diff --git a/apply.c b/apply.c
index e5e11b8579..373565a7ba 100644
--- a/apply.c
+++ b/apply.c
@@ -26,6 +26,7 @@
 #include "rerere.h"
 #include "apply.h"
 #include "entry.h"
+#include "wrapper.h"
 
 struct gitdiff_data {
 	struct strbuf *root;
diff --git a/builtin/am.c b/builtin/am.c
index 14347ecf9a..37f82b3eb4 100644
--- a/builtin/am.c
+++ b/builtin/am.c
@@ -38,6 +38,7 @@
 #include "packfile.h"
 #include "repository.h"
 #include "pretty.h"
+#include "wrapper.h"
 
 /**
  * Returns the length of the first line of msg.
diff --git a/builtin/bisect.c b/builtin/bisect.c
index 09188e554b..31cc57e45b 100644
--- a/builtin/bisect.c
+++ b/builtin/bisect.c
@@ -11,6 +11,7 @@
 #include "prompt.h"
 #include "quote.h"
 #include "revision.h"
+#include "wrapper.h"
 
 static GIT_PATH_FUNC(git_path_bisect_terms, "BISECT_TERMS")
 static GIT_PATH_FUNC(git_path_bisect_expected_rev, "BISECT_EXPECTED_REV")
diff --git a/builtin/branch.c b/builtin/branch.c
index 56dbee97d2..98475ea532 100644
--- a/builtin/branch.c
+++ b/builtin/branch.c
@@ -26,6 +26,7 @@
 #include "worktree.h"
 #include "help.h"
 #include "commit-reach.h"
+#include "wrapper.h"
 
 static const char * const builtin_branch_usage[] = {
 	N_("git branch [<options>] [-r | -a] [--merged] [--no-merged]"),
diff --git a/builtin/bugreport.c b/builtin/bugreport.c
index b5dfad4e12..160590e4ef 100644
--- a/builtin/bugreport.c
+++ b/builtin/bugreport.c
@@ -8,7 +8,7 @@
 #include "hook.h"
 #include "hook-list.h"
 #include "diagnose.h"
-
+#include "wrapper.h"
 
 static void get_system_info(struct strbuf *sys_info)
 {
diff --git a/builtin/config.c b/builtin/config.c
index 42e6b8d348..1c1e006ff3 100644
--- a/builtin/config.c
+++ b/builtin/config.c
@@ -9,6 +9,7 @@
 #include "urlmatch.h"
 #include "quote.h"
 #include "worktree.h"
+#include "wrapper.h"
 
 static const char *const builtin_config_usage[] = {
 	N_("git config [<options>]"),
diff --git a/builtin/credential-cache.c b/builtin/credential-cache.c
index 25f2f71c21..af56a44923 100644
--- a/builtin/credential-cache.c
+++ b/builtin/credential-cache.c
@@ -1,6 +1,7 @@
 #include "builtin.h"
 #include "gettext.h"
 #include "parse-options.h"
+#include "wrapper.h"
 
 #ifndef NO_UNIX_SOCKETS
 
diff --git a/builtin/difftool.c b/builtin/difftool.c
index ed06db1208..59465c39f1 100644
--- a/builtin/difftool.c
+++ b/builtin/difftool.c
@@ -27,6 +27,7 @@
 #include "object-store.h"
 #include "dir.h"
 #include "entry.h"
+#include "wrapper.h"
 
 static int trust_exit_code;
 
diff --git a/builtin/fast-import.c b/builtin/fast-import.c
index 7307c4657f..3300b7f30f 100644
--- a/builtin/fast-import.c
+++ b/builtin/fast-import.c
@@ -23,6 +23,7 @@
 #include "commit-reach.h"
 #include "khash.h"
 #include "date.h"
+#include "wrapper.h"
 
 #define PACK_ID_BITS 16
 #define MAX_PACK_ID ((1<<PACK_ID_BITS)-1)
diff --git a/builtin/fmt-merge-msg.c b/builtin/fmt-merge-msg.c
index 0f9855b680..cc81241642 100644
--- a/builtin/fmt-merge-msg.c
+++ b/builtin/fmt-merge-msg.c
@@ -3,6 +3,7 @@
 #include "fmt-merge-msg.h"
 #include "gettext.h"
 #include "parse-options.h"
+#include "wrapper.h"
 
 static const char * const fmt_merge_msg_usage[] = {
 	N_("git fmt-merge-msg [-m <message>] [--log[=<n>] | --no-log] [--file <file>]"),
diff --git a/builtin/gc.c b/builtin/gc.c
index ef063fc828..2107e3d1f2 100644
--- a/builtin/gc.c
+++ b/builtin/gc.c
@@ -35,6 +35,7 @@
 #include "exec-cmd.h"
 #include "gettext.h"
 #include "hook.h"
+#include "wrapper.h"
 
 #define FAILED_RUN "failed to run %s"
 
diff --git a/builtin/get-tar-commit-id.c b/builtin/get-tar-commit-id.c
index 491af9202d..6745796998 100644
--- a/builtin/get-tar-commit-id.c
+++ b/builtin/get-tar-commit-id.c
@@ -6,6 +6,7 @@
 #include "tar.h"
 #include "builtin.h"
 #include "quote.h"
+#include "wrapper.h"
 
 static const char builtin_get_tar_commit_id_usage[] =
 "git get-tar-commit-id";
diff --git a/builtin/index-pack.c b/builtin/index-pack.c
index bae5b05403..2393897cb8 100644
--- a/builtin/index-pack.c
+++ b/builtin/index-pack.c
@@ -19,6 +19,7 @@
 #include "object-store.h"
 #include "replace-object.h"
 #include "promisor-remote.h"
+#include "wrapper.h"
 
 static const char index_pack_usage[] =
 "git index-pack [-v] [-o <index-file>] [--keep | --keep=<msg>] [--[no-]rev-index] [--verify] [--strict] (<pack-file> | --stdin [--fix-thin] [<pack-file>])";
diff --git a/builtin/init-db.c b/builtin/init-db.c
index 6f724f694f..a5d4f5c8ec 100644
--- a/builtin/init-db.c
+++ b/builtin/init-db.c
@@ -12,6 +12,7 @@
 #include "exec-cmd.h"
 #include "parse-options.h"
 #include "worktree.h"
+#include "wrapper.h"
 
 #ifndef DEFAULT_GIT_TEMPLATE_DIR
 #define DEFAULT_GIT_TEMPLATE_DIR "/usr/share/git-core/templates"
diff --git a/builtin/merge.c b/builtin/merge.c
index 38243e55c5..f4f4a220f3 100644
--- a/builtin/merge.c
+++ b/builtin/merge.c
@@ -49,6 +49,7 @@
 #include "commit-reach.h"
 #include "wt-status.h"
 #include "commit-graph.h"
+#include "wrapper.h"
 
 #define DEFAULT_TWOHEAD (1<<0)
 #define DEFAULT_OCTOPUS (1<<1)
diff --git a/builtin/pack-objects.c b/builtin/pack-objects.c
index 1ca800c7c5..8b55a088a7 100644
--- a/builtin/pack-objects.c
+++ b/builtin/pack-objects.c
@@ -40,6 +40,7 @@
 #include "shallow.h"
 #include "promisor-remote.h"
 #include "pack-mtimes.h"
+#include "wrapper.h"
 
 /*
  * Objects we are going to pack are collected in the `to_pack` structure.
diff --git a/builtin/rebase.c b/builtin/rebase.c
index a3f8be8888..d2f8f703d6 100644
--- a/builtin/rebase.c
+++ b/builtin/rebase.c
@@ -32,6 +32,7 @@
 #include "rebase-interactive.h"
 #include "reset.h"
 #include "hook.h"
+#include "wrapper.h"
 
 static char const * const builtin_rebase_usage[] = {
 	N_("git rebase [-i] [options] [--exec <cmd>] "
diff --git a/builtin/receive-pack.c b/builtin/receive-pack.c
index aec5ee930b..ae49ea8c2a 100644
--- a/builtin/receive-pack.c
+++ b/builtin/receive-pack.c
@@ -33,6 +33,7 @@
 #include "commit-reach.h"
 #include "worktree.h"
 #include "shallow.h"
+#include "wrapper.h"
 
 static const char * const receive_pack_usage[] = {
 	N_("git receive-pack <git-dir>"),
diff --git a/builtin/rerere.c b/builtin/rerere.c
index 24c7875572..d4a03707b1 100644
--- a/builtin/rerere.c
+++ b/builtin/rerere.c
@@ -6,6 +6,7 @@
 #include "parse-options.h"
 #include "string-list.h"
 #include "rerere.h"
+#include "wrapper.h"
 #include "xdiff/xdiff.h"
 #include "xdiff-interface.h"
 #include "pathspec.h"
diff --git a/builtin/unpack-file.c b/builtin/unpack-file.c
index e9b105a539..4cbb403929 100644
--- a/builtin/unpack-file.c
+++ b/builtin/unpack-file.c
@@ -2,6 +2,7 @@
 #include "config.h"
 #include "hex.h"
 #include "object-store.h"
+#include "wrapper.h"
 
 static char *create_temp_file(struct object_id *oid)
 {
diff --git a/builtin/worktree.c b/builtin/worktree.c
index ed614ffddc..1533b4ab43 100644
--- a/builtin/worktree.c
+++ b/builtin/worktree.c
@@ -16,6 +16,7 @@
 #include "submodule.h"
 #include "utf8.h"
 #include "worktree.h"
+#include "wrapper.h"
 #include "quote.h"
 
 #define BUILTIN_WORKTREE_ADD_USAGE \
diff --git a/cache.h b/cache.h
index 705c41992b..31c722533f 100644
--- a/cache.h
+++ b/cache.h
@@ -1085,10 +1085,6 @@ const char *repo_find_unique_abbrev(struct repository *r, const struct object_id
 int repo_find_unique_abbrev_r(struct repository *r, char *hex, const struct object_id *oid, int len);
 #define find_unique_abbrev_r(hex, oid, len) repo_find_unique_abbrev_r(the_repository, hex, oid, len)
 
-/* set default permissions by passing mode arguments to open(2) */
-int git_mkstemps_mode(char *pattern, int suffix_len, int mode);
-int git_mkstemp_mode(char *pattern, int mode);
-
 /*
  * NOTE NOTE NOTE!!
  *
@@ -1423,31 +1419,6 @@ static inline int batch_fsync_enabled(enum fsync_component component)
 	return (fsync_components & component) && (fsync_method == FSYNC_METHOD_BATCH);
 }
 
-ssize_t read_in_full(int fd, void *buf, size_t count);
-ssize_t write_in_full(int fd, const void *buf, size_t count);
-ssize_t pread_in_full(int fd, void *buf, size_t count, off_t offset);
-
-static inline ssize_t write_str_in_full(int fd, const char *str)
-{
-	return write_in_full(fd, str, strlen(str));
-}
-
-/**
- * Open (and truncate) the file at path, write the contents of buf to it,
- * and close it. Dies if any errors are encountered.
- */
-void write_file_buf(const char *path, const char *buf, size_t len);
-
-/**
- * Like write_file_buf(), but format the contents into a buffer first.
- * Additionally, write_file() will append a newline if one is not already
- * present, making it convenient to write text files:
- *
- *   write_file(path, "counter: %d", ctr);
- */
-__attribute__((format (printf, 2, 3)))
-void write_file(const char *path, const char *fmt, ...);
-
 /* pager.c */
 void setup_pager(void);
 int pager_in_use(void);
@@ -1571,7 +1542,4 @@ int versioncmp(const char *s1, const char *s2);
  */
 int print_sha1_ellipsis(void);
 
-/* Return 1 if the file is empty or does not exists, 0 otherwise. */
-int is_empty_or_missing_file(const char *filename);
-
 #endif /* CACHE_H */
diff --git a/commit-graph.c b/commit-graph.c
index 8f21a0a0c2..5481736c76 100644
--- a/commit-graph.c
+++ b/commit-graph.c
@@ -22,6 +22,7 @@
 #include "json-writer.h"
 #include "trace2.h"
 #include "chunk-format.h"
+#include "wrapper.h"
 
 void git_test_write_commit_graph_or_die(void)
 {
diff --git a/compat/mingw.c b/compat/mingw.c
index cbcd03aea9..d48899bf7b 100644
--- a/compat/mingw.c
+++ b/compat/mingw.c
@@ -11,6 +11,7 @@
 #include "../alloc.h"
 #include "win32/lazyload.h"
 #include "../config.h"
+#include "../wrapper.h"
 #include "dir.h"
 #include "gettext.h"
 #define SECURITY_WIN32
diff --git a/compat/terminal.c b/compat/terminal.c
index afebe6b249..ed2b30b38f 100644
--- a/compat/terminal.c
+++ b/compat/terminal.c
@@ -6,6 +6,7 @@
 #include "run-command.h"
 #include "string-list.h"
 #include "hashmap.h"
+#include "wrapper.h"
 
 #if defined(HAVE_DEV_TTY) || defined(GIT_WINDOWS_NATIVE)
 
diff --git a/config.c b/config.c
index 6815919ec3..5b1a5d5205 100644
--- a/config.c
+++ b/config.c
@@ -28,6 +28,7 @@
 #include "replace-object.h"
 #include "refs.h"
 #include "worktree.h"
+#include "wrapper.h"
 
 struct config_source {
 	struct config_source *prev;
diff --git a/convert.c b/convert.c
index 2bd54244b5..da06e2f51c 100644
--- a/convert.c
+++ b/convert.c
@@ -11,6 +11,7 @@
 #include "sub-process.h"
 #include "utf8.h"
 #include "ll-merge.h"
+#include "wrapper.h"
 
 /*
  * convert.c - convert a file when checking it out and checking it in.
diff --git a/copy.c b/copy.c
index 4de6a110f0..c3250f0822 100644
--- a/copy.c
+++ b/copy.c
@@ -1,4 +1,5 @@
 #include "cache.h"
+#include "wrapper.h"
 
 int copy_fd(int ifd, int ofd)
 {
diff --git a/csum-file.c b/csum-file.c
index cce13c0f04..2d22f80d90 100644
--- a/csum-file.c
+++ b/csum-file.c
@@ -10,6 +10,7 @@
 #include "cache.h"
 #include "progress.h"
 #include "csum-file.h"
+#include "wrapper.h"
 
 static void verify_buffer_or_die(struct hashfile *f,
 				 const void *buf,
diff --git a/daemon.c b/daemon.c
index bb795ca3ca..e35604e194 100644
--- a/daemon.c
+++ b/daemon.c
@@ -6,6 +6,7 @@
 #include "run-command.h"
 #include "strbuf.h"
 #include "string-list.h"
+#include "wrapper.h"
 
 #ifdef NO_INITGROUPS
 #define initgroups(x, y) (0) /* nothing */
diff --git a/diff.c b/diff.c
index 1b0be99c06..1b0b24c21c 100644
--- a/diff.c
+++ b/diff.c
@@ -33,6 +33,7 @@
 #include "promisor-remote.h"
 #include "dir.h"
 #include "strmap.h"
+#include "wrapper.h"
 
 #ifdef NO_FAST_WORKING_DIRECTORY
 #define FAST_WORKING_DIRECTORY 0
diff --git a/dir.c b/dir.c
index c72481c60e..b57c770e68 100644
--- a/dir.c
+++ b/dir.c
@@ -21,6 +21,7 @@
 #include "ewah/ewok.h"
 #include "fsmonitor.h"
 #include "submodule-config.h"
+#include "wrapper.h"
 
 /*
  * Tells read_directory_recursive how a file or directory should be treated.
diff --git a/entry.c b/entry.c
index acb76a61ac..70212af260 100644
--- a/entry.c
+++ b/entry.c
@@ -10,6 +10,7 @@
 #include "fsmonitor.h"
 #include "entry.h"
 #include "parallel-checkout.h"
+#include "wrapper.h"
 
 static void create_directories(const char *path, int path_len,
 			       const struct checkout *state)
diff --git a/environment.c b/environment.c
index c69571f0b2..bf02f3cf48 100644
--- a/environment.c
+++ b/environment.c
@@ -23,6 +23,7 @@
 #include "tmp-objdir.h"
 #include "chdir-notify.h"
 #include "shallow.h"
+#include "wrapper.h"
 
 int trust_executable_bit = 1;
 int trust_ctime = 1;
diff --git a/fetch-pack.c b/fetch-pack.c
index 359dce6afe..c119080140 100644
--- a/fetch-pack.c
+++ b/fetch-pack.c
@@ -30,6 +30,7 @@
 #include "commit-graph.h"
 #include "sigchain.h"
 #include "mergesort.h"
+#include "wrapper.h"
 
 static int transfer_unpack_limit = -1;
 static int fetch_unpack_limit = -1;
diff --git a/gpg-interface.c b/gpg-interface.c
index f9c5b6c3f5..6644701fda 100644
--- a/gpg-interface.c
+++ b/gpg-interface.c
@@ -10,6 +10,7 @@
 #include "sigchain.h"
 #include "tempfile.h"
 #include "alias.h"
+#include "wrapper.h"
 
 static int git_gpg_config(const char *, const char *, void *);
 
diff --git a/http-backend.c b/http-backend.c
index 7e7c19e66b..42e6c2596e 100644
--- a/http-backend.c
+++ b/http-backend.c
@@ -16,6 +16,7 @@
 #include "object-store.h"
 #include "protocol.h"
 #include "date.h"
+#include "wrapper.h"
 
 static const char content_type[] = "Content-Type";
 static const char content_length[] = "Content-Length";
diff --git a/imap-send.c b/imap-send.c
index c65a27219c..aa5b2f252d 100644
--- a/imap-send.c
+++ b/imap-send.c
@@ -28,6 +28,7 @@
 #include "gettext.h"
 #include "run-command.h"
 #include "parse-options.h"
+#include "wrapper.h"
 #if defined(NO_OPENSSL) && !defined(HAVE_OPENSSL_CSPRNG)
 typedef void *SSL;
 #endif
diff --git a/ll-merge.c b/ll-merge.c
index 130d26501c..8be38d3bd4 100644
--- a/ll-merge.c
+++ b/ll-merge.c
@@ -11,6 +11,7 @@
 #include "run-command.h"
 #include "ll-merge.h"
 #include "quote.h"
+#include "wrapper.h"
 
 struct ll_merge_driver;
 
diff --git a/merge-recursive.c b/merge-recursive.c
index 0b0255ebc8..f918cea4c6 100644
--- a/merge-recursive.c
+++ b/merge-recursive.c
@@ -30,6 +30,7 @@
 #include "tag.h"
 #include "tree-walk.h"
 #include "unpack-trees.h"
+#include "wrapper.h"
 #include "xdiff-interface.h"
 
 struct merge_options_internal {
diff --git a/notes-merge.c b/notes-merge.c
index c8d0020b1a..ba2970f070 100644
--- a/notes-merge.c
+++ b/notes-merge.c
@@ -15,6 +15,7 @@
 #include "strbuf.h"
 #include "notes-utils.h"
 #include "commit-reach.h"
+#include "wrapper.h"
 
 struct notes_merge_pair {
 	struct object_id obj, base, local, remote;
diff --git a/object-file.c b/object-file.c
index bee41b3047..bdf68763a5 100644
--- a/object-file.c
+++ b/object-file.c
@@ -38,6 +38,7 @@
 #include "promisor-remote.h"
 #include "submodule.h"
 #include "fsck.h"
+#include "wrapper.h"
 
 /* The maximum size for an object header. */
 #define MAX_HEADER_LEN 32
diff --git a/packfile.c b/packfile.c
index 3290fde15a..8c117ccee2 100644
--- a/packfile.c
+++ b/packfile.c
@@ -20,6 +20,7 @@
 #include "midx.h"
 #include "commit-graph.h"
 #include "promisor-remote.h"
+#include "wrapper.h"
 
 char *odb_pack_name(struct strbuf *buf,
 		    const unsigned char *hash,
diff --git a/parallel-checkout.c b/parallel-checkout.c
index 38c4dc665d..50fd7fe31e 100644
--- a/parallel-checkout.c
+++ b/parallel-checkout.c
@@ -12,6 +12,7 @@
 #include "streaming.h"
 #include "thread-utils.h"
 #include "trace2.h"
+#include "wrapper.h"
 
 struct pc_worker {
 	struct child_process cp;
diff --git a/pkt-line.c b/pkt-line.c
index c8b90b2242..30469eb4d8 100644
--- a/pkt-line.c
+++ b/pkt-line.c
@@ -3,6 +3,7 @@
 #include "gettext.h"
 #include "hex.h"
 #include "run-command.h"
+#include "wrapper.h"
 
 char packet_buffer[LARGE_PACKET_MAX];
 static const char *packet_trace_prefix = "git";
diff --git a/read-cache.c b/read-cache.c
index 63789ea5e2..9a8d5fe97e 100644
--- a/read-cache.c
+++ b/read-cache.c
@@ -32,6 +32,7 @@
 #include "csum-file.h"
 #include "promisor-remote.h"
 #include "hook.h"
+#include "wrapper.h"
 
 /* Mask for the name length in ce_flags in the on-disk index */
 
diff --git a/rebase-interactive.c b/rebase-interactive.c
index 649c94e69a..7c885c35bf 100644
--- a/rebase-interactive.c
+++ b/rebase-interactive.c
@@ -7,6 +7,7 @@
 #include "commit-slab.h"
 #include "config.h"
 #include "dir.h"
+#include "wrapper.h"
 
 static const char edit_todo_list_advice[] =
 N_("You can fix this with 'git rebase --edit-todo' "
diff --git a/refs.c b/refs.c
index 8684f4610f..385051752f 100644
--- a/refs.c
+++ b/refs.c
@@ -24,6 +24,7 @@
 #include "sigchain.h"
 #include "date.h"
 #include "commit.h"
+#include "wrapper.h"
 
 /*
  * List of all available backends
diff --git a/refs/files-backend.c b/refs/files-backend.c
index de3628ff3f..eb14d124e3 100644
--- a/refs/files-backend.c
+++ b/refs/files-backend.c
@@ -13,7 +13,8 @@
 #include "../object.h"
 #include "../dir.h"
 #include "../chdir-notify.h"
-#include "worktree.h"
+#include "../worktree.h"
+#include "../wrapper.h"
 
 /*
  * This backend uses the following flags in `ref_update::flags` for
diff --git a/rerere.c b/rerere.c
index c3258e1390..b5ccbecdcd 100644
--- a/rerere.c
+++ b/rerere.c
@@ -16,6 +16,7 @@
 #include "object-store.h"
 #include "hash-lookup.h"
 #include "strmap.h"
+#include "wrapper.h"
 
 #define RESOLVED 0
 #define PUNTED 1
diff --git a/sequencer.c b/sequencer.c
index c61c1fc4d8..aa7983f5b4 100644
--- a/sequencer.c
+++ b/sequencer.c
@@ -41,6 +41,7 @@
 #include "rebase-interactive.h"
 #include "reset.h"
 #include "branch.h"
+#include "wrapper.h"
 
 #define GIT_REFLOG_ACTION "GIT_REFLOG_ACTION"
 
diff --git a/server-info.c b/server-info.c
index 7864337705..ae96d784e5 100644
--- a/server-info.c
+++ b/server-info.c
@@ -10,6 +10,7 @@
 #include "packfile.h"
 #include "object-store.h"
 #include "strbuf.h"
+#include "wrapper.h"
 
 struct update_info_ctx {
 	FILE *cur_fp;
diff --git a/shallow.c b/shallow.c
index c5433a4fd3..7fcba5f6d0 100644
--- a/shallow.c
+++ b/shallow.c
@@ -17,6 +17,7 @@
 #include "list-objects.h"
 #include "commit-reach.h"
 #include "shallow.h"
+#include "wrapper.h"
 
 void set_alternate_shallow_file(struct repository *r, const char *path, int override)
 {
diff --git a/strbuf.c b/strbuf.c
index 9633e37b62..70a83e7980 100644
--- a/strbuf.c
+++ b/strbuf.c
@@ -8,6 +8,7 @@
 #include "string-list.h"
 #include "utf8.h"
 #include "date.h"
+#include "wrapper.h"
 
 int starts_with(const char *str, const char *prefix)
 {
diff --git a/streaming.c b/streaming.c
index 27841dc1d9..6c69f59504 100644
--- a/streaming.c
+++ b/streaming.c
@@ -7,6 +7,7 @@
 #include "object-store.h"
 #include "replace-object.h"
 #include "packfile.h"
+#include "wrapper.h"
 
 typedef int (*open_istream_fn)(struct git_istream *,
 			       struct repository *,
diff --git a/t/helper/test-delta.c b/t/helper/test-delta.c
index b15481ea59..6609fcbc12 100644
--- a/t/helper/test-delta.c
+++ b/t/helper/test-delta.c
@@ -12,6 +12,7 @@
 #include "git-compat-util.h"
 #include "delta.h"
 #include "cache.h"
+#include "wrapper.h"
 
 static const char usage_str[] =
 	"test-tool delta (-d|-p) <from_file> <data_file> <out_file>";
diff --git a/t/helper/test-fsmonitor-client.c b/t/helper/test-fsmonitor-client.c
index 54a4856c48..c43fc976b8 100644
--- a/t/helper/test-fsmonitor-client.c
+++ b/t/helper/test-fsmonitor-client.c
@@ -9,6 +9,7 @@
 #include "fsmonitor-ipc.h"
 #include "thread-utils.h"
 #include "trace2.h"
+#include "wrapper.h"
 
 #ifndef HAVE_FSMONITOR_DAEMON_BACKEND
 int cmd__fsmonitor_client(int argc, const char **argv)
diff --git a/t/helper/test-read-cache.c b/t/helper/test-read-cache.c
index 23e9e27109..84818363d5 100644
--- a/t/helper/test-read-cache.c
+++ b/t/helper/test-read-cache.c
@@ -2,6 +2,7 @@
 #include "test-tool.h"
 #include "cache.h"
 #include "config.h"
+#include "wrapper.h"
 
 int cmd__read_cache(int argc, const char **argv)
 {
diff --git a/tag.c b/tag.c
index 18b718cca6..3408bb9433 100644
--- a/tag.c
+++ b/tag.c
@@ -8,6 +8,7 @@
 #include "gpg-interface.h"
 #include "hex.h"
 #include "packfile.h"
+#include "wrapper.h"
 
 const char *tag_type = "tag";
 
diff --git a/tempfile.c b/tempfile.c
index e27048f970..cdd2cab3ba 100644
--- a/tempfile.c
+++ b/tempfile.c
@@ -45,6 +45,7 @@
 #include "cache.h"
 #include "tempfile.h"
 #include "sigchain.h"
+#include "wrapper.h"
 
 static VOLATILE_LIST_HEAD(tempfile_list);
 
diff --git a/trace.c b/trace.c
index 2b41c683fc..de004f6298 100644
--- a/trace.c
+++ b/trace.c
@@ -24,6 +24,7 @@
 #include "cache.h"
 #include "abspath.h"
 #include "quote.h"
+#include "wrapper.h"
 
 struct trace_key trace_default_key = { "GIT_TRACE", 0, 0, 0 };
 struct trace_key trace_perf_key = TRACE_KEY_INIT(PERFORMANCE);
diff --git a/transport-helper.c b/transport-helper.c
index 105bb801c2..09048eab48 100644
--- a/transport-helper.c
+++ b/transport-helper.c
@@ -16,6 +16,7 @@
 #include "refspec.h"
 #include "transport-internal.h"
 #include "protocol.h"
+#include "wrapper.h"
 
 static int debug;
 
diff --git a/transport.c b/transport.c
index 80059124c0..c6179b801e 100644
--- a/transport.c
+++ b/transport.c
@@ -26,6 +26,7 @@
 #include "object-store.h"
 #include "color.h"
 #include "bundle-uri.h"
+#include "wrapper.h"
 
 static int transport_use_color = -1;
 static char transport_colors[][COLOR_MAXLEN] = {
diff --git a/usage.c b/usage.c
index 40a1c5a433..b53c99dbe5 100644
--- a/usage.c
+++ b/usage.c
@@ -5,6 +5,7 @@
  */
 #include "cache.h"
 #include "gettext.h"
+#include "wrapper.h"
 
 static void vreportf(const char *prefix, const char *err, va_list params)
 {
diff --git a/worktree.c b/worktree.c
index b7bc4c7bb7..fe4345012c 100644
--- a/worktree.c
+++ b/worktree.c
@@ -9,6 +9,7 @@
 #include "dir.h"
 #include "wt-status.h"
 #include "config.h"
+#include "wrapper.h"
 
 void free_worktrees(struct worktree **worktrees)
 {
diff --git a/wrapper.c b/wrapper.c
index df1fa6286d..ee83757590 100644
--- a/wrapper.c
+++ b/wrapper.c
@@ -5,6 +5,7 @@
 #include "abspath.h"
 #include "config.h"
 #include "gettext.h"
+#include "wrapper.h"
 
 static intmax_t count_fsync_writeout_only;
 static intmax_t count_fsync_hardware_flush;
diff --git a/wrapper.h b/wrapper.h
new file mode 100644
index 0000000000..f0c7d0616d
--- /dev/null
+++ b/wrapper.h
@@ -0,0 +1,36 @@
+#ifndef WRAPPER_H
+#define WRAPPER_H
+
+/* set default permissions by passing mode arguments to open(2) */
+int git_mkstemps_mode(char *pattern, int suffix_len, int mode);
+int git_mkstemp_mode(char *pattern, int mode);
+
+ssize_t read_in_full(int fd, void *buf, size_t count);
+ssize_t write_in_full(int fd, const void *buf, size_t count);
+ssize_t pread_in_full(int fd, void *buf, size_t count, off_t offset);
+
+static inline ssize_t write_str_in_full(int fd, const char *str)
+{
+	return write_in_full(fd, str, strlen(str));
+}
+
+/**
+ * Open (and truncate) the file at path, write the contents of buf to it,
+ * and close it. Dies if any errors are encountered.
+ */
+void write_file_buf(const char *path, const char *buf, size_t len);
+
+/**
+ * Like write_file_buf(), but format the contents into a buffer first.
+ * Additionally, write_file() will append a newline if one is not already
+ * present, making it convenient to write text files:
+ *
+ *   write_file(path, "counter: %d", ctr);
+ */
+__attribute__((format (printf, 2, 3)))
+void write_file(const char *path, const char *fmt, ...);
+
+/* Return 1 if the file is empty or does not exists, 0 otherwise. */
+int is_empty_or_missing_file(const char *filename);
+
+#endif /* WRAPPER_H */
diff --git a/write-or-die.c b/write-or-die.c
index aaa0318e82..a7afc303db 100644
--- a/write-or-die.c
+++ b/write-or-die.c
@@ -1,6 +1,7 @@
 #include "cache.h"
 #include "config.h"
 #include "run-command.h"
+#include "wrapper.h"
 
 /*
  * Some cases use stdio, but want to flush after the write