feat(gix): hash and store objects natively

Implement managed object hashing/writing for blobs, trees, commits and tags. Validate the native serialization in an in-memory ODB before persisting bytes, and preserve the input position on fallback. Limit native input to 8 MiB. Once a native write starts, convert its error without retrying via Git.

The staged version passes Ruff and Python syntax checks. Its SHA-1/SHA-256 native smoke and focused pytest selection pass: 8 passed in 1.20s.

Author: codex

git/_backend.py

@@ -350,6 +350,53 @@ def _update_index(repo: Any, args: List[str], kwargs: Dict[str, Any]) -> bytes:
     return str(_index(repo, kwargs).version()).encode("ascii") + b"\n"
 
 
+def _write(method: str, function: Callable[[], Any]) -> Any:
+    """Once a write starts, an error must not cause a second attempt through Git."""
+    try:
+        return function()
+    except gix.Error as exc:
+        raise GitCommandError(["gix", method], 128, str(exc)) from exc
+
+
+def _input(kwargs: Dict[str, Any]) -> bytes:
+    stream = kwargs.get("istream")
+    if stream is None or not hasattr(stream, "seekable") or not stream.seekable():
+        raise _Unsupported("nonseekable input")
+    start = stream.tell()
+    try:
+        stream.seek(0, 2)
+        if stream.tell() - start > 8 * 1024 * 1024:
+            raise _Unsupported("large object streaming (GIX-2)")
+        stream.seek(start)
+        data = stream.read()
+    finally:
+        stream.seek(start)
+    if not isinstance(data, bytes):
+        raise _Unsupported("nonbinary input")
+    return data
+
+
+def _hash_object(repo: Any, args: List[str], kwargs: Dict[str, Any]) -> bytes:
+    if len(args) not in (3, 4) or args[0] != "-t" or args[-1] != "--stdin":
+        raise _Unsupported("object hashing options")
+    write = args[2:-1] == ["-w"]
+    if args[2:-1] not in ([], ["-w"]):
+        raise _Unsupported("object hashing options")
+    kind = args[1]
+    if kind not in ("blob", "tree", "commit", "tag"):
+        raise _Unsupported("object kind")
+    data = _input(kwargs)
+    # Validate and check the encoded bytes in memory before touching object storage.
+    memory = repo.with_object_memory()
+    oid = memory.write_object(kind, data)
+    if memory.find_object(oid).data != data:
+        raise _Unsupported("object serialization changes bytes (GIX-5)")
+    if write:
+        oid = _write("hash_object", lambda: repo.write_object(kind, data))
+    kwargs["istream"].seek(len(data), 1)
+    return str(oid).encode("ascii") + b"\n"
+
+
 _HANDLERS: Dict[str, Callable[[Any, List[str], Dict[str, Any]], bytes]] = {
     "rev_parse": _rev_parse,
     "ls_tree": _ls_tree,
@@ -358,6 +405,7 @@ def _update_index(repo: Any, args: List[str], kwargs: Dict[str, Any]) -> bytes:
     "merge_base": _merge_base,
     "ls_files": _ls_files,
     "update_index": _update_index,
+    "hash_object": _hash_object,
     "config": _config,
     "worktree": _worktree,
 }

test/test_gix_backend.py

@@ -7,7 +7,7 @@
 import pytest
 
 from git import Git, Repo, _backend
-from git.exc import InvalidGitRepositoryError
+from git.exc import GitCommandError, InvalidGitRepositoryError
 from gitdb import IStream
 
 gix = pytest.importorskip("gix")
@@ -69,6 +69,23 @@ def test_unknown_command_and_storage_environment_use_cli(repo):
         assert cli.call_count == 3
 
 
+def test_a_native_write_failure_is_not_retried(repo, monkeypatch):
+    attempts = []
+
+    def fail():
+        attempts.append("write")
+        raise gix.Error("write failed after it began")
+
+    def handler(native, args, kwargs):
+        return _backend._write("test_write", fail)
+
+    monkeypatch.setitem(_backend._HANDLERS, "test_write", handler)
+    with patch.object(Git, "execute", side_effect=AssertionError("must not retry through CLI")):
+        with pytest.raises(GitCommandError, match="write failed after it began"):
+            repo.git._call_process_safe("test_write")
+    assert attempts == ["write"]
+
+
 def test_partial_native_stream_does_not_corrupt_next_read(repo):
     one = repo.odb.store(IStream("blob", 6, BytesIO(b"abcdef"))).binsha
     two = repo.odb.store(IStream("blob", 3, BytesIO(b"xyz"))).binsha