GitoxideLabs/gitoxide gix-object-v0.64.0

gix-object v0.64.0

on GitHub

New Features (BREAKING)

• support signing and verifying annotated tags
  Breaking as it renames Tag::pgp_signature to signature.

  Extend gix-object signature support from commits to annotated tags.

  Signature infrastructure

  • Move object-independent signing and verification machinery into the shared
    gix_object::signature module.
  • Keep signature discovery available without the signature feature.
  • Continue using the existing signing and verification options and
    shared verification outcome for all object types.

  Annotated tags

  • Add Tag::sign() and TagRef::sign().
  • Add signature accessors that report both the armor and detected format.
  • Add raw extraction of a tag signature and its exact signed bytes.
  • Recognize OpenPGP signature/message, X.509, and SSH armor markers.
  • Match Git by selecting the last recognized marker at a line boundary.
  • Support native SHA-1 and SHA-256 tags without compatibility headers or
    multiple signatures.

New Features

• add explicit commit signing to gix-object

  Add plumbing for signing commits through external OpenPGP, X.509, and SSH
  programs under the shared signature feature. Accept fully resolved signer
  options so callers control the program, key, environment, and arguments
  without introducing repository configuration into the object crate.

  Replace an existing signature using the hash-appropriate commit header,
  normalize signer output, and report process and malformed-output failures
  with context. Cover every supported format, SHA-256 headers, replacement,
  literal SSH keys, and verify generated signatures through the sibling
  plumbing verifier as well as the external reference programs.

• add commit signature verification to gix-object via commit::SignedData::verify()

  Add feature-gated plumbing for verifying OpenPGP, X.509, and SSH commit
  signatures with fully resolved programs, arguments, environments, trust
  thresholds, and SSH policy inputs. Keep repository configuration out of
  the object crate while exposing Git-compatible status, identity, key, and
  fingerprint results.

  Stream signed commit data directly to OpenPGP and SSH verifiers without
  reconstructing it. Use a temporary payload only where gpgsm requires a
  file, and cover Git status parsing plus unsupported and mismatched formats.

• recognize SHA-256 commit signature headers

  Teach commit parsing and signature extraction about the gpgsig-sha256
  header used by Git when signing SHA-256 commits. Treat it like gpgsig
  when locating the embedded signature while preserving the actual header
  name when reconstructing the signed payload.

  Cover both full commit parsing and token iteration so callers observe
  the signature consistently through either API.

• add tree::name_order() for git-style tree-entry comparison

• support Assisted-by commit trailers, count them as attributions.

  Expose Assisted-by predicates and iterators alongside Co-authored-by, and
  include agent assistance in the general attribution stream without treating
  assistants as authors.

• expose commit message blocks via Commit::body()::message_blocks()
  This allows parsing messages that have been concatenated, and each message
  has its own trailers.

Commit Statistics

• 16 commits contributed to the release over the course of 30 calendar days.
• 30 days passed between releases.
• 7 commits were understood as conventional.
• 0 issues like '(#ID)' were seen in commit messages

Commit Details