Update Rust crate gix-object to 0.65

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
gix-object	dependencies	minor	0.63 → 0.65

---

Release Notes

GitoxideLabs/gitoxide (gix-object)

v0.65.0: gix-object v0.65.0

Compare Source

New Features

• add Never::panic_on_access() to forbid object access

  Tests that must avoid object database access can use Never::panic_on_access()
  instead of implementing their own panicking stores. The returned PanicAlways
  type panics on reads, existence checks, and writes, while preserving the
  existing Never unit struct and its behavior.

  Replace the custom panicking stores in the null-ID tests in gix-diff and
  gix-merge, and cover every object-access method. Validated the object, diff,
  and merge integration test suites and cargo fmt --all -- --check.

  Keep rustdoc links aligned with the constructor name. CI's test and lint
  jobs build documentation with warnings denied, and the old
  Never::fail_always() links failed to resolve. The failure was reproduced
  locally; RUSTDOCFLAGS='-D warnings' cargo doc -p gix-object --no-deps --features sha1
  passes with the corrected links.

Bug Fixes

• Keep rust workspace tests inside disposable repositories and isolated environments

  Direct Git launches inherited repository selectors and user configuration even
  when tests supplied a fixture working directory. Tests of default-environment
  APIs and local Git transports also shared the runner's environment. A few
  journey tests wrote beneath source directories or used the source checkout as
  the repository under test.

  Use the shared gix-testtools Git command builder for subprocess setup, isolated
  repository options for fixtures, and isolated child processes where the real
  environment-reading API must be exercised. Scope CWD changes, copy the fixture
  used by an object-write test, and run shell journeys through jtt run. Keep
  journey worktrees and example output within their disposable sandboxes and
  replace the attributes checkout test with a representative fixture repository.
  Prompt examples also run in isolated children and must build successfully; the
  old tests could ignore build failures and execute stale cached binaries.

  The affected Rust crate suites, internal test-tool build, and max-pure journey
  suite pass from a source copy without Git metadata. Signing and Git-daemon
  checks use only disposable keys, repositories, and local sockets.

• omit the final newline from bodyless commit titles
  An ordinary commit created with git commit -m "initial commit" exposes
  "initial commit\n" as MessageRef::title because the no-separator path
  returns the entire message. Exclude a final LF or CRLF in that shared
  parser path, preserving other whitespace, interior newlines, and raw bytes.

  Correct the existing LF and CRLF expectations, add boundary cases for empty
  and multiline titles, whitespace, lone CR, and non-UTF-8 bytes, and update
  the public documentation and gix reference example.

  Git reference: pretty.c (is_blank_line() and format_subject()) and
  t/t6006-rev-list-format.sh at 1630431f326e15fcde608827b5ff38422528eb59.
  Git 2.50.1 also returns Sync with 'maint' via %s for reference commit
  aec3f587505a472db67e9462d0702e7d463a449d, whose raw message ends in LF.

• invoke signature programs without a shell

  Treat signing and verification programs as executable paths, matching the
  argv-based launch used by Git. Shell detection treated paths containing spaces
  as shell commands, so unquoted Windows paths could fail before reaching the
  signer.

  Keep wrapper customization explicit through program_arguments and cover signer
  and verifier paths containing spaces with regression tests.

Changed (BREAKING)

• migrate errors to gix-error

  rubberstamp

• raise MSRV to Rust 1.88

  The newly published dua-core 3.3 release used by linked-worktree removal
  requires Rust 1.88, so raise every workspace crate and the advertised badge
  together.

  Keep the MSRV checks buildable by selecting the latest sysinfo and rusqlite
  release lines that support Rust 1.88.

Commit Statistics

• 18 commits contributed to the release over the course of 32 calendar days.
• 33 days passed between releases.
• 6 commits were understood as conventional.
• 1 unique issue was worked on: #​2991

Commit Details

view details

• #​2991
  • Omit the final newline from bodyless commit titles (f51c0c5)
• Uncategorized
  • Merge pull request #​2847 from GitoxideLabs/gix-error-completion (6356013)
  • Use borrowed error inspection throughout the workspace (daf73b5)
  • Migrate errors to gix-error (8c101c9)
  • Merge pull request #​2989 from GitoxideLabs/error-conversion-review (4b9ff51)
  • Merge pull request #​2990 from GitoxideLabs/various-improvements (c609062)
  • Keep rust workspace tests inside disposable repositories and isolated environments (4e0f8ff)
  • Merge pull request #​2992 from GitoxideLabs/fix-message-newline (4f29e0c)
  • Merge pull request #​2971 from GitoxideLabs/diff-nullid-fix (d7551f1)
  • Add Never::panic_on_access() to forbid object access (36e9406)
  • Merge pull request #​2958 from GitoxideLabs/sign-on-windows (c16300c)
  • Merge pull request #​2957 from GitoxideLabs/sign-on-windows (b7bedcf)
  • Invoke signature programs without a shell (9b26904)
  • Merge pull request #​2949 from GitoxideLabs/error-conversion-review (a095334)
  • Raise MSRV to Rust 1.88 (4b42e0c)
  • Merge pull request #​2955 from GitoxideLabs/transport-url-encoding (7e35849)
  • Release gix-path v0.12.6, gix-error v0.3.2, gix-command v0.10.1, gix-transport v0.59.2 (888677a)
  • Merge pull request #​2932 from GitoxideLabs/fundamental-types-comp (6704303)

v0.64.1: gix-object v0.64.1

Compare Source

Commit Statistics

• 2 commits contributed to the release.
• 1 day passed between releases.
• 0 commits were understood as conventional.
• 0 issues like '(#ID)' were seen in commit messages

Commit Details

view details

• Uncategorized
  • Use fundamental-type comparisons throughout tests (47536a5)
  • Merge pull request #​2933 from GitoxideLabs/report-august (b8914ff)

v0.64.0: gix-object v0.64.0

Compare Source

New Features (BREAKING)

• support signing and verifying annotated tags
  Breaking as it renames Tag::pgp_signature to signature.

  Extend gix-object signature support from commits to annotated tags.

  Signature infrastructure

  • Move object-independent signing and verification machinery into the shared
    gix_object::signature module.
  • Keep signature discovery available without the signature feature.
  • Continue using the existing signing and verification options and
    shared verification outcome for all object types.

  Annotated tags

  • Add Tag::sign() and TagRef::sign().
  • Add signature accessors that report both the armor and detected format.
  • Add raw extraction of a tag signature and its exact signed bytes.
  • Recognize OpenPGP signature/message, X.509, and SSH armor markers.
  • Match Git by selecting the last recognized marker at a line boundary.
  • Support native SHA-1 and SHA-256 tags without compatibility headers or
    multiple signatures.

New Features

• add explicit commit signing to gix-object

  Add plumbing for signing commits through external OpenPGP, X.509, and SSH
  programs under the shared signature feature. Accept fully resolved signer
  options so callers control the program, key, environment, and arguments
  without introducing repository configuration into the object crate.

  Replace an existing signature using the hash-appropriate commit header,
  normalize signer output, and report process and malformed-output failures
  with context. Cover every supported format, SHA-256 headers, replacement,
  literal SSH keys, and verify generated signatures through the sibling
  plumbing verifier as well as the external reference programs.

• add commit signature verification to gix-object via commit::SignedData::verify()

  Add feature-gated plumbing for verifying OpenPGP, X.509, and SSH commit
  signatures with fully resolved programs, arguments, environments, trust
  thresholds, and SSH policy inputs. Keep repository configuration out of
  the object crate while exposing Git-compatible status, identity, key, and
  fingerprint results.

  Stream signed commit data directly to OpenPGP and SSH verifiers without
  reconstructing it. Use a temporary payload only where gpgsm requires a
  file, and cover Git status parsing plus unsupported and mismatched formats.

• recognize SHA-256 commit signature headers

  Teach commit parsing and signature extraction about the gpgsig-sha256
  header used by Git when signing SHA-256 commits. Treat it like gpgsig
  when locating the embedded signature while preserving the actual header
  name when reconstructing the signed payload.

  Cover both full commit parsing and token iteration so callers observe
  the signature consistently through either API.

• add tree::name_order() for git-style tree-entry comparison

• support Assisted-by commit trailers, count them as attributions.

  Expose Assisted-by predicates and iterators alongside Co-authored-by, and
  include agent assistance in the general attribution stream without treating
  assistants as authors.

• expose commit message blocks via Commit::body()::message_blocks()
  This allows parsing messages that have been concatenated, and each message
  has its own trailers.

Commit Statistics

• 16 commits contributed to the release over the course of 30 calendar days.
• 30 days passed between releases.
• 7 commits were understood as conventional.
• 0 issues like '(#ID)' were seen in commit messages

Commit Details

view details

• Uncategorized
  • Update manifests prior to release (ebe9095)
  • Merge pull request #​2930 from GitoxideLabs/gix-notes (7424676)
  • Improve Tree::bisect_entry() to be more succinct (579544e)
  • Merge pull request #​2905 from GitoxideLabs/various-improvements (f3bbfad)
  • Support signing and verifying annotated tags (26d231b)
  • Add explicit commit signing to gix-object (ca7563e)
  • Add commit signature verification to gix-object via commit::SignedData::verify() (5b90699)
  • Recognize SHA-256 commit signature headers (a30f442)
  • Adapt to changes in gix-testtools (0cbe539)
  • Add tree::name_order() for git-style tree-entry comparison (c6cf668)
  • Merge pull request #​2901 from cruessler/switch-to-gix-odb-at-opts (2a4d996)
  • Introduce Store::at() where possible (17fea2a)
  • Merge pull request #​2834 from GitoxideLabs/tix-improvements (2fadbc7)
  • Support Assisted-by commit trailers, count them as attributions. (e5370e6)
  • Expose commit message blocks via Commit::body()::message_blocks() (f2e90e9)
  • Merge pull request #​2812 from GitoxideLabs/report-july (ae8845a)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 30bce7de-2e95-4cab-b3f9-fabe13a362d7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}