review

I didn't try to fix all the issues with this, let's just make it a little bit
better hoping the code won't be around much longer.

<!-- agent -->
# Known limitations
Commit.encoding still conflates the declared encoding with the codec used for
best-effort decoding. Unsupported or malformed declarations leave the default
encoding—or an earlier accepted declaration—in place, so the resulting attribute
does not faithfully represent the commit’s original metadata. The rejected
header bytes appear in the diagnostic but are not retained on the object.

Fallback decoding with "replace" can irreversibly alter identity and
message content. Reserializing such a commit can therefore change both its
encoding declaration and its content; this change does not provide lossless
round-tripping. Codec validation also checks only that Python accepts the codec,
not that it can decode the actual commit content.

Assisted-by: GPT 6.1 Sol
Co-authored-by: GPT 6.1 Sol <codex@openai.com>

Author: Byron

git/objects/commit.py

@@ -897,14 +897,16 @@ def _deserialize(self, stream: BytesIO) -> "Commit":
         buf = enc.strip()
         while buf:
             if buf[0:9] == b"encoding ":
-                encoding = buf[buf.find(b" ") + 1 :].decode(self.encoding, "ignore")
+                raw_encoding = buf[9:]
                 try:
+                    # Codec names are ASCII, independent of the content encoding.
+                    encoding = raw_encoding.decode("ascii")
                     # Probe one byte: decoding b"" skips the codec lookup entirely.
                     b" ".decode(encoding, "replace")
                 except (LookupError, ValueError):
-                    # The encoding is not a text encoding Python knows; keep the
-                    # default so the identity and message lines still decode below.
-                    _logger.error("Ignoring unknown commit encoding %r", encoding)
+                    # Reject malformed names and non-text codecs without changing
+                    # the current encoding (the default unless a valid header was read).
+                    _logger.error("Ignoring invalid commit encoding %r", raw_encoding)
                 else:
                     self.encoding = encoding
             elif buf[0:7] == b"gpgsig ":

test/test_commit.py

@@ -493,6 +493,26 @@ def test_deserialization_unknown_declared_encoding(self):
         self.assertEqual(cmt.author.name, "Andr�")
         self.assertEqual(cmt.message, "R�sum�\n")
 
+    def test_deserialization_multiple_encoding_headers(self):
+        for headers in (
+            b"encoding utf-16-be\nencoding ISO-8859-1\n",
+            b"encoding ISO-8859-1\nencoding utf-\xff8\n",
+        ):
+            with self.subTest(headers=headers):
+                data = (
+                    b"tree 3385f7b1e5f91930a3bd3e07105e113fca29981d\n"
+                    b"author Andr\xe9 <andre@example.com> 1112591163 +0200\n"
+                    b"committer Andr\xe9 <andre@example.com> 1112591163 +0200\n" + headers + b"\n"
+                    b"R\xe9sum\xe9\n"
+                )
+                cmt = self.rorepo.commit()
+                cmt._deserialize(BytesIO(data))
+
+                self.assertEqual(cmt.encoding, "ISO-8859-1")
+                self.assertEqual(cmt.author.name, "André")
+                self.assertEqual(cmt.committer.name, "André")
+                self.assertEqual(cmt.message, "Résumé\n")
+
     @with_rw_directory
     def test_identity_cannot_alter_headers(self, rw_dir):
         """A name or email must not add header lines or present another identity."""