thodg/got

diff --git a/got/got.c b/got/got.c
index f2810cc..755f467 100644
--- a/got/got.c
+++ b/got/got.c
@@ -314,8 +314,8 @@ cmd_checkout(int argc, char *argv[])
 	argv += optind;
 
 #ifndef PROFILE
-	if (pledge("stdio rpath wpath cpath flock proc exec sendfd unveil",
-	    NULL) == -1)
+	if (pledge("stdio rpath wpath cpath fattr flock proc exec sendfd "
+	    "unveil", NULL) == -1)
 		err(1, "pledge");
 #endif
 	if (argc == 1) {
@@ -470,8 +470,8 @@ cmd_update(int argc, char *argv[])
 	argv += optind;
 
 #ifndef PROFILE
-	if (pledge("stdio rpath wpath cpath flock proc exec sendfd unveil",
-	    NULL) == -1)
+	if (pledge("stdio rpath wpath cpath fattr flock proc exec sendfd "
+	    "unveil", NULL) == -1)
 		err(1, "pledge");
 #endif
 	if (argc == 0) {
diff --git a/lib/worktree.c b/lib/worktree.c
index e5d3988..98fe111 100644
--- a/lib/worktree.c
+++ b/lib/worktree.c
@@ -605,7 +605,7 @@ done:
 static const struct got_error *
 merge_blob(struct got_worktree *worktree, struct got_fileindex *fileindex,
    struct got_fileindex_entry *ie, const char *ondisk_path, const char *path,
-   struct got_blob_object *blob1, struct got_repository *repo,
+   uint16_t mode, struct got_blob_object *blob1, struct got_repository *repo,
    got_worktree_checkout_cb progress_cb, void *progress_arg)
 {
 	const struct got_error *err = NULL;
@@ -693,7 +693,7 @@ done:
 static const struct got_error *
 install_blob(struct got_worktree *worktree, struct got_fileindex *fileindex,
    struct got_fileindex_entry *entry, const char *ondisk_path, const char *path,
-   struct got_blob_object *blob,
+   uint16_t mode, struct got_blob_object *blob,
    struct got_repository *repo, got_worktree_checkout_cb progress_cb,
    void *progress_arg)
 {
@@ -702,6 +702,7 @@ install_blob(struct got_worktree *worktree, struct got_fileindex *fileindex,
 	size_t len, hdrlen;
 	int update = 0;
 	char *tmppath = NULL;
+	struct stat sb;
 
 	fd = open(ondisk_path, O_RDWR | O_CREAT | O_EXCL | O_NOFOLLOW,
 	    GOT_DEFAULT_FILE_MODE);
@@ -719,7 +720,6 @@ install_blob(struct got_worktree *worktree, struct got_fileindex *fileindex,
 			if (fd == -1)
 				return got_error_from_errno();
 		} else if (errno == EEXIST) {
-			struct stat sb;
 			if (lstat(ondisk_path, &sb) == -1) {
 				err = got_error_from_errno();
 				goto done;
@@ -769,6 +769,16 @@ install_blob(struct got_worktree *worktree, struct got_fileindex *fileindex,
 			goto done;
 		}
 	}
+	if (mode & S_IRWXU) {
+		if (!update && lstat(ondisk_path, &sb) == -1) {
+			err = got_error_from_errno();
+			goto done;
+		}
+		if (chmod(ondisk_path, sb.st_mode | S_IRWXU) == -1) {
+			err = got_error_from_errno();
+			goto done;
+		}
+	}
 
 	if (entry == NULL)
 		entry = got_fileindex_entry_get(fileindex, path);
@@ -907,10 +917,10 @@ update_blob(struct got_worktree *worktree,
 
 	if (status == GOT_STATUS_MODIFY)
 		err = merge_blob(worktree, fileindex, ie, ondisk_path, path,
-		    blob, repo, progress_cb, progress_arg);
+		    te->mode, blob, repo, progress_cb, progress_arg);
 	else
 		err = install_blob(worktree, fileindex, ie, ondisk_path, path,
-		    blob, repo, progress_cb, progress_arg);
+		    te->mode, blob, repo, progress_cb, progress_arg);
 
 	got_object_blob_close(blob);
 done:
diff --git a/regress/cmdline/checkout.sh b/regress/cmdline/checkout.sh
index 15e1d04..a8b9cef 100755
--- a/regress/cmdline/checkout.sh
+++ b/regress/cmdline/checkout.sh
@@ -53,4 +53,40 @@ function test_checkout_basic {
 	test_done "$testroot" "$ret"
 }
 
+function test_checkout_sets_xbit {
+	local testroot=`test_init checkout_sets_xbit 1`
+
+	touch $testroot/repo/xfile
+	chmod +x $testroot/repo/xfile
+	(cd $testroot/repo && git add .)
+	git_commit $testroot/repo -m "adding executable file"
+
+	echo "A  $testroot/wt/xfile" > $testroot/stdout.expected
+	echo "Now shut up and hack" >> $testroot/stdout.expected
+
+	got checkout $testroot/repo $testroot/wt > $testroot/stdout
+	ret="$?"
+	if [ "$ret" != "0" ]; then
+		test_done "$testroot" "$ret"
+		return 1
+	fi
+
+	cmp $testroot/stdout.expected $testroot/stdout
+	ret="$?"
+	if [ "$ret" != "0" ]; then
+		diff -u $testroot/stdout.expected $testroot/stdout
+		test_done "$testroot" "$ret"
+		return 1
+	fi
+
+	ls -l $testroot/wt/xfile | grep -q '^-rwx'
+	ret="$?"
+	if [ "$ret" != "0" ]; then
+		echo "file is not executable" >&2
+		ls -l $testroot/wt/xfile >&2
+	fi
+	test_done "$testroot" "$ret"
+}
+
 run_test test_checkout_basic
+run_test test_checkout_sets_xbit
diff --git a/regress/cmdline/update.sh b/regress/cmdline/update.sh
index de6d765..bc2db08 100755
--- a/regress/cmdline/update.sh
+++ b/regress/cmdline/update.sh
@@ -682,6 +682,53 @@ function test_update_merges_file_edits {
 	test_done "$testroot" "$ret"
 }
 
+function test_update_keeps_xbit {
+	local testroot=`test_init update_keeps_xbit 1`
+
+	touch $testroot/repo/xfile
+	chmod +x $testroot/repo/xfile
+	(cd $testroot/repo && git add .)
+	git_commit $testroot/repo -m "adding executable file"
+
+	got checkout $testroot/repo $testroot/wt > $testroot/stdout
+	ret="$?"
+	if [ "$ret" != "0" ]; then
+		test_done "$testroot" "$ret"
+		return 1
+	fi
+
+	echo foo > $testroot/repo/xfile
+	git_commit $testroot/repo -m "changed executable file"
+
+	echo "U  xfile" > $testroot/stdout.expected
+	echo -n "Updated to commit " >> $testroot/stdout.expected
+	git_show_head $testroot/repo >> $testroot/stdout.expected
+	echo >> $testroot/stdout.expected
+
+	(cd $testroot/wt && got update > $testroot/stdout)
+	ret="$?"
+	if [ "$ret" != "0" ]; then
+		test_done "$testroot" "$ret"
+		return 1
+	fi
+
+	cmp $testroot/stdout.expected $testroot/stdout
+	ret="$?"
+	if [ "$ret" != "0" ]; then
+		diff -u $testroot/stdout.expected $testroot/stdout
+		test_done "$testroot" "$ret"
+		return 1
+	fi
+
+	ls -l $testroot/wt/xfile | grep -q '^-rwx'
+	ret="$?"
+	if [ "$ret" != "0" ]; then
+		echo "file is not executable" >&2
+		ls -l $testroot/wt/xfile >&2
+	fi
+	test_done "$testroot" "$ret"
+}
+
 run_test test_update_basic
 run_test test_update_adds_file
 run_test test_update_deletes_file
@@ -696,3 +743,4 @@ run_test test_update_creates_missing_parent
 run_test test_update_creates_missing_parent_with_subdir
 run_test test_update_file_in_subsubdir
 run_test test_update_merges_file_edits
+run_test test_update_keeps_xbit
diff --git a/regress/worktree/worktree_test.c b/regress/worktree/worktree_test.c
index 1c56479..238c089 100644
--- a/regress/worktree/worktree_test.c
+++ b/regress/worktree/worktree_test.c
@@ -400,8 +400,8 @@ main(int argc, char *argv[])
 	int ch;
 
 #ifndef PROFILE
-	if (pledge("stdio rpath wpath cpath flock proc exec sendfd unveil",
-	    NULL) == -1)
+	if (pledge("stdio rpath wpath cpath fattr flock proc exec sendfd "
+	    "unveil", NULL) == -1)
 		err(1, "pledge");
 #endif