_dispose(&path);
+	git_str_dispose(&nfc_path);
+	git_str_dispose(&nfd_path);
 	return found_decomposed;
 }
 
 #else
 
-bool git_path_does_fs_decompose_unicode(const char *root)
+bool git_fs_path_does_decompose_unicode(const char *root)
 {
 	GIT_UNUSED(root);
 	return false;
@@ -1106,10 +1115,10 @@ typedef char path_dirent_data[sizeof(struct dirent) + FILENAME_MAX + 1];
 typedef struct dirent path_dirent_data;
 #endif
 
-int git_path_direach(
-	git_buf *path,
+int git_fs_path_direach(
+	git_str *path,
 	uint32_t flags,
-	int (*fn)(void *, git_buf *),
+	int (*fn)(void *, git_str *),
 	void *arg)
 {
 	int error = 0;
@@ -1118,15 +1127,15 @@ int git_path_direach(
 	struct dirent *de;
 
 #ifdef GIT_USE_ICONV
-	git_path_iconv_t ic = GIT_PATH_ICONV_INIT;
+	git_fs_path_iconv_t ic = GIT_PATH_ICONV_INIT;
 #endif
 
 	GIT_UNUSED(flags);
 
-	if (git_path_to_dir(path) < 0)
+	if (git_fs_path_to_dir(path) < 0)
 		return -1;
 
-	wd_len = git_buf_len(path);
+	wd_len = git_str_len(path);
 
 	if ((dir = opendir(path->ptr)) == NULL) {
 		git_error_set(GIT_ERROR_OS, "failed to open directory '%s'", path->ptr);
@@ -1137,34 +1146,34 @@ int git_path_direach(
 	}
 
 #ifdef GIT_USE_ICONV
-	if ((flags & GIT_PATH_DIR_PRECOMPOSE_UNICODE) != 0)
-		(void)git_path_iconv_init_precompose(&ic);
+	if ((flags & GIT_FS_PATH_DIR_PRECOMPOSE_UNICODE) != 0)
+		(void)git_fs_path_iconv_init_precompose(&ic);
 #endif
 
 	while ((de = readdir(dir)) != NULL) {
 		const char *de_path = de->d_name;
 		size_t de_len = strlen(de_path);
 
-		if (git_path_is_dot_or_dotdot(de_path))
+		if (git_fs_path_is_dot_or_dotdot(de_path))
 			continue;
 
 #ifdef GIT_USE_ICONV
-		if ((error = git_path_iconv(&ic, &de_path, &de_len)) < 0)
+		if ((error = git_fs_path_iconv(&ic, &de_path, &de_len)) < 0)
 			break;
 #endif
 
-		if ((error = git_buf_put(path, de_path, de_len)) < 0)
+		if ((error = git_str_put(path, de_path, de_len)) < 0)
 			break;
 
 		git_error_clear();
 		error = fn(arg, path);
 
-		git_buf_truncate(path, wd_len); /* restore path */
+		git_str_truncate(path, wd_len); /* restore path */
 
 		/* Only set our own error if the callback did not set one already */
 		if (error != 0) {
 			if (!git_error_last())
-				git_error_set_after_callback(error);
+				ensure_error_set(error);
 
 			break;
 		}
@@ -1173,7 +1182,7 @@ int git_path_direach(
 	closedir(dir);
 
 #ifdef GIT_USE_ICONV
-	git_path_iconv_clear(&ic);
+	git_fs_path_iconv_clear(&ic);
 #endif
 
 	return error;
@@ -1188,8 +1197,8 @@ int git_path_direach(
 # define FIND_FIRST_EX_LARGE_FETCH 2
 #endif
 
-int git_path_diriter_init(
-	git_path_diriter *diriter,
+int git_fs_path_diriter_init(
+	git_fs_path_diriter *diriter,
 	const char *path,
 	unsigned int flags)
 {
@@ -1202,10 +1211,10 @@ int git_path_diriter_init(
 	GIT_ASSERT_ARG(diriter);
 	GIT_ASSERT_ARG(path);
 
-	memset(diriter, 0, sizeof(git_path_diriter));
+	memset(diriter, 0, sizeof(git_fs_path_diriter));
 	diriter->handle = INVALID_HANDLE_VALUE;
 
-	if (git_buf_puts(&diriter->path_utf8, path) < 0)
+	if (git_str_puts(&diriter->path_utf8, path) < 0)
 		return -1;
 
 	path_trim_slashes(&diriter->path_utf8);
@@ -1239,7 +1248,7 @@ int git_path_diriter_init(
 	return 0;
 }
 
-static int diriter_update_paths(git_path_diriter *diriter)
+static int diriter_update_paths(git_fs_path_diriter *diriter)
 {
 	size_t filename_len, path_len;
 
@@ -1261,23 +1270,23 @@ static int diriter_update_paths(git_path_diriter *diriter)
 		diriter->current.cFileName, filename_len * sizeof(wchar_t));
 	diriter->path[path_len-1] = L'\0';
 
-	git_buf_truncate(&diriter->path_utf8, diriter->parent_utf8_len);
+	git_str_truncate(&diriter->path_utf8, diriter->parent_utf8_len);
 
 	if (diriter->parent_utf8_len > 0 &&
 		diriter->path_utf8.ptr[diriter->parent_utf8_len-1] != '/')
-		git_buf_putc(&diriter->path_utf8, '/');
+		git_str_putc(&diriter->path_utf8, '/');
 
-	git_buf_put_w(&diriter->path_utf8, diriter->current.cFileName, filename_len);
+	git_str_put_w(&diriter->path_utf8, diriter->current.cFileName, filename_len);
 
-	if (git_buf_oom(&diriter->path_utf8))
+	if (git_str_oom(&diriter->path_utf8))
 		return -1;
 
 	return 0;
 }
 
-int git_path_diriter_next(git_path_diriter *diriter)
+int git_fs_path_diriter_next(git_fs_path_diriter *diriter)
 {
-	bool skip_dot = !(diriter->flags & GIT_PATH_DIR_INCLUDE_DOT_AND_DOTDOT);
+	bool skip_dot = !(diriter->flags & GIT_FS_PATH_DIR_INCLUDE_DOT_AND_DOTDOT);
 
 	do {
 		/* Our first time through, we already have the data from
@@ -1287,7 +1296,7 @@ int git_path_diriter_next(git_path_diriter *diriter)
 			diriter->needs_next = 1;
 		else if (!FindNextFileW(diriter->handle, &diriter->current))
 			return GIT_ITEROVER;
-	} while (skip_dot && git_path_is_dot_or_dotdotW(diriter->current.cFileName));
+	} while (skip_dot && git_fs_path_is_dot_or_dotdotW(diriter->current.cFileName));
 
 	if (diriter_update_paths(diriter) < 0)
 		return -1;
@@ -1295,10 +1304,10 @@ int git_path_diriter_next(git_path_diriter *diriter)
 	return 0;
 }
 
-int git_path_diriter_filename(
+int git_fs_path_diriter_filename(
 	const char **out,
 	size_t *out_len,
-	git_path_diriter *diriter)
+	git_fs_path_diriter *diriter)
 {
 	GIT_ASSERT_ARG(out);
 	GIT_ASSERT_ARG(out_len);
@@ -1310,10 +1319,10 @@ int git_path_diriter_filename(
 	return 0;
 }
 
-int git_path_diriter_fullpath(
+int git_fs_path_diriter_fullpath(
 	const char **out,
 	size_t *out_len,
-	git_path_diriter *diriter)
+	git_fs_path_diriter *diriter)
 {
 	GIT_ASSERT_ARG(out);
 	GIT_ASSERT_ARG(out_len);
@@ -1324,7 +1333,7 @@ int git_path_diriter_fullpath(
 	return 0;
 }
 
-int git_path_diriter_stat(struct stat *out, git_path_diriter *diriter)
+int git_fs_path_diriter_stat(struct stat *out, git_fs_path_diriter *diriter)
 {
 	GIT_ASSERT_ARG(out);
 	GIT_ASSERT_ARG(diriter);
@@ -1334,12 +1343,12 @@ int git_path_diriter_stat(struct stat *out, git_path_diriter *diriter)
 		diriter->path);
 }
 
-void git_path_diriter_free(git_path_diriter *diriter)
+void git_fs_path_diriter_free(git_fs_path_diriter *diriter)
 {
 	if (diriter == NULL)
 		return;
 
-	git_buf_dispose(&diriter->path_utf8);
+	git_str_dispose(&diriter->path_utf8);
 
 	if (diriter->handle != INVALID_HANDLE_VALUE) {
 		FindClose(diriter->handle);
@@ -1349,17 +1358,17 @@ void git_path_diriter_free(git_path_diriter *diriter)
 
 #else
 
-int git_path_diriter_init(
-	git_path_diriter *diriter,
+int git_fs_path_diriter_init(
+	git_fs_path_diriter *diriter,
 	const char *path,
 	unsigned int flags)
 {
 	GIT_ASSERT_ARG(diriter);
 	GIT_ASSERT_ARG(path);
 
-	memset(diriter, 0, sizeof(git_path_diriter));
+	memset(diriter, 0, sizeof(git_fs_path_diriter));
 
-	if (git_buf_puts(&diriter->path, path) < 0)
+	if (git_str_puts(&diriter->path, path) < 0)
 		return -1;
 
 	path_trim_slashes(&diriter->path);
@@ -1370,15 +1379,15 @@ int git_path_diriter_init(
 	}
 
 	if ((diriter->dir = opendir(diriter->path.ptr)) == NULL) {
-		git_buf_dispose(&diriter->path);
+		git_str_dispose(&diriter->path);
 
 		git_error_set(GIT_ERROR_OS, "failed to open directory '%s'", path);
 		return -1;
 	}
 
 #ifdef GIT_USE_ICONV
-	if ((flags & GIT_PATH_DIR_PRECOMPOSE_UNICODE) != 0)
-		(void)git_path_iconv_init_precompose(&diriter->ic);
+	if ((flags & GIT_FS_PATH_DIR_PRECOMPOSE_UNICODE) != 0)
+		(void)git_fs_path_iconv_init_precompose(&diriter->ic);
 #endif
 
 	diriter->parent_len = diriter->path.size;
@@ -1387,12 +1396,12 @@ int git_path_diriter_init(
 	return 0;
 }
 
-int git_path_diriter_next(git_path_diriter *diriter)
+int git_fs_path_diriter_next(git_fs_path_diriter *diriter)
 {
 	struct dirent *de;
 	const char *filename;
 	size_t filename_len;
-	bool skip_dot = !(diriter->flags & GIT_PATH_DIR_INCLUDE_DOT_AND_DOTDOT);
+	bool skip_dot = !(diriter->flags & GIT_FS_PATH_DIR_INCLUDE_DOT_AND_DOTDOT);
 	int error = 0;
 
 	GIT_ASSERT_ARG(diriter);
@@ -1408,35 +1417,35 @@ int git_path_diriter_next(git_path_diriter *diriter)
 				"could not read directory '%s'", diriter->path.ptr);
 			return -1;
 		}
-	} while (skip_dot && git_path_is_dot_or_dotdot(de->d_name));
+	} while (skip_dot && git_fs_path_is_dot_or_dotdot(de->d_name));
 
 	filename = de->d_name;
 	filename_len = strlen(filename);
 
 #ifdef GIT_USE_ICONV
-	if ((diriter->flags & GIT_PATH_DIR_PRECOMPOSE_UNICODE) != 0 &&
-		(error = git_path_iconv(&diriter->ic, &filename, &filename_len)) < 0)
+	if ((diriter->flags & GIT_FS_PATH_DIR_PRECOMPOSE_UNICODE) != 0 &&
+		(error = git_fs_path_iconv(&diriter->ic, &filename, &filename_len)) < 0)
 		return error;
 #endif
 
-	git_buf_truncate(&diriter->path, diriter->parent_len);
+	git_str_truncate(&diriter->path, diriter->parent_len);
 
 	if (diriter->parent_len > 0 &&
 		diriter->path.ptr[diriter->parent_len-1] != '/')
-		git_buf_putc(&diriter->path, '/');
+		git_str_putc(&diriter->path, '/');
 
-	git_buf_put(&diriter->path, filename, filename_len);
+	git_str_put(&diriter->path, filename, filename_len);
 
-	if (git_buf_oom(&diriter->path))
+	if (git_str_oom(&diriter->path))
 		return -1;
 
 	return error;
 }
 
-int git_path_diriter_filename(
+int git_fs_path_diriter_filename(
 	const char **out,
 	size_t *out_len,
-	git_path_diriter *diriter)
+	git_fs_path_diriter *diriter)
 {
 	GIT_ASSERT_ARG(out);
 	GIT_ASSERT_ARG(out_len);
@@ -1448,10 +1457,10 @@ int git_path_diriter_filename(
 	return 0;
 }
 
-int git_path_diriter_fullpath(
+int git_fs_path_diriter_fullpath(
 	const char **out,
 	size_t *out_len,
-	git_path_diriter *diriter)
+	git_fs_path_diriter *diriter)
 {
 	GIT_ASSERT_ARG(out);
 	GIT_ASSERT_ARG(out_len);
@@ -1462,15 +1471,15 @@ int git_path_diriter_fullpath(
 	return 0;
 }
 
-int git_path_diriter_stat(struct stat *out, git_path_diriter *diriter)
+int git_fs_path_diriter_stat(struct stat *out, git_fs_path_diriter *diriter)
 {
 	GIT_ASSERT_ARG(out);
 	GIT_ASSERT_ARG(diriter);
 
-	return git_path_lstat(diriter->path.ptr, out);
+	return git_fs_path_lstat(diriter->path.ptr, out);
 }
 
-void git_path_diriter_free(git_path_diriter *diriter)
+void git_fs_path_diriter_free(git_fs_path_diriter *diriter)
 {
 	if (diriter == NULL)
 		return;
@@ -1481,21 +1490,21 @@ void git_path_diriter_free(git_path_diriter *diriter)
 	}
 
 #ifdef GIT_USE_ICONV
-	git_path_iconv_clear(&diriter->ic);
+	git_fs_path_iconv_clear(&diriter->ic);
 #endif
 
-	git_buf_dispose(&diriter->path);
+	git_str_dispose(&diriter->path);
 }
 
 #endif
 
-int git_path_dirload(
+int git_fs_path_dirload(
 	git_vector *contents,
 	const char *path,
 	size_t prefix_len,
 	uint32_t flags)
 {
-	git_path_diriter iter = GIT_PATH_DIRITER_INIT;
+	git_fs_path_diriter iter = GIT_FS_PATH_DIRITER_INIT;
 	const char *name;
 	size_t name_len;
 	char *dup;
@@ -1504,11 +1513,11 @@ int git_path_dirload(
 	GIT_ASSERT_ARG(contents);
 	GIT_ASSERT_ARG(path);
 
-	if ((error = git_path_diriter_init(&iter, path, flags)) < 0)
+	if ((error = git_fs_path_diriter_init(&iter, path, flags)) < 0)
 		return error;
 
-	while ((error = git_path_diriter_next(&iter)) == 0) {
-		if ((error = git_path_diriter_fullpath(&name, &name_len, &iter)) < 0)
+	while ((error = git_fs_path_diriter_next(&iter)) == 0) {
+		if ((error = git_fs_path_diriter_fullpath(&name, &name_len, &iter)) < 0)
 			break;
 
 		GIT_ASSERT(name_len > prefix_len);
@@ -1523,22 +1532,22 @@ int git_path_dirload(
 	if (error == GIT_ITEROVER)
 		error = 0;
 
-	git_path_diriter_free(&iter);
+	git_fs_path_diriter_free(&iter);
 	return error;
 }
 
-int git_path_from_url_or_path(git_buf *local_path_out, const char *url_or_path)
+int git_fs_path_from_url_or_path(git_str *local_path_out, const char *url_or_path)
 {
-	if (git_path_is_local_file_url(url_or_path))
-		return git_path_fromurl(local_path_out, url_or_path);
+	if (git_fs_path_is_local_file_url(url_or_path))
+		return git_fs_path_fromurl(local_path_out, url_or_path);
 	else
-		return git_buf_sets(local_path_out, url_or_path);
+		return git_str_sets(local_path_out, url_or_path);
 }
 
 /* Reject paths like AUX or COM1, or those versions that end in a dot or
  * colon.  ("AUX." or "AUX:")
  */
-GIT_INLINE(bool) verify_dospath(
+GIT_INLINE(bool) validate_dospath(
 	const char *component,
 	size_t len,
 	const char dospath[3],
@@ -1557,180 +1566,15 @@ GIT_INLINE(bool) verify_dospath(
 		component[last] != ':');
 }
 
-static int32_t next_hfs_char(const char **in, size_t *len)
-{
-	while (*len) {
-		uint32_t codepoint;
-		int cp_len = git_utf8_iterate(&codepoint, *in, *len);
-		if (cp_len < 0)
-			return -1;
-
-		(*in) += cp_len;
-		(*len) -= cp_len;
-
-		/* these code points are ignored completely */
-		switch (codepoint) {
-		case 0x200c: /* ZERO WIDTH NON-JOINER */
-		case 0x200d: /* ZERO WIDTH JOINER */
-		case 0x200e: /* LEFT-TO-RIGHT MARK */
-		case 0x200f: /* RIGHT-TO-LEFT MARK */
-		case 0x202a: /* LEFT-TO-RIGHT EMBEDDING */
-		case 0x202b: /* RIGHT-TO-LEFT EMBEDDING */
-		case 0x202c: /* POP DIRECTIONAL FORMATTING */
-		case 0x202d: /* LEFT-TO-RIGHT OVERRIDE */
-		case 0x202e: /* RIGHT-TO-LEFT OVERRIDE */
-		case 0x206a: /* INHIBIT SYMMETRIC SWAPPING */
-		case 0x206b: /* ACTIVATE SYMMETRIC SWAPPING */
-		case 0x206c: /* INHIBIT ARABIC FORM SHAPING */
-		case 0x206d: /* ACTIVATE ARABIC FORM SHAPING */
-		case 0x206e: /* NATIONAL DIGIT SHAPES */
-		case 0x206f: /* NOMINAL DIGIT SHAPES */
-		case 0xfeff: /* ZERO WIDTH NO-BREAK SPACE */
-			continue;
-		}
-
-		/* fold into lowercase -- this will only fold characters in
-		 * the ASCII range, which is perfectly fine, because the
-		 * git folder name can only be composed of ascii characters
-		 */
-		return git__tolower((int)codepoint);
-	}
-	return 0; /* NULL byte -- end of string */
-}
-
-static bool verify_dotgit_hfs_generic(const char *path, size_t len, const char *needle, size_t needle_len)
-{
-	size_t i;
-	char c;
-
-	if (next_hfs_char(&path, &len) != '.')
-		return true;
-
-	for (i = 0; i < needle_len; i++) {
-		c = next_hfs_char(&path, &len);
-		if (c != needle[i])
-			return true;
-	}
-
-	if (next_hfs_char(&path, &len) != '\0')
-		return true;
-
-	return false;
-}
-
-static bool verify_dotgit_hfs(const char *path, size_t len)
-{
-	return verify_dotgit_hfs_generic(path, len, "git", CONST_STRLEN("git"));
-}
-
-GIT_INLINE(bool) verify_dotgit_ntfs(git_repository *repo, const char *path, size_t len)
-{
-	git_buf *reserved = git_repository__reserved_names_win32;
-	size_t reserved_len = git_repository__reserved_names_win32_len;
-	size_t start = 0, i;
-
-	if (repo)
-		git_repository__reserved_names(&reserved, &reserved_len, repo, true);
-
-	for (i = 0; i < reserved_len; i++) {
-		git_buf *r = &reserved[i];
-
-		if (len >= r->size &&
-			strncasecmp(path, r->ptr, r->size) == 0) {
-			start = r->size;
-			break;
-		}
-	}
-
-	if (!start)
-		return true;
-
-	/*
-	 * Reject paths that start with Windows-style directory separators
-	 * (".git\") or NTFS alternate streams (".git:") and could be used
-	 * to write to the ".git" directory on Windows platforms.
-	 */
-	if (path[start] == '\\' || path[start] == ':')
-		return false;
-
-	/* Reject paths like '.git ' or '.git.' */
-	for (i = start; i < len; i++) {
-		if (path[i] != ' ' && path[i] != '.')
-			return true;
-	}
-
-	return false;
-}
-
-/*
- * Windows paths that end with spaces and/or dots are elided to the
- * path without them for backward compatibility.  That is to say
- * that opening file "foo ", "foo." or even "foo . . ." will all
- * map to a filename of "foo".  This function identifies spaces and
- * dots at the end of a filename, whether the proper end of the
- * filename (end of string) or a colon (which would indicate a
- * Windows alternate data stream.)
- */
-GIT_INLINE(bool) ntfs_end_of_filename(const char *path)
-{
-	const char *c = path;
-
-	for (;; c++) {
-		if (*c == '\0' || *c == ':')
-			return true;
-		if (*c != ' ' && *c != '.')
-			return false;
-	}
-
-	return true;
-}
-
-GIT_INLINE(bool) verify_dotgit_ntfs_generic(const char *name, size_t len, const char *dotgit_name, size_t dotgit_len, const char *shortname_pfix)
-{
-	int i, saw_tilde;
-
-	if (name[0] == '.' && len >= dotgit_len &&
-	    !strncasecmp(name + 1, dotgit_name, dotgit_len)) {
-		return !ntfs_end_of_filename(name + dotgit_len + 1);
-	}
-
-	/* Detect the basic NTFS shortname with the first six chars */
-	if (!strncasecmp(name, dotgit_name, 6) && name[6] == '~' &&
-	    name[7] >= '1' && name[7] <= '4')
-		return !ntfs_end_of_filename(name + 8);
-
-	/* Catch fallback names */
-	for (i = 0, saw_tilde = 0; i < 8; i++) {
-		if (name[i] == '\0') {
-			return true;
-		} else if (saw_tilde) {
-			if (name[i] < '0' || name[i] > '9')
-				return true;
-		} else if (name[i] == '~') {
-			if (name[i+1] < '1' || name[i+1]  > '9')
-				return true;
-			saw_tilde = 1;
-		} else if (i >= 6) {
-			return true;
-		} else if ((unsigned char)name[i] > 127) {
-			return true;
-		} else if (git__tolower(name[i]) != shortname_pfix[i]) {
-			return true;
-		}
-	}
-
-	return !ntfs_end_of_filename(name + i);
-}
-
-GIT_INLINE(bool) verify_char(unsigned char c, unsigned int flags)
+GIT_INLINE(bool) validate_char(unsigned char c, unsigned int flags)
 {
-	if ((flags & GIT_PATH_REJECT_BACKSLASH) && c == '\\')
+	if ((flags & GIT_FS_PATH_REJECT_BACKSLASH) && c == '\\')
 		return false;
 
-	if ((flags & GIT_PATH_REJECT_SLASH) && c == '/')
+	if ((flags & GIT_FS_PATH_REJECT_SLASH) && c == '/')
 		return false;
 
-	if (flags & GIT_PATH_REJECT_NT_CHARS) {
+	if (flags & GIT_FS_PATH_REJECT_NT_CHARS) {
 		if (c < 32)
 			return false;
 
@@ -1749,211 +1593,166 @@ GIT_INLINE(bool) verify_char(unsigned char c, unsigned int flags)
 	return true;
 }
 
-/*
- * Return the length of the common prefix between str and prefix, comparing them
- * case-insensitively (must be ASCII to match).
- */
-GIT_INLINE(size_t) common_prefix_icase(const char *str, size_t len, const char *prefix)
-{
-	size_t count = 0;
-
-	while (len >0 && tolower(*str) == tolower(*prefix)) {
-		count++;
-		str++;
-		prefix++;
-		len--;
-	}
-
-	return count;
-}
-
 /*
  * We fundamentally don't like some paths when dealing with user-inputted
- * strings (in checkout or ref names): we don't want dot or dot-dot
+ * strings (to avoid escaping a sandbox): we don't want dot or dot-dot
  * anywhere, we want to avoid writing weird paths on Windows that can't
  * be handled by tools that use the non-\\?\ APIs, we don't want slashes
  * or double slashes at the end of paths that can make them ambiguous.
  *
  * For checkout, we don't want to recurse into ".git" either.
  */
-static bool verify_component(
-	git_repository *repo,
+static bool validate_component(
 	const char *component,
 	size_t len,
-	uint16_t mode,
 	unsigned int flags)
 {
 	if (len == 0)
-		return false;
+		return !(flags & GIT_FS_PATH_REJECT_EMPTY_COMPONENT);
 
-	if ((flags & GIT_PATH_REJECT_TRAVERSAL) &&
-		len == 1 && component[0] == '.')
+	if ((flags & GIT_FS_PATH_REJECT_TRAVERSAL) &&
+	    len == 1 && component[0] == '.')
 		return false;
 
-	if ((flags & GIT_PATH_REJECT_TRAVERSAL) &&
-		len == 2 && component[0] == '.' && component[1] == '.')
+	if ((flags & GIT_FS_PATH_REJECT_TRAVERSAL) &&
+	    len == 2 && component[0] == '.' && component[1] == '.')
 		return false;
 
-	if ((flags & GIT_PATH_REJECT_TRAILING_DOT) && component[len-1] == '.')
+	if ((flags & GIT_FS_PATH_REJECT_TRAILING_DOT) &&
+	    component[len - 1] == '.')
 		return false;
 
-	if ((flags & GIT_PATH_REJECT_TRAILING_SPACE) && component[len-1] == ' ')
+	if ((flags & GIT_FS_PATH_REJECT_TRAILING_SPACE) &&
+	    component[len - 1] == ' ')
 		return false;
 
-	if ((flags & GIT_PATH_REJECT_TRAILING_COLON) && component[len-1] == ':')
+	if ((flags & GIT_FS_PATH_REJECT_TRAILING_COLON) &&
+	    component[len - 1] == ':')
 		return false;
 
-	if (flags & GIT_PATH_REJECT_DOS_PATHS) {
-		if (!verify_dospath(component, len, "CON", false) ||
-			!verify_dospath(component, len, "PRN", false) ||
-			!verify_dospath(component, len, "AUX", false) ||
-			!verify_dospath(component, len, "NUL", false) ||
-			!verify_dospath(component, len, "COM", true)  ||
-			!verify_dospath(component, len, "LPT", true))
-			return false;
-	}
-
-	if (flags & GIT_PATH_REJECT_DOT_GIT_HFS) {
-		if (!verify_dotgit_hfs(component, len))
-			return false;
-		if (S_ISLNK(mode) && git_path_is_gitfile(component, len, GIT_PATH_GITFILE_GITMODULES, GIT_PATH_FS_HFS))
+	if (flags & GIT_FS_PATH_REJECT_DOS_PATHS) {
+		if (!validate_dospath(component, len, "CON", false) ||
+		    !validate_dospath(component, len, "PRN", false) ||
+		    !validate_dospath(component, len, "AUX", false) ||
+		    !validate_dospath(component, len, "NUL", false) ||
+		    !validate_dospath(component, len, "COM", true)  ||
+		    !validate_dospath(component, len, "LPT", true))
 			return false;
 	}
 
-	if (flags & GIT_PATH_REJECT_DOT_GIT_NTFS) {
-		if (!verify_dotgit_ntfs(repo, component, len))
-			return false;
-		if (S_ISLNK(mode) && git_path_is_gitfile(component, len, GIT_PATH_GITFILE_GITMODULES, GIT_PATH_FS_NTFS))
-			return false;
-	}
-
-	/* don't bother rerunning the `.git` test if we ran the HFS or NTFS
-	 * specific tests, they would have already rejected `.git`.
-	 */
-	if ((flags & GIT_PATH_REJECT_DOT_GIT_HFS) == 0 &&
-	    (flags & GIT_PATH_REJECT_DOT_GIT_NTFS) == 0 &&
-	    (flags & GIT_PATH_REJECT_DOT_GIT_LITERAL)) {
-		if (len >= 4 &&
-		    component[0] == '.' &&
-		    (component[1] == 'g' || component[1] == 'G') &&
-		    (component[2] == 'i' || component[2] == 'I') &&
-		    (component[3] == 't' || component[3] == 'T')) {
-			if (len == 4)
-				return false;
-
-			if (S_ISLNK(mode) && common_prefix_icase(component, len, ".gitmodules") == len)
-				return false;
-		}
-	    }
-
 	return true;
 }
 
-GIT_INLINE(unsigned int) dotgit_flags(
-	git_repository *repo,
-	unsigned int flags)
+#ifdef GIT_WIN32
+GIT_INLINE(bool) validate_length(
+	const char *path,
+	size_t len,
+	size_t utf8_char_len)
 {
-	int protectHFS = 0, protectNTFS = 1;
-	int error = 0;
-
-	flags |= GIT_PATH_REJECT_DOT_GIT_LITERAL;
+	GIT_UNUSED(path);
+	GIT_UNUSED(len);
 
-#ifdef __APPLE__
-	protectHFS = 1;
+	return (utf8_char_len <= MAX_PATH);
+}
 #endif
 
-	if (repo && !protectHFS)
-		error = git_repository__configmap_lookup(&protectHFS, repo, GIT_CONFIGMAP_PROTECTHFS);
-	if (!error && protectHFS)
-		flags |= GIT_PATH_REJECT_DOT_GIT_HFS;
+bool git_fs_path_str_is_valid_ext(
+	const git_str *path,
+	unsigned int flags,
+	bool (*validate_char_cb)(char ch, void *payload),
+	bool (*validate_component_cb)(const char *component, size_t len, void *payload),
+	bool (*validate_length_cb)(const char *path, size_t len, size_t utf8_char_len),
+	void *payload)
+{
+	const char *start, *c;
+	size_t len = 0;
 
-	if (repo)
-		error = git_repository__configmap_lookup(&protectNTFS, repo, GIT_CONFIGMAP_PROTECTNTFS);
-	if (!error && protectNTFS)
-		flags |= GIT_PATH_REJECT_DOT_GIT_NTFS;
+	if (!flags)
+		return true;
 
-	return flags;
-}
+	for (start = c = path->ptr; *c && len < path->size; c++, len++) {
+		if (!validate_char(*c, flags))
+			return false;
 
-bool git_path_validate(
-	git_repository *repo,
-	const char *path,
-	uint16_t mode,
-	unsigned int flags)
-{
-	const char *start, *c;
+		if (validate_char_cb && !validate_char_cb(*c, payload))
+			return false;
 
-	/* Upgrade the ".git" checks based on platform */
-	if ((flags & GIT_PATH_REJECT_DOT_GIT))
-		flags = dotgit_flags(repo, flags);
+		if (*c != '/')
+			continue;
 
-	for (start = c = path; *c; c++) {
-		if (!verify_char(*c, flags))
+		if (!validate_component(start, (c - start), flags))
 			return false;
 
-		if (*c == '/') {
-			if (!verify_component(repo, start, (c - start), mode, flags))
-				return false;
+		if (validate_component_cb &&
+		    !validate_component_cb(start, (c - start), payload))
+			return false;
 
-			start = c+1;
-		}
+		start = c + 1;
 	}
 
-	return verify_component(repo, start, (c - start), mode, flags);
-}
+	/*
+	 * We want to support paths specified as either `const char *`
+	 * or `git_str *`; we pass size as `SIZE_MAX` when we use a
+	 * `const char *` to avoid a `strlen`.  Ensure that we didn't
+	 * have a NUL in the buffer if there was a non-SIZE_MAX length.
+	 */
+	if (path->size != SIZE_MAX && len != path->size)
+		return false;
 
-#ifdef GIT_WIN32
-GIT_INLINE(bool) should_validate_longpaths(git_repository *repo)
-{
-	int longpaths = 0;
+	if (!validate_component(start, (c - start), flags))
+		return false;
 
-	if (repo &&
-	    git_repository__configmap_lookup(&longpaths, repo, GIT_CONFIGMAP_LONGPATHS) < 0)
-		longpaths = 0;
+	if (validate_component_cb &&
+	    !validate_component_cb(start, (c - start), payload))
+		return false;
 
-	return (longpaths == 0);
-}
+#ifdef GIT_WIN32
+	if ((flags & GIT_FS_PATH_REJECT_LONG_PATHS) != 0) {
+		size_t utf8_len = git_utf8_char_length(path->ptr, len);
 
-#else
+		if (!validate_length(path->ptr, len, utf8_len))
+			return false;
 
-GIT_INLINE(bool) should_validate_longpaths(git_repository *repo)
-{
-	GIT_UNUSED(repo);
+		if (validate_length_cb &&
+		    !validate_length_cb(path->ptr, len, utf8_len))
+			return false;
+	}
+#else
+	GIT_UNUSED(validate_length_cb);
+#endif
 
-	return false;
+	return true;
 }
-#endif
 
-int git_path_validate_workdir(git_repository *repo, const char *path)
+int git_fs_path_validate_str_length_with_suffix(
+	git_str *path,
+	size_t suffix_len)
 {
-	if (should_validate_longpaths(repo))
-		return git_path_validate_filesystem(path, strlen(path));
+#ifdef GIT_WIN32
+	size_t utf8_len = git_utf8_char_length(path->ptr, path->size);
+	size_t total_len;
 
-	return 0;
-}
+	if (GIT_ADD_SIZET_OVERFLOW(&total_len, utf8_len, suffix_len) ||
+	    total_len > MAX_PATH) {
 
-int git_path_validate_workdir_with_len(
-	git_repository *repo,
-	const char *path,
-	size_t path_len)
-{
-	if (should_validate_longpaths(repo))
-		return git_path_validate_filesystem(path, path_len);
+		git_error_set(GIT_ERROR_FILESYSTEM, "path too long: '%.*s'",
+			(int)path->size, path->ptr);
+		return -1;
+	}
+#else
+	GIT_UNUSED(path);
+	GIT_UNUSED(suffix_len);
+#endif
 
 	return 0;
 }
 
-int git_path_validate_workdir_buf(git_repository *repo, git_buf *path)
-{
-	return git_path_validate_workdir_with_len(repo, path->ptr, path->size);
-}
-
-int git_path_normalize_slashes(git_buf *out, const char *path)
+int git_fs_path_normalize_slashes(git_str *out, const char *path)
 {
 	int error;
 	char *p;
 
-	if ((error = git_buf_puts(out, path)) < 0)
+	if ((error = git_str_puts(out, path)) < 0)
 		return error;
 
 	for (p = out->ptr; *p; p++) {
@@ -1964,47 +1763,9 @@ int git_path_normalize_slashes(git_buf *out, const char *path)
 	return 0;
 }
 
-static const struct {
-	const char *file;
-	const char *hash;
-	size_t filelen;
-} gitfiles[] = {
-	{ "gitignore", "gi250a", CONST_STRLEN("gitignore") },
-	{ "gitmodules", "gi7eba", CONST_STRLEN("gitmodules") },
-	{ "gitattributes", "gi7d29", CONST_STRLEN("gitattributes") }
-};
-
-extern int git_path_is_gitfile(const char *path, size_t pathlen, git_path_gitfile gitfile, git_path_fs fs)
-{
-	const char *file, *hash;
-	size_t filelen;
-
-	if (!(gitfile >= GIT_PATH_GITFILE_GITIGNORE && gitfile < ARRAY_SIZE(gitfiles))) {
-		git_error_set(GIT_ERROR_OS, "invalid gitfile for path validation");
-		return -1;
-	}
-
-	file = gitfiles[gitfile].file;
-	filelen = gitfiles[gitfile].filelen;
-	hash = gitfiles[gitfile].hash;
-
-	switch (fs) {
-	case GIT_PATH_FS_GENERIC:
-		return !verify_dotgit_ntfs_generic(path, pathlen, file, filelen, hash) ||
-		       !verify_dotgit_hfs_generic(path, pathlen, file, filelen);
-	case GIT_PATH_FS_NTFS:
-		return !verify_dotgit_ntfs_generic(path, pathlen, file, filelen, hash);
-	case GIT_PATH_FS_HFS:
-		return !verify_dotgit_hfs_generic(path, pathlen, file, filelen);
-	default:
-		git_error_set(GIT_ERROR_OS, "invalid filesystem for path validation");
-		return -1;
-	}
-}
-
-bool git_path_supports_symlinks(const char *dir)
+bool git_fs_path_supports_symlinks(const char *dir)
 {
-	git_buf path = GIT_BUF_INIT;
+	git_str path = GIT_STR_INIT;
 	bool supported = false;
 	struct stat st;
 	int fd;
@@ -2020,82 +1781,286 @@ bool git_path_supports_symlinks(const char *dir)
 done:
 	if (path.size)
 		(void)p_unlink(path.ptr);
-	git_buf_dispose(&path);
+	git_str_dispose(&path);
 	return supported;
 }
 
-int git_path_validate_system_file_ownership(const char *path)
+static git_fs_path_owner_t mock_owner = GIT_FS_PATH_OWNER_NONE;
+
+void git_fs_path__set_owner(git_fs_path_owner_t owner)
+{
+	mock_owner = owner;
+}
+
+#ifdef GIT_WIN32
+static PSID *sid_dup(PSID sid)
+{
+	DWORD len;
+	PSID dup;
+
+	len = GetLengthSid(sid);
+
+	if ((dup = git__malloc(len)) == NULL)
+		return NULL;
+
+	if (!CopySid(len, dup, sid)) {
+		git_error_set(GIT_ERROR_OS, "could not duplicate sid");
+		git__free(dup);
+		return NULL;
+	}
+
+	return dup;
+}
+
+static int current_user_sid(PSID *out)
 {
-#ifndef GIT_WIN32
-	GIT_UNUSED(path);
-	return GIT_OK;
-#else
-	git_win32_path buf;
-	PSID owner_sid;
-	PSECURITY_DESCRIPTOR descriptor = NULL;
-	HANDLE token;
 	TOKEN_USER *info = NULL;
-	DWORD err, len;
-	int ret;
+	HANDLE token = NULL;
+	DWORD len = 0;
+	int error = -1;
 
-	if (git_win32_path_from_utf8(buf, path) < 0)
-		return -1;
+	if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &token)) {
+		git_error_set(GIT_ERROR_OS, "could not lookup process information");
+		goto done;
+	}
+
+	if (GetTokenInformation(token, TokenUser, NULL, 0, &len) ||
+		GetLastError() != ERROR_INSUFFICIENT_BUFFER) {
+		git_error_set(GIT_ERROR_OS, "could not lookup token metadata");
+		goto done;
+	}
 
-	err = GetNamedSecurityInfoW(buf, SE_FILE_OBJECT,
-				    OWNER_SECURITY_INFORMATION |
-					    DACL_SECURITY_INFORMATION,
-				    &owner_sid, NULL, NULL, NULL, &descriptor);
+	info = git__malloc(len);
+	GIT_ERROR_CHECK_ALLOC(info);
 
-	if (err == ERROR_FILE_NOT_FOUND || err == ERROR_PATH_NOT_FOUND) {
-		ret = GIT_ENOTFOUND;
-		goto cleanup;
+	if (!GetTokenInformation(token, TokenUser, info, len, &len)) {
+		git_error_set(GIT_ERROR_OS, "could not lookup current user");
+		goto done;
 	}
 
-	if (err != ERROR_SUCCESS) {
+	if ((*out = sid_dup(info->User.Sid)))
+		error = 0;
+
+done:
+	if (token)
+		CloseHandle(token);
+
+	git__free(info);
+	return error;
+}
+
+static int file_owner_sid(PSID *out, const char *path)
+{
+	git_win32_path path_w32;
+	PSECURITY_DESCRIPTOR descriptor = NULL;
+	PSID owner_sid;
+	DWORD ret;
+	int error = GIT_EINVALID;
+
+	if (git_win32_path_from_utf8(path_w32, path) < 0)
+		return -1;
+
+	ret = GetNamedSecurityInfoW(path_w32, SE_FILE_OBJECT,
+		OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
+		&owner_sid, NULL, NULL, NULL, &descriptor);
+
+	if (ret == ERROR_FILE_NOT_FOUND || ret == ERROR_PATH_NOT_FOUND)
+		error = GIT_ENOTFOUND;
+	else if (ret != ERROR_SUCCESS)
 		git_error_set(GIT_ERROR_OS, "failed to get security information");
-		ret = GIT_ERROR;
-		goto cleanup;
+	else if (!IsValidSid(owner_sid))
+		git_error_set(GIT_ERROR_OS, "file owner is not valid");
+	else if ((*out = sid_dup(owner_sid)))
+		error = 0;
+
+	if (descriptor)
+		LocalFree(descriptor);
+
+	return error;
+}
+
+int git_fs_path_owner_is(
+	bool *out,
+	const char *path,
+	git_fs_path_owner_t owner_type)
+{
+	PSID owner_sid = NULL, user_sid = NULL;
+	BOOL is_admin, admin_owned;
+	int error;
+
+	if (mock_owner) {
+		*out = ((mock_owner & owner_type) != 0);
+		return 0;
 	}
 
-	if (!IsValidSid(owner_sid)) {
-		git_error_set(GIT_ERROR_INVALID, "programdata configuration file owner is unknown");
-		ret = GIT_ERROR;
-		goto cleanup;
+	if ((error = file_owner_sid(&owner_sid, path)) < 0)
+		goto done;
+
+	if ((owner_type & GIT_FS_PATH_OWNER_CURRENT_USER) != 0) {
+		if ((error = current_user_sid(&user_sid)) < 0)
+			goto done;
+
+		if (EqualSid(owner_sid, user_sid)) {
+			*out = true;
+			goto done;
+		}
 	}
 
-	if (IsWellKnownSid(owner_sid, WinBuiltinAdministratorsSid) ||
-	    IsWellKnownSid(owner_sid, WinLocalSystemSid)) {
-		ret = GIT_OK;
-		goto cleanup;
+	admin_owned =
+		IsWellKnownSid(owner_sid, WinBuiltinAdministratorsSid) ||
+		IsWellKnownSid(owner_sid, WinLocalSystemSid);
+
+	if (admin_owned &&
+	    (owner_type & GIT_FS_PATH_OWNER_ADMINISTRATOR) != 0) {
+		*out = true;
+		goto done;
 	}
 
-	/* Obtain current user's SID */
-	if (OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &token) &&
-	    !GetTokenInformation(token, TokenUser, NULL, 0, &len)) {
-		info = git__malloc(len);
-		GIT_ERROR_CHECK_ALLOC(info);
-		if (!GetTokenInformation(token, TokenUser, info, len, &len)) {
-			git__free(info);
-			info = NULL;
-		}
+	if (admin_owned &&
+	    (owner_type & GIT_FS_PATH_USER_IS_ADMINISTRATOR) != 0 &&
+	    CheckTokenMembership(NULL, owner_sid, &is_admin) &&
+	    is_admin) {
+		*out = true;
+		goto done;
 	}
 
-	/*
-	 * If the file is owned by the same account that is running the current
-	 * process, it's okay to read from that file.
-	 */
-	if (info && EqualSid(owner_sid, info->User.Sid))
-		ret = GIT_OK;
-	else {
-		git_error_set(GIT_ERROR_INVALID, "programdata configuration file owner is not valid");
-		ret = GIT_ERROR;
+	*out = false;
+
+done:
+	git__free(owner_sid);
+	git__free(user_sid);
+	return error;
+}
+
+#else
+
+static int sudo_uid_lookup(uid_t *out)
+{
+	git_str uid_str = GIT_STR_INIT;
+	int64_t uid;
+	int error;
+
+	if ((error = git__getenv(&uid_str, "SUDO_UID")) == 0 &&
+	    (error = git__strntol64(&uid, uid_str.ptr, uid_str.size, NULL, 10)) == 0 &&
+	    uid == (int64_t)((uid_t)uid)) {
+		*out = (uid_t)uid;
 	}
-	git__free(info);
 
-cleanup:
-	if (descriptor)
-		LocalFree(descriptor);
+	git_str_dispose(&uid_str);
+	return error;
+}
+
+int git_fs_path_owner_is(
+	bool *out,
+	const char *path,
+	git_fs_path_owner_t owner_type)
+{
+	struct stat st;
+	uid_t euid, sudo_uid;
+
+	if (mock_owner) {
+		*out = ((mock_owner & owner_type) != 0);
+		return 0;
+	}
+
+	euid = geteuid();
+
+	if (p_lstat(path, &st) != 0) {
+		if (errno == ENOENT)
+			return GIT_ENOTFOUND;
+
+		git_error_set(GIT_ERROR_OS, "could not stat '%s'", path);
+		return -1;
+	}
+
+	if ((owner_type & GIT_FS_PATH_OWNER_CURRENT_USER) != 0 &&
+	    st.st_uid == euid) {
+		*out = true;
+		return 0;
+	}
+
+	if ((owner_type & GIT_FS_PATH_OWNER_ADMINISTRATOR) != 0 &&
+	    st.st_uid == 0) {
+		*out = true;
+		return 0;
+	}
+
+	if ((owner_type & GIT_FS_PATH_OWNER_RUNNING_SUDO) != 0 &&
+	    euid == 0 &&
+	    sudo_uid_lookup(&sudo_uid) == 0 &&
+	    st.st_uid == sudo_uid) {
+		*out = true;
+		return 0;
+	}
+
+	*out = false;
+	return 0;
+}
+
+#endif
+
+int git_fs_path_owner_is_current_user(bool *out, const char *path)
+{
+	return git_fs_path_owner_is(out, path, GIT_FS_PATH_OWNER_CURRENT_USER);
+}
+
+int git_fs_path_owner_is_system(bool *out, const char *path)
+{
+	return git_fs_path_owner_is(out, path, GIT_FS_PATH_OWNER_ADMINISTRATOR);
+}
+
+int git_fs_path_find_executable(git_str *fullpath, const char *executable)
+{
+#ifdef GIT_WIN32
+	git_win32_path fullpath_w, executable_w;
+	int error;
+
+	if (git__utf8_to_16(executable_w, GIT_WIN_PATH_MAX, executable) < 0)
+		return -1;
+
+	error = git_win32_path_find_executable(fullpath_w, executable_w);
+
+	if (error == 0)
+		error = git_str_put_w(fullpath, fullpath_w, wcslen(fullpath_w));
+
+	return error;
+#else
+	git_str path = GIT_STR_INIT;
+	const char *current_dir, *term;
+	bool found = false;
+
+	if (git__getenv(&path, "PATH") < 0)
+		return -1;
+
+	current_dir = path.ptr;
+
+	while (*current_dir) {
+		if (! (term = strchr(current_dir, GIT_PATH_LIST_SEPARATOR)))
+			term = strchr(current_dir, '\0');
+
+		git_str_clear(fullpath);
+		if (git_str_put(fullpath, current_dir, (term - current_dir)) < 0 ||
+		    git_str_putc(fullpath, '/') < 0 ||
+		    git_str_puts(fullpath, executable) < 0)
+			return -1;
+
+		if (git_fs_path_isfile(fullpath->ptr)) {
+			found = true;
+			break;
+		}
+
+		current_dir = term;
+
+		while (*current_dir == GIT_PATH_LIST_SEPARATOR)
+			current_dir++;
+	}
+
+	git_str_dispose(&path);
+
+	if (found)
+		return 0;
 
-	return ret;
+	git_str_clear(fullpath);
+	return GIT_ENOTFOUND;
 #endif
 }