diff --git a/.github/workflows/taskcluster.yml b/.github/workflows/taskcluster.yml
index 8fe8621ea..ecc9d5c19 100644
--- a/.github/workflows/taskcluster.yml
+++ b/.github/workflows/taskcluster.yml
@@ -12,6 +12,6 @@ jobs:
       - run: sudo -H python2.7 -m pip install pip==20.3.4 wheel==0.37.0 --upgrade
       - uses: actions/setup-python@v4
         with:
-          python-version: '3.9'
-      - run: sudo -H python3 -m pip install pip==20.3.4 wheel==0.37.0 --upgrade
+          python-version: '3.9.14'
+      - run: python3 -m pip install pip==20.3.4 wheel==0.37.0 --upgrade
       - run: CI/start-worker.sh worker-$TC_WORKER_TYPE $TC_WORKER_TYPE
diff --git a/CI/decision.py b/CI/decision.py
index 3f1245ea2..b99be00e0 100644
--- a/CI/decision.py
+++ b/CI/decision.py
@@ -1,3 +1,7 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
 import hashlib
 import json
 import os
@@ -412,8 +416,8 @@ def main():
                 merge_coverage,
                 [
                     'cd repo',
-                    'codecov --required --name "taskcluster" --commit {}'
-                    ' --branch {}'.format(TC_COMMIT, TC_BRANCH),
+                    'codecov -Z --name "taskcluster" -C {} -B {}'
+                    .format(TC_COMMIT, TC_BRANCH),
                 ],
             )),
         )
diff --git a/CI/docker.py b/CI/docker.py
index fb3a5c68f..7f0988336 100644
--- a/CI/docker.py
+++ b/CI/docker.py
@@ -1,3 +1,7 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
 import hashlib
 import json
 
@@ -166,7 +170,11 @@ def sources_list(snapshot, sections):
             ])),
             'apt-get clean',
             'ln -s /usr/bin/python3-coverage /usr/local/bin/coverage',
-            'python3 -m pip install codecov==2.1.12',
+            'curl -o /usr/local/bin/codecov -sL {}'.format(
+                'https://github.com/codecov/uploader/releases/download'
+                '/v0.1.0_9779/codecov-linux'
+            ),
+            'chmod +x /usr/local/bin/codecov',
             'curl -sL {} | tar -C /usr/local/bin -jxf -'.format(
                 'https://github.com/mozilla/grcov/releases/download/v0.8.7'
                 '/grcov-x86_64-unknown-linux-gnu.tar.bz2'
diff --git a/CI/filter.py b/CI/filter.py
new file mode 100644
index 000000000..3045ab487
--- /dev/null
+++ b/CI/filter.py
@@ -0,0 +1,60 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+import sys
+
+
+class DataCommand:
+    def __init__(self, data):
+        self.data = data
+
+    def write_to(self, out):
+        out.write(b"data %d\n" % len(self.data))
+        out.write(self.data)
+
+
+def iter_commands(input=sys.stdin.buffer):
+    for line in input:
+        if line.startswith(b"data "):
+            _, length = line.split()
+            length = int(length)
+            data = input.read(length)
+            assert len(data) == length
+            yield DataCommand(data)
+        else:
+            yield line
+
+
+def write_command(command, out=sys.stdout.buffer):
+    if isinstance(command, DataCommand):
+        command.write_to(out)
+    else:
+        out.write(command)
+
+
+if __name__ == "__main__":
+    args = sys.argv[1:]
+    for arg in args:
+        if arg not in ["--commits", "--roots"]:
+            print(f"Unsupported options: {args}")
+            sys.exit(1)
+
+    commands = iter_commands()
+    for command in commands:
+        if isinstance(command, DataCommand):
+            if "--commits" in args:
+                command.data += b"\n"
+            if "--roots" in args:
+                write_command(command)
+                while True:
+                    command = next(commands)
+                    # No "from" command, so this is a root, remove all the
+                    # files from it.
+                    if not command.startswith((b"deleteall", b"M ")):
+                        break
+
+        elif command.startswith((b"author  <", b"committer  <")):
+            cmd, email = command.split(b"<", 1)
+            command = cmd[:-1] + email.split(b"@", 1)[0] + b" <" + email
+        write_command(command)
diff --git a/CI/hg-serve-exec.py b/CI/hg-serve-exec.py
index 54dc77b5f..b6e26c3b7 100644
--- a/CI/hg-serve-exec.py
+++ b/CI/hg-serve-exec.py
@@ -1,3 +1,7 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
 from __future__ import print_function
 import base64
 import os
diff --git a/CI/msys.py b/CI/msys.py
index 02c1b99d1..7d980d9ff 100644
--- a/CI/msys.py
+++ b/CI/msys.py
@@ -1,3 +1,7 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
 import hashlib
 import re
 
diff --git a/CI/osx.py b/CI/osx.py
index 4030784f3..951fe32ad 100644
--- a/CI/osx.py
+++ b/CI/osx.py
@@ -1,3 +1,7 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
 import hashlib
 
 from tasks import (
diff --git a/CI/package.mk b/CI/package.mk
index 8e1fffa4d..f5c64e69b 100644
--- a/CI/package.mk
+++ b/CI/package.mk
@@ -1,3 +1,7 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
 TOPDIR = $(abspath $(or $(dir $(firstword $(MAKEFILE_LIST))),$(CURDIR))/..)
 
 ifeq (a,$(firstword a$(subst /, ,$(abspath .))))
diff --git a/CI/start-worker.sh b/CI/start-worker.sh
index 78af81f9d..ee1c8bf80 100755
--- a/CI/start-worker.sh
+++ b/CI/start-worker.sh
@@ -1,4 +1,7 @@
 #!/bin/sh
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 where=$(dirname $0)
 clientId=$1
diff --git a/CI/tasks.py b/CI/tasks.py
index 306e8e6cc..9de3b1e65 100644
--- a/CI/tasks.py
+++ b/CI/tasks.py
@@ -1,3 +1,7 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
 import base64
 import datetime
 import json
@@ -354,7 +358,7 @@ def file_format(url):
             elif k == 'dockerSave':
                 features = task['payload'].setdefault('features', {})
                 features[k] = bool(v)
-                artifact_paths.append('dockerImage.tar')
+                artifact_paths.append('public/dockerImage.tar')
             else:
                 raise Exception("Don't know how to handle {}".format(k))
         task['dependencies'] = sorted(dependencies)
diff --git a/CI/tests.mk b/CI/tests.mk
index 9888d24b9..73ce11aae 100644
--- a/CI/tests.mk
+++ b/CI/tests.mk
@@ -1,3 +1,7 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
 TOPDIR = $(abspath $(or $(dir $(firstword $(MAKEFILE_LIST))),$(CURDIR))/..)
 
 ifeq (a,$(firstword a$(subst /, ,$(abspath .))))
@@ -232,12 +236,11 @@ hg.graft.base.git hg.graft2.base.git: hg.upgraded.git hg.pure.hg
 	$(GIT) init $@
 	$(GIT) -C $@ remote add origin hg::$(PATH_URL)/$(word 2,$^)
 	$(GIT) -C $< push $(CURDIR)/$@ refs/remotes/*:refs/remotes/*
-	$(GIT) -C $@ checkout $$($(GIT) -C $< rev-parse HEAD)
 
 hg.graft.git: hg.graft.base.git hg.upgraded.git
 	cp -r $< $@
 	$(GIT) -C $@ cinnabar rollback 0000000000000000000000000000000000000000
-	$(GIT) -c user.email=foo@bar -C $@ filter-branch --msg-filter 'cat ; echo' --original original -- --all
+	$(GIT) -C $@ fast-export --no-data --all | python3 $(TOPDIR)/CI/filter.py --commits | git -c core.ignorecase=false -C $@ fast-import --force
 	$(GIT) -C $@ -c cinnabar.graft=true remote update
 	$(call COMPARE_REFS, $(word 2,$^), $@, XARGS_GIT2HG)
 	$(GIT) -C $@ cinnabar fsck --full
@@ -250,10 +253,10 @@ hg.graft2.git: hg.graft.git hg.pure.hg hg.graft2.base.git
 	$(call COMPARE_REFS, $<, $@)
 	$(GIT) -C $@ cinnabar fsck --full
 
-hg.graft.replace.git: hg.graft.git hg.upgraded.git
+hg.graft.replace.git: hg.graft.base.git hg.upgraded.git
 	cp -r $< $@
 	$(GIT) -C $@ cinnabar rollback 0000000000000000000000000000000000000000
-	$(GIT) -c user.email=foo@bar -C $@ filter-branch --index-filter 'test $$GIT_COMMIT = '$$($(call GET_ROOTS,$@,--remotes))' && git rm -r --cached -- \* || true' --original original -- --all
+	$(GIT) -C $@ fast-export --no-data --full-tree --all | python3 $(TOPDIR)/CI/filter.py --commits --roots | git -c core.ignorecase=false -C $@ fast-import --force
 	$(GIT) -C $@ -c cinnabar.graft=true remote update
 	$(call COMPARE_REFS, $(word 2,$^), $@, XARGS_GIT2HG)
 	$(call COMPARE_COMMANDS,$(call GET_ROOTS,$(word 2,$^),--remotes),$(call GET_ROOTS,$@,--glob=refs/cinnabar/replace))
diff --git a/CI/tools.py b/CI/tools.py
index d8a2bd05f..d67c994b7 100644
--- a/CI/tools.py
+++ b/CI/tools.py
@@ -1,3 +1,7 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
 import hashlib
 import os
 
@@ -12,7 +16,7 @@
 import msys
 
 
-MERCURIAL_VERSION = '6.3.0'
+MERCURIAL_VERSION = '6.4.2'
 GIT_VERSION = '2.40.0'
 
 ALL_MERCURIAL_VERSIONS = (
@@ -22,7 +26,7 @@
     '4.0.2', '4.1.3', '4.2.2', '4.3.3', '4.4.2', '4.5.3', '4.6.2',
     '4.7.2', '4.8.2', '4.9.1', '5.0.2', '5.1.2', '5.2.2', '5.3.2',
     '5.4.2', '5.5.2', '5.6.1', '5.7.1', '5.8.1', '5.9.3', '6.0.3',
-    '6.1.4', '6.2.3', '6.3.0',
+    '6.1.4', '6.2.3', '6.3.3', '6.4.2',
 )
 
 SOME_MERCURIAL_VERSIONS = (
diff --git a/CI/util.py b/CI/util.py
index 0b5a6458c..2d714e408 100644
--- a/CI/util.py
+++ b/CI/util.py
@@ -1,3 +1,7 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
 import os
 import subprocess
 
diff --git a/CI/variables.py b/CI/variables.py
index 243d39b7e..39d8b8d25 100644
--- a/CI/variables.py
+++ b/CI/variables.py
@@ -1,3 +1,7 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
 import json
 import os
 
diff --git a/Cargo.lock b/Cargo.lock
index c7325ed2d..f7b5b7fc3 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -100,9 +100,9 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.12.0"
+version = "3.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d261e256854913907f67ed06efbc3338dfe6179796deefc1ff763fc1aee5535"
+checksum = "9b1ce199063694f33ffb7dd4e0ee620741495c32833cde5aa08f02a0bf96f0c8"
 
 [[package]]
 name = "byteorder"
@@ -185,9 +185,9 @@ dependencies = [
 
 [[package]]
 name = "cpufeatures"
-version = "0.2.6"
+version = "0.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "280a9f2d8b3a38871a3c8a46fb80db65e5e5ed97da80c4d08bf27fb63e35e181"
+checksum = "3e4c1eaa2012c47becbbad2ab175484c2a84d1185b566fb2cc5b8707343dfe58"
 dependencies = [
  "libc",
 ]
@@ -337,9 +337,9 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.8"
+version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c05aeb6a22b8f62540c194aac980f2115af067bfe15a0734d7277a768d396b31"
+checksum = "c85e1d9ab2eadba7e5040d4e09cbd6d072b76a557ad64e797c2cb9d4da21d7e4"
 dependencies = [
  "cfg-if",
  "libc",
@@ -366,7 +366,7 @@ checksum = "ad0a93d233ebf96623465aad4046a8d3aa4da22d4f4beba5388838c8a434bbb4"
 
 [[package]]
 name = "git-cinnabar"
-version = "0.6.0"
+version = "0.6.1"
 dependencies = [
  "all_asserts",
  "array-init",
@@ -523,9 +523,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.140"
+version = "0.2.142"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99227334921fae1a979cf0bfdfcc6b3e5ce376ef57e16fb6fb3ea2ed6095f80c"
+checksum = "6a987beff54b60ffa6d51982e1aa1146bc42f19bd26be28b0586f252fccf5317"
 
 [[package]]
 name = "libz-sys"
@@ -618,11 +618,10 @@ checksum = "b7e5500299e16ebb147ae15a00a942af264cf3688f47923b8fc2cd5858f23ad3"
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.83"
+version = "0.9.86"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "666416d899cf077260dac8698d60a60b435a46d57e82acb1be3d0dad87284e5b"
+checksum = "992bac49bdbab4423199c654a5515bd2a6c6a23bf03f2dd3bdb7e5ae6259bc69"
 dependencies = [
- "autocfg",
  "cc",
  "libc",
  "pkg-config",
@@ -695,9 +694,9 @@ checksum = "dc375e1527247fe1a97d8b7156678dfe7c1af2fc075c9a4db3690ecd2a148068"
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.54"
+version = "1.0.56"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e472a104799c74b514a57226160104aa483546de37e839ec50e3c2e41dd87534"
+checksum = "2b63bdb0cd06f1f4dedf69b254734f9b45af66e4a031e42a7480257d9898b435"
 dependencies = [
  "unicode-ident",
 ]
@@ -752,18 +751,18 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.7.3"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b1f693b24f6ac912f4893ef08244d70b6067480d2f1a46e950c9691e6749d1d"
+checksum = "af83e617f331cc6ae2da5443c602dfa5af81e517212d9d611a5b3ba1777b5370"
 dependencies = [
  "regex-syntax",
 ]
 
 [[package]]
 name = "regex-syntax"
-version = "0.6.29"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f162c6dd7b008981e4d40210aca20b4bd0f9b60ca9271061b07f78537722f2e1"
+checksum = "a5996294f19bd3aae0453a862ad728f60e6600695733dd5df01da90c54363a3c"
 
 [[package]]
 name = "remove_dir_all"
@@ -791,9 +790,9 @@ dependencies = [
 
 [[package]]
 name = "rustc-demangle"
-version = "0.1.22"
+version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4a36c42d1873f9a77c53bde094f9664d9891bc604a45b4798fd2c389ed12e5b"
+checksum = "d626bb9dae77e28219937af045c257c28bfd3f69333c512553507f5f9798cb76"
 
 [[package]]
 name = "rustls"
@@ -849,9 +848,9 @@ checksum = "bebd363326d05ec3e2f532ab7660680f3b02130d780c299bca73469d521bc0ed"
 
 [[package]]
 name = "serde"
-version = "1.0.159"
+version = "1.0.160"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c04e8343c3daeec41f58990b9d77068df31209f2af111e059e9fe9646693065"
+checksum = "bb2f3770c8bce3bcda7e149193a069a0f4365bda1fa5cd88e03bca26afc1216c"
 
 [[package]]
 name = "sha-1"
@@ -1192,9 +1191,9 @@ dependencies = [
 
 [[package]]
 name = "zstd-safe"
-version = "6.0.4+zstd.1.5.4"
+version = "6.0.5+zstd.1.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7afb4b54b8910cf5447638cb54bf4e8a65cbedd783af98b98c62ffe91f185543"
+checksum = "d56d9e60b4b1758206c238a10165fbcae3ca37b01744e394c463463f6529d23b"
 dependencies = [
  "libc",
  "zstd-sys",
@@ -1202,9 +1201,9 @@ dependencies = [
 
 [[package]]
 name = "zstd-sys"
-version = "2.0.7+zstd.1.5.4"
+version = "2.0.8+zstd.1.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94509c3ba2fe55294d752b79842c530ccfab760192521df74a081a78d2b3c7f5"
+checksum = "5556e6ee25d32df2586c098bbfa278803692a20d0ab9565e049480d52707ec8c"
 dependencies = [
  "cc",
  "libc",
diff --git a/Cargo.toml b/Cargo.toml
index 3c63f1dbe..f6a13d971 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -4,7 +4,7 @@
 
 [package]
 name = "git-cinnabar"
-version = "0.6.0"
+version = "0.6.1"
 description = "git remote helper to interact with mercurial repositories"
 authors = ["Mike Hommey <mh@glandium.org>"]
 edition = "2021"
diff --git a/Makefile b/Makefile
index d69a18223..e84ecd70c 100644
--- a/Makefile
+++ b/Makefile
@@ -1,3 +1,7 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
 .PHONY: all
 all:
 
diff --git a/download.py b/download.py
index 15dbe4ff9..1bfd44409 100755
--- a/download.py
+++ b/download.py
@@ -1,4 +1,8 @@
 #!/bin/sh
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
 ''':'
 if command -v python3 > /dev/null; then
   PYTHON=python3
diff --git a/mercurial/cinnabarclone.py b/mercurial/cinnabarclone.py
index df21e435b..75ab62fd9 100644
--- a/mercurial/cinnabarclone.py
+++ b/mercurial/cinnabarclone.py
@@ -1,5 +1,6 @@
-# This software may be used and distributed according to the terms of the
-# GNU General Public License version 2 or any later version.
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 """Advertize pre-generated git-cinnabar clones
 
diff --git a/src/build.mk b/src/build.mk
index 917123e52..b4a8c28ae 100644
--- a/src/build.mk
+++ b/src/build.mk
@@ -1,3 +1,7 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
 ifdef NO_CURL
 $(error Cannot build without curl)
 endif
diff --git a/src/commit-reach.c.patch b/src/commit-reach.c.patch
new file mode 100644
index 000000000..e7ef98183
--- /dev/null
+++ b/src/commit-reach.c.patch
@@ -0,0 +1,13 @@
+diff --git a/commit-reach.c b/commit-reach.c
+index 2e33c599a8..58267d5420 100644
+--- a/commit-reach.c
++++ b/commit-reach.c
+@@ -936,6 +936,8 @@ struct commit_list *get_reachable_subset(struct commit **from, int nr_from,
+ 		}
+ 	}
+ 
++	clear_prio_queue(&queue);
++
+ 	clear_commit_marks_many(nr_to, to, PARENT1);
+ 	clear_commit_marks_many(nr_from, from, PARENT2);
+ 
diff --git a/src/libgit.rs b/src/libgit.rs
index 3af84fdae..21ac1a7a8 100644
--- a/src/libgit.rs
+++ b/src/libgit.rs
@@ -484,6 +484,10 @@ pub struct rev_info(c_void);
 #[repr(transparent)]
 pub struct commit(c_void);
 
+#[allow(non_camel_case_types)]
+#[repr(transparent)]
+pub struct commit_list(c_void);
+
 extern "C" {
     fn commit_oid(c: *const commit) -> *const object_id;
 
@@ -1111,3 +1115,68 @@ pub fn ls_tree(tree_id: &TreeId) -> Result<impl Iterator<Item = LsTreeItem>, LsT
     }
     Ok(result.into_iter())
 }
+
+extern "C" {
+    fn get_reachable_subset(
+        from: *const *const commit,
+        nr_from: c_int,
+        to: *const *const commit,
+        nr_to: c_int,
+        reachable_flag: c_uint,
+    ) -> *mut commit_list;
+
+    fn commit_list_count(l: *const commit_list) -> c_uint;
+
+    fn free_commit_list(list: *mut commit_list);
+
+    fn lookup_commit(r: *mut repository, oid: *const object_id) -> *const commit;
+}
+
+pub struct CommitList {
+    list: *mut commit_list,
+}
+
+impl CommitList {
+    pub fn is_empty(&self) -> bool {
+        unsafe { commit_list_count(self.list) == 0 }
+    }
+}
+
+impl Drop for CommitList {
+    fn drop(&mut self) {
+        unsafe {
+            free_commit_list(self.list);
+        }
+    }
+}
+
+pub fn reachable_subset(
+    from: impl IntoIterator<Item = CommitId>,
+    to: impl IntoIterator<Item = CommitId>,
+) -> CommitList {
+    let from = from
+        .into_iter()
+        .map(|cid| {
+            let oid = object_id::from(cid);
+            unsafe { lookup_commit(the_repository, &oid) }
+        })
+        .collect::<Vec<_>>();
+    let to = to
+        .into_iter()
+        .map(|cid| {
+            let oid = object_id::from(cid);
+            unsafe { lookup_commit(the_repository, &oid) }
+        })
+        .collect::<Vec<_>>();
+    CommitList {
+        list: unsafe {
+            get_reachable_subset(
+                from.as_ptr(),
+                from.len().try_into().unwrap(),
+                to.as_ptr(),
+                to.len().try_into().unwrap(),
+                0,
+            )
+        },
+    }
+}
diff --git a/src/main.rs b/src/main.rs
index dfc5811aa..b8dde71d7 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -113,9 +113,9 @@ use hg_connect::{get_bundle, get_clonebundle_url, get_connection, get_store_bund
 use libcinnabar::{files_meta, git2hg, hg2git, hg_object_id};
 use libgit::{
     config_get_value, diff_tree, for_each_ref_in, for_each_remote, get_oid_committish,
-    lookup_replace_commit, ls_tree, metadata_oid, object_id, remote, resolve_ref, rev_list,
-    rev_list_with_boundaries, strbuf, BlobId, CommitId, DiffTreeItem, FileMode, MaybeBoundary,
-    RawBlob, RawCommit, RefTransaction,
+    lookup_replace_commit, ls_tree, metadata_oid, object_id, reachable_subset, remote, resolve_ref,
+    rev_list, rev_list_with_boundaries, strbuf, BlobId, CommitId, DiffTreeItem, FileMode,
+    MaybeBoundary, RawBlob, RawCommit, RefTransaction,
 };
 use oid::{Abbrev, GitObjectId, HgObjectId, ObjectId};
 use progress::Progress;
@@ -918,6 +918,7 @@ fn do_self_update(branch: Option<String>, exact: Option<CommitId>) -> Result<(),
         tmpbuilder.prefix(BINARY);
         let mut tmpfile = tmpbuilder.tempfile_in(exe_dir).map_err(|e| e.to_string())?;
         download_build(version, &mut tmpfile, BINARY)?;
+        tmpfile.flush().map_err(|e| e.to_string())?;
         let old_exe = tmpbuilder.tempfile_in(exe_dir).map_err(|e| e.to_string())?;
         let old_exe_path = old_exe.path().to_path_buf();
         old_exe.close().map_err(|e| e.to_string())?;
@@ -4005,29 +4006,22 @@ fn remote_helper_push(
                 if drafts.is_empty() {
                     false
                 } else {
-                    let args = [
-                        OsString::from("--ancestry-path"),
-                        OsString::from("--topo-order"),
-                    ]
-                    .into_iter()
-                    .chain(
-                        drafts
-                            .iter()
-                            .filter_map(HgChangesetId::to_git)
-                            .map(|csid| format!("^{}^@", csid).into()),
-                    )
-                    .chain(
-                        pushed
-                            .heads()
-                            .filter_map(HgChangesetId::to_git)
-                            .map(|csid| csid.to_string().into()),
-                    );
                     // Theoretically, we could have commits with no
                     // metadata that the remote declares are public, while
                     // the rest of our push is in a draft state. That is
                     // however so unlikely that it's not worth the effort
                     // to support partial metadata storage.
-                    rev_list(args).any(|_| true)
+                    !reachable_subset(
+                        pushed
+                            .heads()
+                            .filter_map(HgChangesetId::to_git)
+                            .map(Into::into),
+                        drafts
+                            .iter()
+                            .filter_map(HgChangesetId::to_git)
+                            .map(Into::into),
+                    )
+                    .is_empty()
                 }
             }
             _ => unreachable!(),
diff --git a/src/oid.rs b/src/oid.rs
index 2a67733c1..981b4c6a0 100644
--- a/src/oid.rs
+++ b/src/oid.rs
@@ -70,6 +70,12 @@ macro_rules! oid_type {
             }
         }
 
+        impl From<$name> for $base_type {
+            fn from(o: $name) -> $base_type {
+                o.0
+            }
+        }
+
         oid_type!(@other $name);
     };
     ($name:ident for $typ:ty) => {
diff --git a/tests/cinnabarclone.t b/tests/cinnabarclone.t
index e050ad9f8..d4f1ee0bb 100755
--- a/tests/cinnabarclone.t
+++ b/tests/cinnabarclone.t
@@ -110,7 +110,7 @@ TODO: Ideally, the error message would say the server could not be connected to.
   Cloning into 'repo-git'...
   Fetching cinnabar metadata from http://localhost:8080/
   \r (no-eol) (esc)
-  ERROR unable to access 'http://localhost:8080/': Failed to connect to localhost port 8080: Connection refused
+  ERROR unable to access 'http://localhost:8080/': Failed to connect to localhost port 8080.* (re)
   \r (no-eol) (esc)
   WARNING Falling back to normal clone.
 
diff --git a/tests/push.t b/tests/push.t
index 16941bff9..e2bc583ab 100755
--- a/tests/push.t
+++ b/tests/push.t
@@ -15,9 +15,11 @@ Test repository setup.
   $ hg init abc
   $ hg init def
   $ hg init xyz
+  $ hg init uvw
   $ ABC=$(pwd)/abc
   $ DEF=$(pwd)/def
   $ XYZ=$(pwd)/xyz
+  $ UVW=$(pwd)/uvw
 
   $ cd abc
   $ for f in a b c; do create $f; done
@@ -47,6 +49,8 @@ Create git clones of the above repositories.
   $ git -c fetch.prune=true clone -n -q hg::$DEF def-git
   $ git -c fetch.prune=true clone -n -q hg::$XYZ xyz-git
   warning: You appear to have cloned an empty repository.
+  $ git -c fetch.prune=true clone -n -q hg::$UVW uvw-git
+  warning: You appear to have cloned an empty repository.
 
 Ensure the repositories look like what we assume further below.
 
@@ -302,3 +306,62 @@ Server is still non-publishing, but we opted in to store the metadata.
   a2341d430e5acddf9481eabcad901fda12d023d3
   8b8194eefb69ec89edc35dafb965311fe48c49d0
   2836e453f32b1ecccd3acca412f75b07c88176bf
+
+Pushing a root to a new non-publishing repo should work.
+
+  $ cat >> $UVW/.hg/hgrc <<EOF
+  > [phases]
+  > publish = False
+  > EOF
+
+  $ git -C uvw-git fetch ../xyz-git 687e015f9f646bb19797d991f2f53087297fbe14
+  From ../xyz-git
+   * branch            687e015f9f646bb19797d991f2f53087297fbe14 -> FETCH_HEAD
+
+  $ git -c cinnabar.data=phase -C uvw-git push origin 687e015f9f646bb19797d991f2f53087297fbe14:refs/heads/branches/default/tip
+  remote: adding changesets
+  remote: adding manifests
+  remote: adding file changes
+  remote: added 3 changesets with 3 changes to 3 files
+  To hg::.*/push.t/uvw (re)
+   * [new branch]      687e015f9f646bb19797d991f2f53087297fbe14 -> branches/default/tip
+
+Server is non-publishing, metadata should not be stored.
+
+  $ git -C uvw-git cinnabar rollback --candidates
+
+  $ hg -R $UVW phase --public f92470d7f6966a39dfbced6a525fe81ebf5c37b9
+  $ hg -R $UVW phase -r 'all()'
+  0: public
+  1: draft
+  2: draft
+
+We won't be able to push without first pulling something, so fetch the first commit.
+
+  $ git -C uvw-git cinnabar fetch hg::$UVW f92470d7f6966a39dfbced6a525fe81ebf5c37b9
+  From hg::.*/push.t/uvw (re)
+   * branch            hg/revs/f92470d7f6966a39dfbced6a525fe81ebf5c37b9 -> FETCH_HEAD
+
+  $ git -C uvw-git cinnabar rollback --candidates
+  2836e453f32b1ecccd3acca412f75b07c88176bf (current)
+
+  $ hg -R $UVW phase --public 636e60525868096cbdc961870493510558f41d2f
+  $ hg -R $UVW phase -r 'all()'
+  0: public
+  1: public
+  2: draft
+  $ hg --config extensions.strip= -R $UVW strip -r 2 --no-backup
+
+  $ git -c cinnabar.data=phase -C uvw-git push origin 687e015f9f646bb19797d991f2f53087297fbe14:refs/heads/branches/default/tip
+  remote: adding changesets
+  remote: adding manifests
+  remote: adding file changes
+  remote: added 1 changesets with 1 changes to 2 files
+  To hg::.*/push.t/uvw (re)
+   * [new branch]      687e015f9f646bb19797d991f2f53087297fbe14 -> branches/default/tip
+
+We pushed what happens to be one existing public commit and one draft commit.
+In that corner case, we don't store metadata.
+
+  $ git -C uvw-git cinnabar rollback --candidates
+  2836e453f32b1ecccd3acca412f75b07c88176bf (current)