swhid 0.4.1 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 55ef264a7547cae4c3e201c8c4b745ea42437173efd681623bf7307c0bf58b0d
-  data.tar.gz: d851e19c5511018c5ded8e853306650414b1708a99fd10837f2e6d62a6266f13
+  metadata.gz: 5851a0a381d49b2824a6371b3cc4e1148ba8d8e6791b82d849feb5ba1860801b
+  data.tar.gz: bbb8211dea616259f3e80a5ea567d70fe3e74f44b0634f900cec78706a6913a2
 SHA512:
-  metadata.gz: db250c4038a39aa01d3a73c83a1d11ebf907a7465649b69cbff3ed3c9b44e758519c2573ca949fabc996b43ae737a5259d41c1d143ecb1dc980813dc2d6c54cc
-  data.tar.gz: abaa8a4ca6c33cc718c28f573641a207c6458c8dcb4df4440759583cd1dd9394a60c507c0d29795e4149218b1bcba8b212ee83114e1bbf6a6f0ebe99135328ef
+  metadata.gz: 7be028aff05051f058d466fa143ae540d0e360799996a9424a3193ae3d608e0362e5e853a2e2cdeca61fea635bd3fd304fea6d47e654fd64900d8c9c22e80f8d
+  data.tar.gz: 552340a1970dd51499e864d0c5ca2f6f8f9e9d4a0cb670723bcd7540f8bd5266afea57fabf5ba1d82b598df5f0653c79aa389144310a39a2b98d9cb04c46a41a

data/.ruby-version

@@ -0,0 +1 @@
+4.0.7

data/CHANGELOG.md

@@ -1,5 +1,32 @@
 ## [Unreleased]
 
+## [0.5.0] - 2026-09-20
+
+### Added
+- `Swhid.from_content_io` for hashing content from an IO without loading the entire value into memory
+- Benchmarks for large content, directories, snapshots, and Git-backed identifiers
+
+### Changed
+- Validate and canonicalize qualified SWHIDs, including nested identifiers and line and byte ranges
+- Limit snapshots to `HEAD`, local branches, and tags
+- Read Gitlink entries from the Git index when hashing filesystem directories
+- Stream file content and reuse verified Git object IDs when computing identifiers
+- Delay loading Rugged until a Git-backed API is called
+
+### Fixed
+- Reject duplicate or invalid directory entries and snapshot branch names
+- Sort directory and snapshot names by raw bytes
+- Accept `Swhid::Identifier` objects as directory targets without using Ruby object identity
+
+## [0.4.2] - 2026-01-14
+
+### Fixed
+- CLI now reads stdin and writes stdout in binary mode (fixes CRLF and binary file handling on Windows)
+- Normalize path separators for Git index lookups on Windows
+
+### Added
+- CLI integration tests for binary content and line ending preservation
+
 ## [0.4.1] - 2026-01-13
 
 ### Fixed

data/README.md

@@ -74,6 +74,11 @@ content = File.read("example.txt")
 swhid = Swhid.from_content(content)
 puts swhid.to_s # => "swh:1:cnt:..."
 
+# Stream a large file
+swhid = File.open("archive.tar", "rb") do |file|
+  Swhid.from_content_io(file, size: file.size)
+end
+
 # Empty file
 swhid = Swhid.from_content("")
 puts swhid.to_s # => "swh:1:cnt:e69de29bb2d1d6434b8b29ae775ad8c2e48c5391"

data/benchmark/benchmark.rb

@@ -4,6 +4,8 @@
 require "bundler/setup"
 require "swhid"
 require "benchmark"
+require "stringio"
+require "tmpdir"
 
 puts "SWHID Performance Benchmarks"
 puts "=" * 60
@@ -27,6 +29,33 @@ Benchmark.bm(30) do |x|
   x.report("Large content (1 MB):") do
     100.times { Swhid.from_content(content_large) }
   end
+
+  x.report("Large content IO (1 MB):") do
+    100.times do
+      Swhid.from_content_io(StringIO.new(content_large), size: content_large.bytesize)
+    end
+  end
+end
+
+puts
+puts "=" * 60
+puts
+puts "Filesystem directory hashing:"
+
+Dir.mktmpdir("swhid-benchmark") do |directory_path|
+  require "rugged"
+  repository = Rugged::Repository.init_at(directory_path)
+  1_000.times do |i|
+    File.binwrite(File.join(directory_path, "file#{i}.txt"), "content #{i}\n")
+  end
+  repository.index.add_all
+  repository.index.write
+
+  Benchmark.bm(30) do |x|
+    x.report("Filesystem (1,000 files):") do
+      10.times { Swhid::FromFilesystem.from_directory_path(directory_path) }
+    end
+  end
 end
 
 puts
@@ -48,6 +77,10 @@ entries_large = 100.times.map do |i|
   { name: "file#{i}.txt", type: :file, target: "94a9ed024d3859793618152ea559a168bbcbb5e2" }
 end
 
+entries_xlarge = 1_000.times.map do |i|
+  { name: "file#{i}.txt", type: :file, target: "94a9ed024d3859793618152ea559a168bbcbb5e2" }
+end
+
 Benchmark.bm(30) do |x|
   x.report("Small directory (1 entry):") do
     10_000.times { Swhid.from_directory(entries_small) }
@@ -60,6 +93,27 @@ Benchmark.bm(30) do |x|
   x.report("Large directory (100 entries):") do
     1_000.times { Swhid.from_directory(entries_large) }
   end
+
+  x.report("XL directory (1,000 entries):") do
+    100.times { Swhid.from_directory(entries_xlarge) }
+  end
+end
+
+puts
+puts "=" * 60
+puts
+
+# Benchmark snapshot hashing
+puts "Snapshot hashing:"
+
+branches = 1_000.times.map do |i|
+  { name: "refs/heads/branch#{i}", target_type: "revision", target: "94a9ed024d3859793618152ea559a168bbcbb5e2" }
+end
+
+Benchmark.bm(30) do |x|
+  x.report("Snapshot (1,000 branches):") do
+    100.times { Swhid.from_snapshot(branches) }
+  end
 end
 
 puts

data/exe/swhid

@@ -6,6 +6,9 @@ require "swhid"
 require "optparse"
 require "json"
 
+# Ensure consistent LF line endings on all platforms
+$stdout.binmode
+
 class SwhidCLI
   def initialize(args)
     @args = args
@@ -96,6 +99,7 @@ class SwhidCLI
   end
 
   def compute_content_swhid
+    $stdin.binmode
     content = $stdin.read
 
     swhid = Swhid.from_content(content)

data/lib/swhid/from_filesystem.rb

@@ -10,7 +10,25 @@ module Swhid
       raise ArgumentError, "Path is not a directory: #{path}" unless File.directory?(path)
 
       git_repo ||= discover_git_repo(path)
-      entries = build_entries(path, git_repo: git_repo, permissions: permissions)
+      repo_relative_path = relative_path_in_repo(path, git_repo) if git_repo
+      index_entries = load_git_index_entries(git_repo)
+      compute_directory_path(
+        path,
+        git_repo: git_repo,
+        permissions: permissions,
+        repo_relative_path: repo_relative_path,
+        index_entries: index_entries
+      )
+    end
+
+    def self.compute_directory_path(path, git_repo:, permissions:, repo_relative_path:, index_entries:)
+      entries = build_entries(
+        path,
+        git_repo: git_repo,
+        permissions: permissions,
+        repo_relative_path: repo_relative_path,
+        index_entries: index_entries
+      )
       Swhid.from_directory(entries)
     end
 
@@ -21,8 +39,9 @@ module Swhid
       nil
     end
 
-    def self.build_entries(dir_path, git_repo: nil, permissions: nil)
+    def self.build_entries(dir_path, git_repo: nil, permissions: nil, repo_relative_path: nil, index_entries: nil)
       entries = []
+      index_entries ||= load_git_index_entries(git_repo)
 
       Dir.foreach(dir_path) do |name|
         next if name == "." || name == ".."
@@ -30,21 +49,38 @@ module Swhid
 
         full_path = File.join(dir_path, name)
         stat = File.lstat(full_path)
-
-        entry = if File.symlink?(full_path)
+        relative_path = if repo_relative_path
+                          repo_relative_path.empty? ? name : "#{repo_relative_path}/#{name}"
+                        end
+        index_entry = relative_path && index_entries[relative_path]
+
+        entry = if index_entry && (index_entry[:mode] & 0o170000) == 0o160000
+                  { name: name, type: :rev, target: index_entry[:oid] }
+                elsif File.symlink?(full_path)
                   target_content = File.readlink(full_path)
                   target_hash = Swhid.from_content(target_content).object_hash
                   { name: name, type: :symlink, target: target_hash }
                 elsif stat.directory?
-                  target_swhid = from_directory_path(full_path, git_repo: git_repo, permissions: permissions)
+                  target_swhid = compute_directory_path(
+                    full_path,
+                    git_repo: git_repo,
+                    permissions: permissions,
+                    repo_relative_path: relative_path,
+                    index_entries: index_entries
+                  )
                   { name: name, type: :dir, target: target_swhid.object_hash }
-                elsif file_executable?(full_path, stat, git_repo, permissions)
-                  content = File.binread(full_path)
-                  target_hash = Swhid.from_content(content).object_hash
+                elsif file_executable?(
+                  full_path,
+                  stat,
+                  git_repo,
+                  permissions,
+                  index_entry: index_entry,
+                  index_checked: true
+                )
+                  target_hash = content_swhid_from_file(full_path, stat.size).object_hash
                   { name: name, type: :exec, target: target_hash }
                 else
-                  content = File.binread(full_path)
-                  target_hash = Swhid.from_content(content).object_hash
+                  target_hash = content_swhid_from_file(full_path, stat.size).object_hash
                   { name: name, type: :file, target: target_hash }
                 end
 
@@ -54,7 +90,13 @@ module Swhid
       entries
     end
 
-    def self.file_executable?(full_path, stat, git_repo, permissions = nil)
+    def self.content_swhid_from_file(path, size)
+      File.open(path, "rb") do |file|
+        Swhid.from_content_io(file, size: size)
+      end
+    end
+
+    def self.file_executable?(full_path, stat, git_repo, permissions = nil, index_entry: nil, index_checked: false)
       # Check explicit permissions map first (from tar extraction, etc.)
       if permissions
         real_path = File.realpath(full_path) rescue File.expand_path(full_path)
@@ -64,20 +106,29 @@ module Swhid
 
       # Check Git index for tracked files
       if git_repo
-        relative_path = relative_path_in_repo(full_path, git_repo)
-        if relative_path
-          entry = git_repo.index[relative_path]
-          if entry
-            mode = entry[:mode]
-            return (mode & 0o111) != 0
-          end
-        end
+        index_entry ||= git_index_entry(full_path, git_repo) unless index_checked
+        return (index_entry[:mode] & 0o111) != 0 if index_entry
       end
 
       # Fall back to filesystem
       stat.executable?
     end
 
+    def self.git_index_entry(full_path, git_repo)
+      return nil unless git_repo
+
+      relative_path = relative_path_in_repo(full_path, git_repo)
+      relative_path && git_repo.index[relative_path]
+    end
+
+    def self.load_git_index_entries(git_repo)
+      return {} unless git_repo
+
+      git_repo.index.each_with_object({}) do |entry, entries|
+        entries[entry[:path]] = entry if entry[:stage].zero?
+      end
+    end
+
     def self.relative_path_in_repo(full_path, git_repo)
       repo_workdir = git_repo.workdir
       return nil unless repo_workdir
@@ -86,13 +137,17 @@ module Swhid
       full_path = File.realpath(full_path) rescue File.expand_path(full_path)
       repo_workdir = File.realpath(repo_workdir) rescue File.expand_path(repo_workdir)
 
-      # Ensure repo_workdir ends with separator for proper prefix matching
-      repo_workdir = repo_workdir.chomp("/").chomp("\\") + "/"
+      # Normalize path separators for consistent comparison (especially on Windows)
+      full_path = full_path.tr("\\", "/")
+      repo_workdir = repo_workdir.tr("\\", "/")
+
+      repo_workdir = repo_workdir.chomp("/")
+      return "" if full_path == repo_workdir
 
-      return nil unless full_path.start_with?(repo_workdir)
+      repo_prefix = "#{repo_workdir}/"
+      return nil unless full_path.start_with?(repo_prefix)
 
-      relative = full_path.sub(repo_workdir, "")
-      relative.tr("\\", "/")
+      full_path.delete_prefix(repo_prefix)
     end
   end
 end

data/lib/swhid/from_git.rb

@@ -1,79 +1,39 @@
 # frozen_string_literal: true
 
-require "rugged"
+require "digest/sha1"
 
 module Swhid
   module FromGit
     def self.from_revision(repo_path, ref = "HEAD")
-      repo = Rugged::Repository.new(repo_path)
+      repo = open_repository(repo_path)
       commit = repo.rev_parse(ref)
 
       raise ArgumentError, "Reference #{ref} is not a commit" unless commit.is_a?(Rugged::Commit)
 
-      metadata = {
-        directory: commit.tree.oid,
-        parents: commit.parents.map(&:oid),
-        author: format_person(commit.author),
-        author_timestamp: commit.author[:time].to_i,
-        author_timezone: format_timezone(commit.author[:time]),
-        committer: format_person(commit.committer),
-        committer_timestamp: commit.committer[:time].to_i,
-        committer_timezone: format_timezone(commit.committer[:time]),
-        message: commit.message
-      }
-
-      # Extract extra headers if present (like gpgsig, svn headers, etc)
-      extra_headers = extract_extra_headers(repo, commit)
-      metadata[:extra_headers] = extra_headers unless extra_headers.empty?
-
-      Swhid.from_revision(metadata)
+      verify_git_object!(repo, commit.oid, :commit)
+      Identifier.new(object_type: "rev", object_hash: commit.oid)
     end
 
     def self.from_release(repo_path, tag_name)
-      repo = Rugged::Repository.new(repo_path)
+      repo = open_repository(repo_path)
       tag_ref = repo.references["refs/tags/#{tag_name}"]
 
       raise ArgumentError, "Tag #{tag_name} not found" unless tag_ref
 
-      # Get the tag object
       tag_obj = repo.lookup(tag_ref.target_id)
 
-      # Check if it's an annotated tag
       if tag_obj.is_a?(Rugged::Tag::Annotation)
-        target_type = case tag_obj.target
-                      when Rugged::Commit then "rev"
-                      when Rugged::Tag::Annotation then "rel"
-                      when Rugged::Tree then "dir"
-                      when Rugged::Blob then "cnt"
-                      else "rev"
-                      end
-
-        metadata = {
-          name: tag_obj.name,
-          target: { hash: tag_obj.target.oid, type: target_type },
-          message: tag_obj.message
-        }
-
-        if tag_obj.tagger
-          metadata[:author] = format_person(tag_obj.tagger)
-          metadata[:author_timestamp] = tag_obj.tagger[:time].to_i
-          metadata[:author_timezone] = format_timezone(tag_obj.tagger[:time])
-        end
-
-        # Extract extra headers if present (like gpgsig for signed tags)
-        extra_headers = extract_tag_extra_headers(repo, tag_obj)
-        metadata[:extra_headers] = extra_headers unless extra_headers.empty?
-
-        Swhid.from_release(metadata)
+        verify_git_object!(repo, tag_obj.oid, :tag)
+        Identifier.new(object_type: "rel", object_hash: tag_obj.oid)
       else
-        # Lightweight tag - points directly to commit
         raise ArgumentError, "Lightweight tags are not supported for release SWHIDs"
       end
     end
 
     def self.from_snapshot(repo_path)
-      repo = Rugged::Repository.new(repo_path)
+      repo = open_repository(repo_path)
       branches = []
+      target_cache = {}
 
       # Check for HEAD first
       head_path = File.join(repo.path, "HEAD")
@@ -90,12 +50,11 @@ module Swhid
         end
       end
 
-      # Get all references (branches and tags)
       repo.references.each do |ref|
         ref_name = ref.name
+        next unless ref_name.start_with?("refs/heads/", "refs/tags/")
 
         if ref.type == :symbolic
-          # This is an alias (symbolic ref)
           target_ref_name = ref.target
           branches << {
             name: ref_name,
@@ -103,22 +62,8 @@ module Swhid
             target: target_ref_name
           }
         else
-          # Direct reference
-          target_obj = ref.target
-
-          # Determine target type and OID
-          target_type, target_oid = case target_obj
-                                     when Rugged::Commit
-                                       ["revision", target_obj.oid]
-                                     when Rugged::Tag::Annotation
-                                       ["release", target_obj.oid]
-                                     when Rugged::Tree
-                                       ["directory", target_obj.oid]
-                                     when Rugged::Blob
-                                       ["content", target_obj.oid]
-                                     else
-                                       ["revision", target_obj.oid]
-                                     end
+          target_oid = ref.target_id
+          target_type = target_cache[target_oid] ||= reference_target_type(repo, target_oid)
 
           branches << {
             name: ref_name,
@@ -133,87 +78,31 @@ module Swhid
 
     private
 
-    def self.format_person(person)
-      "#{person[:name]} <#{person[:email]}>"
-    end
-
-    def self.format_timezone(time)
-      offset = time.utc_offset
-      sign = offset >= 0 ? "+" : "-"
-      hours = offset.abs / 3600
-      minutes = (offset.abs % 3600) / 60
-      format("%s%02d%02d", sign, hours, minutes)
+    def self.open_repository(repo_path)
+      require "rugged"
+      Rugged::Repository.new(repo_path)
     end
 
-    def self.extract_extra_headers(repo, commit)
-      # Rugged doesn't expose extra headers directly
-      # We need to parse the raw commit object
-      raw_data = repo.read(commit.oid).data
-      lines = raw_data.split("\n")
-
-      extra_headers = []
-      in_headers = true
-
-      lines.each do |line|
-        # Stop when we hit the blank line before the message
-        if line.empty?
-          in_headers = false
-          next
-        end
-
-        next unless in_headers
-
-        # Skip standard headers
-        next if line.start_with?("tree ", "parent ", "author ", "committer ")
-
-        # Extract extra headers (like gpgsig, mergetag, svn-repo-uuid, etc)
-        if line.start_with?(" ")
-          # Continuation of previous header
-          if extra_headers.any?
-            extra_headers.last[1] += "\n#{line[1..]}"
-          end
-        elsif line.include?(" ")
-          key, value = line.split(" ", 2)
-          extra_headers << [key, value]
-        end
+    def self.verify_git_object!(repo, oid, expected_type)
+      object = repo.read(oid)
+      unless object.type == expected_type
+        raise ValidationError, "Expected #{expected_type} object, found #{object.type}"
       end
 
-      extra_headers
+      digest = Digest::SHA1.new
+      digest.update("#{object.type} #{object.len}\0")
+      digest.update(object.data)
+      raise ValidationError, "Git object hash mismatch: #{oid}" unless digest.hexdigest == oid
     end
 
-    def self.extract_tag_extra_headers(repo, tag)
-      # Parse raw tag object for extra headers
-      raw_data = repo.read(tag.oid).data
-      lines = raw_data.split("\n")
-
-      extra_headers = []
-      in_headers = true
-
-      lines.each do |line|
-        # Stop when we hit the blank line before the message
-        if line.empty?
-          in_headers = false
-          next
-        end
-
-        next unless in_headers
-
-        # Skip standard tag headers
-        next if line.start_with?("object ", "type ", "tag ", "tagger ")
-
-        # Extract extra headers (like gpgsig for signed tags)
-        if line.start_with?(" ")
-          # Continuation of previous header
-          if extra_headers.any?
-            extra_headers.last[1] += "\n#{line[1..]}"
-          end
-        elsif line.include?(" ")
-          key, value = line.split(" ", 2)
-          extra_headers << [key, value]
-        end
+    def self.reference_target_type(repo, oid)
+      case repo.read_header(oid)[:type]
+      when :commit then "revision"
+      when :tag then "release"
+      when :tree then "directory"
+      when :blob then "content"
+      else "revision"
       end
-
-      extra_headers
     end
   end
 end

data/lib/swhid/identifier.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require "uri"
-
 module Swhid
   class Identifier
     attr_reader :scheme, :version, :object_type, :object_hash, :qualifiers
@@ -11,13 +9,13 @@ module Swhid
       @version = SCHEME_VERSION
       @object_type = validate_object_type!(object_type)
       @object_hash = validate_object_hash!(object_hash)
-      @qualifiers = qualifiers
+      @qualifiers = validate_qualifiers!(qualifiers)
     end
 
     def self.parse(swhid_string)
       raise ParseError, "SWHID string cannot be nil or empty" if swhid_string.nil? || swhid_string.empty?
 
-      core_part, *qualifier_parts = swhid_string.split(";")
+      core_part, qualifier_string = swhid_string.split(";", 2)
 
       parts = core_part.split(":")
       raise ParseError, "Invalid SWHID format" unless parts.length == 4
@@ -27,7 +25,7 @@ module Swhid
       raise ParseError, "Invalid scheme: #{scheme}" unless scheme == SCHEME
       raise ParseError, "Invalid version: #{version}" unless version == SCHEME_VERSION.to_s
 
-      qualifiers = parse_qualifiers(qualifier_parts)
+      qualifiers = parse_qualifiers(qualifier_string)
 
       new(object_type: object_type, object_hash: object_hash, qualifiers: qualifiers)
     end
@@ -74,21 +72,32 @@ module Swhid
       hash
     end
 
-    def self.parse_qualifiers(qualifier_parts)
+    def self.parse_qualifiers(qualifier_string)
       qualifiers = {}
+      return qualifiers unless qualifier_string
+
+      qualifier_string.split(";", -1).each do |part|
+        next if part.empty?
 
-      qualifier_parts.each do |part|
         key, value = part.split("=", 2)
-        next if key.nil? || value.nil?
+        raise ParseError, "Invalid qualifier: #{part}" if key.nil? || key.empty? || value.nil?
 
-        qualifiers[key.to_sym] = decode_qualifier_value(value)
+        qualifiers[key.to_sym] = if key == "origin" || key == "path"
+                                    decode_qualifier_value(key, value)
+                                  else
+                                    value
+                                  end
       end
 
       qualifiers
     end
 
-    def self.decode_qualifier_value(value)
-      URI.decode_www_form_component(value)
+    def self.decode_qualifier_value(key, value)
+      decoded = value.gsub(/%([0-9a-fA-F]{2})/) { [$1].pack("H2") }
+      decoded.force_encoding(Encoding::UTF_8)
+      return decoded if decoded.valid_encoding?
+
+      raise ParseError, "Invalid UTF-8 in #{key} qualifier"
     end
 
     def format_qualifiers(quals)
@@ -97,18 +106,71 @@ module Swhid
       ordered_quals = canonical_order.map do |key|
         next unless quals.key?(key)
 
-        "#{key}=#{encode_qualifier_value(quals[key])}"
+        value = quals[key]
+        value = encode_qualifier_value(value) if key == :origin || key == :path
+        "#{key}=#{value}"
       end.compact
 
       other_quals = quals.reject { |key, _| canonical_order.include?(key) }.map do |key, value|
-        "#{key}=#{encode_qualifier_value(value)}"
+        "#{key}=#{value}"
       end
 
       (ordered_quals + other_quals).join(";")
     end
 
     def encode_qualifier_value(value)
-      value.to_s.gsub(";", "%3B").gsub("%", "%25")
+      value.to_s.gsub(";", "%3B")
+    end
+
+    def validate_qualifiers!(qualifiers)
+      unless qualifiers.respond_to?(:each_pair)
+        raise ValidationError, "Qualifiers must be a hash"
+      end
+
+      qualifiers.each_pair.each_with_object({}) do |(key, value), validated|
+        key = key.to_s
+        unless key.match?(/\A[^;=]+\z/)
+          raise ValidationError, "Invalid qualifier key: #{key}"
+        end
+
+        validated[key.to_sym] = normalize_qualifier_value(key, value)
+      end
+    end
+
+    def normalize_qualifier_value(key, value)
+      case key
+      when "origin", "path"
+        string = value.to_s
+        raise ValidationError, "Invalid UTF-8 in #{key} qualifier" unless string.valid_encoding?
+        string
+      when "visit", "anchor"
+        parsed = value.is_a?(Identifier) ? value : Identifier.parse(value.to_s)
+        unless parsed.qualifiers.empty?
+          raise ValidationError, "Invalid #{key} qualifier: expected a core SWHID"
+        end
+        parsed.core_swhid
+      when "lines", "bytes"
+        normalize_range_qualifier!(key, value.to_s)
+      else
+        value
+      end
+    rescue ParseError, ValidationError
+      raise ValidationError, "Invalid #{key} qualifier: #{value}"
+    end
+
+    def normalize_range_qualifier!(key, value)
+      match = /\A(\d+)(?:-(\d+))?\z/.match(value)
+      raise ValidationError, "Invalid #{key} qualifier: #{value}" unless match
+
+      start_position = Integer(match[1], 10)
+      end_position = match[2] && Integer(match[2], 10)
+      max_position = (2**64) - 1
+
+      if start_position > max_position || (end_position && (end_position < start_position || end_position > max_position))
+        raise ValidationError, "Invalid #{key} qualifier: #{value}"
+      end
+
+      end_position ? "#{start_position}-#{end_position}" : start_position.to_s
     end
   end
 end

data/lib/swhid/objects/content.rb

@@ -5,14 +5,41 @@ require "digest/sha1"
 module Swhid
   module Objects
     class Content
+      READ_SIZE = 64 * 1024
+
       def self.compute(data)
         data = data.to_s if data.is_a?(Symbol)
-        data = data.b if data.respond_to?(:b)
 
         header = "blob #{data.bytesize}\0"
-        hash = Digest::SHA1.hexdigest(header + data)
+        digest = Digest::SHA1.new
+        digest.update(header)
+        digest.update(data)
+
+        Identifier.new(object_type: "cnt", object_hash: digest.hexdigest)
+      end
+
+      def self.compute_io(io, size:)
+        unless size.is_a?(Integer) && size >= 0
+          raise ArgumentError, "Content size must be a non-negative integer"
+        end
+
+        digest = Digest::SHA1.new
+        digest.update("blob #{size}\0")
+
+        bytes_read = 0
+        buffer = String.new(capacity: READ_SIZE, encoding: Encoding::BINARY)
+        while io.read(READ_SIZE, buffer)
+          break if buffer.empty?
+
+          bytes_read += buffer.bytesize
+          digest.update(buffer)
+        end
+
+        unless bytes_read == size
+          raise ArgumentError, "Content size is #{bytes_read} bytes, expected #{size}"
+        end
 
-        Identifier.new(object_type: "cnt", object_hash: hash)
+        Identifier.new(object_type: "cnt", object_hash: digest.hexdigest)
       end
 
       def self.compute_hash(data)

data/lib/swhid/objects/directory.rb

@@ -9,10 +9,14 @@ module Swhid
         attr_reader :name, :type, :target, :perms
 
         def initialize(name:, type:, target:, perms: nil)
-          @name = name
+          @name = validate_name!(name)
           @type = type
           @target = target
           @perms = perms || default_perms
+          @name_binary = @name.b.freeze
+          @perms_binary = @perms.to_s.b.freeze
+          @target_hash = pack_target_hash(target).freeze
+          @sort_key = type == :dir ? @name_binary + "/".b : @name_binary
         end
 
         def default_perms
@@ -33,28 +37,52 @@ module Swhid
         end
 
         def sort_key
-          type == :dir ? "#{name}/" : name
+          @sort_key
         end
 
         def target_hash
-          case target
+          @target_hash
+        end
+
+        def name_binary
+          @name_binary
+        end
+
+        def perms_binary
+          @perms_binary
+        end
+
+        def pack_target_hash(value)
+          case value
           when String
-            raise ValidationError, "Invalid hash length" unless target.length == 40
-            [target].pack("H*")
+            unless value.match?(/\A[0-9a-f]{#{OBJECT_ID_LENGTH}}\z/)
+              raise ValidationError, "Invalid target hash"
+            end
+            [value].pack("H*")
           when Identifier
-            [target.object_id].pack("H*")
+            [value.object_hash].pack("H*")
           else
             raise ValidationError, "Invalid target type"
           end
         end
+
+        def validate_name!(value)
+          raise ValidationError, "Directory entry name must be a string" unless value.is_a?(String)
+          raise ValidationError, "Directory entry name cannot contain a null byte" if value.include?("\0")
+          raise ValidationError, "Directory entry name cannot contain a slash" if value.include?("/")
+
+          value
+        end
       end
 
       def self.compute(entries)
         serialized = serialize_entries(entries)
         header = "tree #{serialized.bytesize}\0"
-        hash = Digest::SHA1.hexdigest(header + serialized)
+        digest = Digest::SHA1.new
+        digest.update(header)
+        digest.update(serialized)
 
-        Identifier.new(object_type: "dir", object_hash: hash)
+        Identifier.new(object_type: "dir", object_hash: digest.hexdigest)
       end
 
       def self.serialize_entries(entries)
@@ -66,14 +94,22 @@ module Swhid
           end
         end
 
+        entry_names = {}
+        entries.each do |entry|
+          name = entry.name_binary
+          raise ValidationError, "Duplicate directory entry name: #{entry.name}" if entry_names.key?(name)
+
+          entry_names[name] = true
+        end
+
         sorted_entries = entries.sort_by(&:sort_key)
 
-        sorted_entries.map do |entry|
-          # Convert name to binary UTF-8 to match target_hash encoding
-          name_binary = entry.name.encode(Encoding::UTF_8).force_encoding(Encoding::BINARY)
-          perms_binary = entry.perms.encode(Encoding::UTF_8).force_encoding(Encoding::BINARY)
-          "#{perms_binary} #{name_binary}\0#{entry.target_hash}"
-        end.join
+        capacity = sorted_entries.sum { |entry| entry.perms_binary.bytesize + entry.name_binary.bytesize + 22 }
+        serialized = String.new(capacity: capacity, encoding: Encoding::BINARY)
+        sorted_entries.each do |entry|
+          serialized << entry.perms_binary << 32 << entry.name_binary << 0 << entry.target_hash
+        end
+        serialized
       end
 
       def self.compute_hash(entries)

data/lib/swhid/objects/release.rb

@@ -16,9 +16,11 @@ module Swhid
       def self.compute(metadata)
         serialized = serialize_metadata(metadata)
         header = "tag #{serialized.bytesize}\0"
-        hash = Digest::SHA1.hexdigest(header + serialized)
+        digest = Digest::SHA1.new
+        digest.update(header)
+        digest.update(serialized)
 
-        Identifier.new(object_type: "rel", object_hash: hash)
+        Identifier.new(object_type: "rel", object_hash: digest.hexdigest)
       end
 
       def self.serialize_metadata(metadata)

data/lib/swhid/objects/revision.rb

@@ -8,9 +8,11 @@ module Swhid
       def self.compute(metadata)
         serialized = serialize_metadata(metadata)
         header = "commit #{serialized.bytesize}\0"
-        hash = Digest::SHA1.hexdigest(header + serialized)
+        digest = Digest::SHA1.new
+        digest.update(header)
+        digest.update(serialized)
 
-        Identifier.new(object_type: "rev", object_hash: hash)
+        Identifier.new(object_type: "rev", object_hash: digest.hexdigest)
       end
 
       def self.serialize_metadata(metadata)

data/lib/swhid/objects/snapshot.rb

@@ -9,7 +9,7 @@ module Swhid
         attr_reader :name, :target_type, :target
 
         def initialize(name:, target_type:, target: nil)
-          @name = name
+          @name = validate_name!(name)
           @target_type = target_type
           @target = target
         end
@@ -23,6 +23,13 @@ module Swhid
 
         private
 
+        def validate_name!(value)
+          raise ValidationError, "Snapshot branch name must be a string" unless value.is_a?(String)
+          raise ValidationError, "Snapshot branch name cannot contain a null byte" if value.include?("\0")
+
+          value
+        end
+
         def compute_target_identifier
           case target_type
           when "content", "directory", "revision", "release", "snapshot"
@@ -39,7 +46,7 @@ module Swhid
         def extract_hash_bytes(value)
           hash_string = case value
                        when String
-                         value.length == 40 ? value : nil
+                         value.match?(/\A[0-9a-f]{#{OBJECT_ID_LENGTH}}\z/) ? value : nil
                        when Identifier
                          value.object_hash
                        else
@@ -55,9 +62,11 @@ module Swhid
       def self.compute(branches)
         serialized = serialize_branches(branches)
         header = "snapshot #{serialized.bytesize}\0"
-        hash = Digest::SHA1.hexdigest(header + serialized)
+        digest = Digest::SHA1.new
+        digest.update(header)
+        digest.update(serialized)
 
-        Identifier.new(object_type: "snp", object_hash: hash)
+        Identifier.new(object_type: "snp", object_hash: digest.hexdigest)
       end
 
       def self.serialize_branches(branches)
@@ -69,7 +78,9 @@ module Swhid
           end
         end
 
-        sorted_branches = branch_objects.sort_by(&:name)
+        sorted_branches = branch_objects.sort_by { |branch| branch.name.b }
+        duplicate = sorted_branches.each_cons(2).find { |left, right| left.name.b == right.name.b }
+        raise ValidationError, "Duplicate snapshot branch name: #{duplicate.first.name}" if duplicate
 
         sorted_branches.map(&:serialize).join
       end

data/lib/swhid/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Swhid
-  VERSION = "0.4.1"
+  VERSION = "0.5.0"
 end

data/lib/swhid.rb

@@ -28,6 +28,10 @@ module Swhid
     Objects::Content.compute(content)
   end
 
+  def self.from_content_io(io, size:)
+    Objects::Content.compute_io(io, size: size)
+  end
+
   def self.from_directory(entries)
     Objects::Directory.compute(entries)
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: swhid
 version: !ruby/object:Gem::Version
-  version: 0.4.1
+  version: 0.5.0
 platform: ruby
 authors:
 - Andrew Nesbitt
@@ -33,6 +33,7 @@ executables:
 extensions: []
 extra_rdoc_files: []
 files:
+- ".ruby-version"
 - CHANGELOG.md
 - CODE_OF_CONDUCT.md
 - LICENSE
@@ -73,7 +74,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.1
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Generate and parse SoftWare Hash IDentifiers (SWHIDs)
 test_files: []