@gitkraken/core-gitlens 0.3.1 → 0.4.100

package/src/git-cli/parsers/logParser.ts

@@ -76,7 +76,7 @@ const graphMapping = {
 	message: '%B',
 };
 
-type GraphLogParser = LogParser<typeof graphMapping>;
+export type GraphLogParser = LogParser<typeof graphMapping>;
 let _graphParser: GraphLogParser | undefined;
 type GraphWithStatsLogParser = LogParserWithStats<typeof graphMapping>;
 let _graphWithStatsParser: GraphWithStatsLogParser | undefined;
@@ -223,6 +223,14 @@ export type AsyncParser<T> = {
 	separators: { record: string; field: string };
 	parse: (data: string | Iterable<string> | undefined) => Generator<T> | Iterable<T>;
 	parseAsync: (stream: AsyncGenerator<string>) => AsyncGenerator<T>;
+	/**
+	 * Like `parseAsync` but yields one ARRAY of entries per stream chunk, scanning each chunk
+	 * synchronously with plain `indexOf` (no per-field iterator machinery). Bulk consumers (the
+	 * graph walk) avoid two promise hops per record — thousands of awaited yields collapse to one
+	 * per chunk. Only the plain parser implements it; per-record `parseAsync` remains the
+	 * general-purpose path.
+	 */
+	parseAsyncBatched?: (stream: AsyncGenerator<string>) => AsyncGenerator<T[]>;
 };
 
 export type LogParser<T> = AsyncParser<LogParsedEntry<T>>;
@@ -280,6 +288,20 @@ const recordFormatSep = '%x1E';
 const fieldSep = '\x1D'; // ASCII Group Separator character
 const fieldFormatSep = '%x1D';
 
+// A complete record terminates every mapped field with a field separator — a cancelled/early-closed
+// stream resolves cleanly with a truncated tail missing at least the final terminator.
+function isCompleteRecord(record: string, requiredFields: number): boolean {
+	let count = 0;
+	let index = -1;
+	while (count < requiredFields) {
+		index = record.indexOf(fieldSep, index + 1);
+		if (index === -1) return false;
+
+		count++;
+	}
+	return true;
+}
+
 export function createLogParser<T extends Record<string, string>>(mapping: ExtractAll<T, string>): LogParser<T> {
 	let format = recordFormatSep;
 	const keys: (keyof ExtractAll<T, string>)[] = [];
@@ -339,6 +361,8 @@ export function createLogParser<T extends Record<string, string>>(mapping: Extra
 
 		for await (const record of records) {
 			if (!record.length) continue;
+			// Drop a truncated tail (cancelled/early-closed stream) instead of yielding undefined/partial fields.
+			if (!isCompleteRecord(record, keys.length)) continue;
 
 			entry = {} as unknown as LogParsedEntry<T>;
 			fields = iterateByDelimiter(record, fieldSep);
@@ -361,11 +385,65 @@ export function createLogParser<T extends Record<string, string>>(mapping: Extra
 		sw?.stop({ suffix: ` parsed ${count} records` });
 	}
 
+	// Builds one entry from a complete record with a plain `indexOf` walk. Matches `parseAsync`'s
+	// semantics exactly: fields beyond the mapping are ignored, and every mapped field is
+	// terminated by a field separator (the format string appends one after each field).
+	function parseRecord(record: string): LogParsedEntry<T> {
+		const entry = {} as unknown as LogParsedEntry<T>;
+		let start = 0;
+		for (const key of keys) {
+			const end = record.indexOf(fieldSep, start);
+			if (end === -1) break;
+
+			entry[key] = record.substring(start, end) as T[keyof T];
+			start = end + 1;
+		}
+		return entry;
+	}
+
+	async function* parseAsyncBatched(stream: AsyncGenerator<string>): AsyncGenerator<LogParsedEntry<T>[]> {
+		using sw = maybeStopWatch('Git.LogParser.parseAsyncBatched', { log: { onlyExit: true, level: 'debug' } });
+
+		let count = 0;
+		let buffer = '';
+		for await (const chunk of stream) {
+			buffer += chunk;
+
+			let batch: LogParsedEntry<T>[] | undefined;
+			let start = 0;
+			while (true) {
+				const end = buffer.indexOf(recordSep, start);
+				if (end === -1) break;
+
+				if (end > start) {
+					(batch ??= []).push(parseRecord(buffer.substring(start, end)));
+					count++;
+				}
+				start = end + 1;
+			}
+			if (start > 0) {
+				buffer = buffer.substring(start);
+			}
+			if (batch != null) {
+				yield batch;
+			}
+		}
+		// Trailing record (the stream doesn't end with a record separator); a truncated tail from a
+		// cancelled/early-closed stream is missing a field terminator and must be dropped, not parsed.
+		if (buffer.length > 0 && isCompleteRecord(buffer, keys.length)) {
+			count++;
+			yield [parseRecord(buffer)];
+		}
+
+		sw?.stop({ suffix: ` parsed ${count} records` });
+	}
+
 	return {
 		arguments: args,
 		separators: { record: recordSep, field: fieldSep },
 		parse: parse,
 		parseAsync: parseAsync,
+		parseAsyncBatched: parseAsyncBatched,
 	};
 }
 
@@ -605,6 +683,8 @@ function createLogParserWithFilesAndStats<T extends Record<string, string> | voi
 
 		for await (const record of records) {
 			if (!record.length) continue;
+			// Drop a truncated tail (cancelled/early-closed stream) instead of yielding undefined/partial fields.
+			if (!isCompleteRecord(record, keys.length)) continue;
 
 			count++;
 			entry = {} as unknown as LogParsedEntryWithFilesAndStats<T>;
@@ -955,6 +1035,8 @@ function createLogParserWithPatch<T extends Record<string, string>>(
 
 		for await (const record of records) {
 			if (!record.length) continue;
+			// Drop a truncated tail (cancelled/early-closed stream) instead of yielding undefined/partial fields.
+			if (!isCompleteRecord(record, keys.length)) continue;
 
 			count++;
 			entry = {} as unknown as LogParsedEntryWithFiles<T>;

package/src/git-cli/parsers/sshSignatureParser.ts

@@ -0,0 +1,85 @@
+import type { SshPublicKey } from '../../git/models/signature.js';
+import { isValidSshKeyData, isValidSshKeyType } from '../../git/utils/sshKey.utils.js';
+
+const sshSigMagic = 'SSHSIG';
+const gpgSigHeaderRegex = /^gpgsig(?:-sha256)? /;
+const sshSigArmorRegex = /-----BEGIN SSH SIGNATURE-----\n([\s\S]*?)\n-----END SSH SIGNATURE-----/;
+// A commit header line: `committer Display Name <email> <unix-ts> <tz>`.
+const committerRegex = /^committer (.*) <([^>]*)> \d+ [-+]\d+$/m;
+
+/**
+ * Extracts the committer's name and raw email from a commit object. The raw email (not a mailmapped one) is the
+ * principal Git checks an SSH signature against, so it's what an `allowed_signers` entry must use.
+ */
+export function extractCommitterFromCommitObject(commitObject: string): { name: string; email: string } | undefined {
+	const match = committerRegex.exec(commitObject);
+	if (match == null) return undefined;
+
+	return { name: match[1], email: match[2] };
+}
+
+/**
+ * Extracts the signer's full SSH public key from a commit object's `gpgsig` SSH signature.
+ *
+ * A commit signed with `gpg.format=ssh` stores an armored `-----BEGIN SSH SIGNATURE-----` (SSHSIG) blob in its
+ * `gpgsig` header, and the SSHSIG wire format embeds the signer's full public key — exactly what an `allowed_signers`
+ * entry requires. (`git log`'s signature fields only expose the key fingerprint, never the full key.)
+ *
+ * @param commitObject Raw commit object text, as produced by `git cat-file commit <sha>`
+ * @returns The key type and base64 public-key blob, or `undefined` if the commit isn't SSH-signed or can't be parsed.
+ */
+export function extractSshPublicKeyFromCommitObject(commitObject: string): SshPublicKey | undefined {
+	const armored = extractArmoredSignature(commitObject);
+	if (armored == null) return undefined;
+
+	const buffer = Buffer.from(armored, 'base64');
+
+	// SSHSIG wire format (see OpenSSH PROTOCOL.sshsig):
+	//   byte[6] MAGIC "SSHSIG" | uint32 version | string publickey | string namespace | ...
+	// where each `string` is a big-endian uint32 length followed by that many bytes.
+	if (buffer.length < 10 || buffer.toString('latin1', 0, 6) !== sshSigMagic) return undefined;
+
+	// `publickey` is the first length-prefixed string, after the 6-byte magic and 4-byte version.
+	const pubKeyBlob = readSshString(buffer, 10);
+	if (pubKeyBlob == null) return undefined;
+
+	// The public-key blob itself begins with its key type as a length-prefixed string.
+	const keyType = readSshString(pubKeyBlob, 0)?.toString('utf8');
+	if (!keyType) return undefined;
+
+	const keyData = pubKeyBlob.toString('base64');
+	// The signature blob is attacker-controllable (Git stores it verbatim and never verifies it on read), so reject
+	// anything that isn't a recognized key type / well-formed base64 before it can become an `allowed_signers` entry.
+	if (!isValidSshKeyType(keyType) || !isValidSshKeyData(keyData)) return undefined;
+
+	return { keyType: keyType, keyData: keyData };
+}
+
+/** Extracts and concatenates the base64 body of the armored SSH signature from a commit's `gpgsig` header. */
+function extractArmoredSignature(commitObject: string): string | undefined {
+	const lines = commitObject.split('\n');
+	const start = lines.findIndex(l => gpgSigHeaderRegex.test(l));
+	if (start === -1) return undefined;
+
+	// The header value, followed by continuation lines (each indented with a single leading space).
+	const block = [lines[start].replace(gpgSigHeaderRegex, '')];
+	for (let i = start + 1; i < lines.length; i++) {
+		if (!lines[i].startsWith(' ')) break;
+
+		block.push(lines[i].slice(1));
+	}
+
+	const match = sshSigArmorRegex.exec(block.join('\n'));
+	return match != null ? match[1].replace(/\s+/g, '') : undefined;
+}
+
+/** Reads a length-prefixed SSH wire-format string (big-endian uint32 length + bytes) at `offset`. */
+function readSshString(buffer: Buffer, offset: number): Buffer | undefined {
+	if (offset + 4 > buffer.length) return undefined;
+
+	const start = offset + 4;
+	const end = start + buffer.readUInt32BE(offset);
+	if (end > buffer.length) return undefined;
+
+	return buffer.subarray(start, end);
+}

package/src/git-cli/parsers/worktreeParser.ts

@@ -39,8 +39,6 @@ export function parseGitWorktrees(
 	let index: number;
 	let key: string;
 	let value: string;
-	let locked: string;
-	let prunable: string;
 	let main = true; // the first worktree is the main worktree
 
 	for (line of iterateByDelimiter(data, '\n')) {
@@ -54,7 +52,7 @@ export function parseGitWorktrees(
 		}
 
 		if (!key && entry != null) {
-			// eslint-disable-next-line no-loop-func
+			// oxlint-disable-next-line no-loop-func
 			const branch = entry.branch ? branches?.find(b => b.name === entry!.branch) : undefined;
 			const uri = fileUri(entry.path!);
 
@@ -96,13 +94,13 @@ export function parseGitWorktrees(
 			case 'detached':
 				entry.detached = true;
 				break;
+			// `value` is the whole reason, which is only present when the locker/Git provides one.
+			// Reasons with unusual characters (e.g. newlines) come through C-quoted, per `core.quotePath`
 			case 'locked':
-				[, locked] = value.split(' ', 2);
-				entry.locked = locked?.trim() || true;
+				entry.locked = value.trim() || true;
 				break;
 			case 'prunable':
-				[, prunable] = value.split(' ', 2);
-				entry.prunable = prunable?.trim() || true;
+				entry.prunable = value.trim() || true;
 				break;
 		}
 	}

package/src/git-cli/providers/branches.ts

@@ -693,7 +693,7 @@ export class BranchesGitSubProvider implements GitBranchesSubProvider {
 							'--',
 						);
 
-						if (result.cancelled || signal?.aborted) {
+						if (result.completion.status === 'cancelled' || signal?.aborted) {
 							throw new CancellationError();
 						}
 
@@ -727,7 +727,7 @@ export class BranchesGitSubProvider implements GitBranchesSubProvider {
 	async getDefaultBranchName(
 		repoPath: string | undefined,
 		remote?: string,
-		options?: { priority?: GitCommandPriority },
+		options?: { priority?: GitCommandPriority; local?: boolean },
 		cancellation?: AbortSignal,
 	): Promise<string | undefined> {
 		if (repoPath == null) return undefined;
@@ -736,6 +736,25 @@ export class BranchesGitSubProvider implements GitBranchesSubProvider {
 		const priority = options?.priority;
 		const priorityOpts = priority != null ? { priority: priority } : undefined;
 
+		// Local-only: read just the existing local symref, never contacting the remote. Bypass the shared
+		// cache entirely — it's keyed by repoPath+remote, so caching a local miss (or sharing this in-flight
+		// promise) would starve a concurrent networked caller of the real default branch. The local read is
+		// a cheap ref lookup, fine to repeat per call.
+		if (options?.local) {
+			try {
+				const result = await this.git.run(
+					{ cwd: this.cache.getCommonPath(repoPath), cancellation: cancellation, ...priorityOpts },
+					'symbolic-ref',
+					'--short',
+					`refs/remotes/${remote}/HEAD`,
+				);
+				return result.stdout.trim() || undefined;
+			} catch (ex) {
+				if (isCancellationError(ex)) throw ex;
+				return undefined;
+			}
+		}
+
 		return this.cache.getDefaultBranchName(repoPath, remote, async commonPath => {
 			let retried = false;
 			while (true) {
@@ -868,20 +887,32 @@ export class BranchesGitSubProvider implements GitBranchesSubProvider {
 	}
 
 	@debug()
-	getBranchMergedStatus(
+	async getBranchMergedStatus(
 		repoPath: string,
 		branch: GitBranchReference,
 		into: GitBranchReference,
 		cancellation?: AbortSignal,
 	): Promise<GitBranchMergedStatus> {
 		if (branch.name === into.name || branch.upstream?.name === into.name) {
-			return Promise.resolve({ merged: false });
+			return { merged: false };
 		}
 
+		// Hoisted so it can feed the cache key below (its tip is a 3rd key input) and the mapper
+		// below reuses it instead of resolving it a second time.
+		const localInto = into.remote
+			? await this.getLocalBranchByUpstream(repoPath, into.name, cancellation)
+			: undefined;
+
 		// Cache key omits repoPath so worktrees of the same common repo share the cached answer.
-		// Branch refs (`refs/heads/*` / `refs/remotes/*`) are unique within a common repo, so
-		// `name` + `remote` flag is the minimal stable identity.
-		const cacheKey = `${branch.remote ? 'r' : 'l'}:${branch.name}|${into.remote ? 'r' : 'l'}:${into.name}`;
+		// Content-keyed on the involved tip shas (the result is a pure function of them), so tip
+		// movement mints a new key instead of relying on eviction; falls back to the name-only
+		// identity when a sha is missing (defensive — the sole caller always supplies both tips).
+		const cacheKey =
+			branch.sha != null && into.sha != null
+				? `${branch.remote ? 'r' : 'l'}:${branch.name}@${branch.sha}|${into.remote ? 'r' : 'l'}:${into.name}@${into.sha}${
+						localInto?.sha != null ? `|L:${localInto.name}@${localInto.sha}` : ''
+					}`
+				: `${branch.remote ? 'r' : 'l'}:${branch.name}|${into.remote ? 'r' : 'l'}:${into.name}`;
 
 		return this.cache.getBranchMergedStatus(
 			repoPath,
@@ -890,38 +921,29 @@ export class BranchesGitSubProvider implements GitBranchesSubProvider {
 				const result = await this.getBranchMergedStatusCore(commonPath, branch, into, signal);
 				if (result.merged) return result;
 
-				// If the branch we are checking is a remote branch, check if it has been merged into its local branch (if there is one)
-				if (into.remote) {
-					const localIntoBranch = await this.getLocalBranchByUpstream(commonPath, into.name, signal);
-					// If there is a local branch and it is not the branch we are checking, check if it has been merged into it
-					if (localIntoBranch != null && localIntoBranch.name !== branch.name) {
-						// Skip the second full merge-check cycle when the local branch points at the same commit as the remote —
-						// the merge-base/cherry/diff/apply pipeline would produce the same answer we already got for `into` above
-						if (localIntoBranch.sha != null && localIntoBranch.sha === into.sha) {
-							return { merged: false };
-						}
+				// If there is a local branch and it is not the branch we are checking, check if it has been merged into it
+				if (localInto != null && localInto.name !== branch.name) {
+					// Skip the second full merge-check cycle when the local branch points at the same commit as the remote —
+					// the merge-base/cherry/diff/apply pipeline would produce the same answer we already got for `into` above
+					if (localInto.sha != null && localInto.sha === into.sha) {
+						return { merged: false };
+					}
 
-						const result = await this.getBranchMergedStatusCore(
-							commonPath,
-							branch,
-							localIntoBranch,
-							signal,
-						);
-						if (result.merged) {
-							// `localBranchOnly` is built against `commonPath` here; the cache mapper rewrites
-							// `repoPath`/`id` to the requesting worktree on retrieval.
-							return {
-								...result,
-								localBranchOnly: createReference(localIntoBranch.ref, localIntoBranch.repoPath, {
-									id: localIntoBranch.id,
-									refType: 'branch',
-									name: localIntoBranch.name,
-									remote: localIntoBranch.remote,
-									upstream: localIntoBranch.upstream,
-									sha: localIntoBranch.sha,
-								}),
-							};
-						}
+					const result = await this.getBranchMergedStatusCore(commonPath, branch, localInto, signal);
+					if (result.merged) {
+						// `localBranchOnly` is built against `commonPath` here; the cache mapper rewrites
+						// `repoPath`/`id` to the requesting worktree on retrieval.
+						return {
+							...result,
+							localBranchOnly: createReference(localInto.ref, commonPath, {
+								id: getBranchId(commonPath, localInto.remote, localInto.name),
+								refType: 'branch',
+								name: localInto.name,
+								remote: localInto.remote,
+								upstream: localInto.upstream,
+								sha: localInto.sha,
+							}),
+						};
 					}
 				}
 

package/src/git-cli/providers/commits.ts

@@ -10,7 +10,7 @@ import type { GitLog } from '../../git/models/log.js';
 import type { GitReflog } from '../../git/models/reflog.js';
 import type { GitRevisionRange } from '../../git/models/revision.js';
 import type { SearchQuery, SearchQueryFilters } from '../../git/models/search.js';
-import type { CommitSignature } from '../../git/models/signature.js';
+import type { CommitSignature, SshSignedCommit } from '../../git/models/signature.js';
 import type { GitUser } from '../../git/models/user.js';
 import type {
 	GitCommitReachability,
@@ -58,6 +58,10 @@ import {
 } from '../parsers/logParser.js';
 import { getReflogParser, parseGitRefLog } from '../parsers/reflogParser.js';
 import { parseSignatureOutput, signatureFormat } from '../parsers/signatureParser.js';
+import {
+	extractCommitterFromCommitObject,
+	extractSshPublicKeyFromCommitObject,
+} from '../parsers/sshSignatureParser.js';
 import { createCommitFileset } from './commitFilesetUtils.js';
 import { convertStashesToStdin } from './stash.js';
 
@@ -118,7 +122,7 @@ export class CommitsGitSubProvider implements GitCommitsSubProvider {
 			rev,
 			'--',
 		);
-		if (result.cancelled || cancellation?.aborted) {
+		if (result.completion.status === 'cancelled' || cancellation?.aborted) {
 			throw new CancellationError();
 		}
 
@@ -146,7 +150,7 @@ export class CommitsGitSubProvider implements GitCommitsSubProvider {
 			'--remotes',
 			'--',
 		);
-		if (result.cancelled || cancellation?.aborted) {
+		if (result.completion.status === 'cancelled' || cancellation?.aborted) {
 			throw new CancellationError();
 		}
 
@@ -178,7 +182,7 @@ export class CommitsGitSubProvider implements GitCommitsSubProvider {
 			...parser.arguments,
 			rev,
 		);
-		if (result.cancelled || cancellation?.aborted) return undefined;
+		if (result.completion.status === 'cancelled' || cancellation?.aborted) return undefined;
 
 		for (const entry of parser.parse(result.stdout)) {
 			const authorSeconds = Number(entry.authorDate);
@@ -331,9 +335,9 @@ export class CommitsGitSubProvider implements GitCommitsSubProvider {
 				return { refs: refs };
 			} catch (ex) {
 				cacheable?.invalidate();
-				debugger;
 				if (isCancellationError(ex)) throw ex;
 
+				debugger;
 				scope?.error(ex);
 
 				return undefined;
@@ -440,7 +444,7 @@ export class CommitsGitSubProvider implements GitCommitsSubProvider {
 					'HEAD',
 					'--',
 				);
-				if (result.cancelled || cancellation?.aborted) {
+				if (result.completion.status === 'cancelled' || cancellation?.aborted) {
 					throw new CancellationError();
 				}
 
@@ -475,7 +479,7 @@ export class CommitsGitSubProvider implements GitCommitsSubProvider {
 				range,
 				'--',
 			);
-			if (result.cancelled || cancellation?.aborted) {
+			if (result.completion.status === 'cancelled' || cancellation?.aborted) {
 				throw new CancellationError();
 			}
 			if (!result.stdout) return undefined;
@@ -887,7 +891,7 @@ export class CommitsGitSubProvider implements GitCommitsSubProvider {
 						}
 						return moreLog.commits;
 					},
-					// eslint-disable-next-line no-loop-func
+					// oxlint-disable-next-line no-loop-func
 					query: (limit: number | undefined) =>
 						this.getLogCore(log.repoPath, rev, { ...options, limit: limit }),
 				};
@@ -1255,6 +1259,10 @@ export class CommitsGitSubProvider implements GitCommitsSubProvider {
 			rev1,
 			rev2,
 		);
+		// A cancelled check has no answer. `completion` now keeps that distinct from a real "is an ancestor"
+		// result — the missing `exitCode` alone already makes the check below `false` — but callers branch on
+		// `isCancellationError`, so this still has to throw rather than quietly answer "no".
+		if (cancellation?.aborted) throw new CancellationError();
 		return result.exitCode === 0;
 	}
 
@@ -1304,8 +1312,30 @@ export class CommitsGitSubProvider implements GitCommitsSubProvider {
 			let stashes: Map<string, GitStashCommit> | undefined;
 			let stdin: string | undefined;
 
+			let resolvedShas: Set<string> | undefined;
 			if (shas?.size) {
-				stdin = join(shas, '\n');
+				resolvedShas = await this.provider.revision.resolveShas(repoPath, shas, cancellation);
+				if (cancellation?.aborted) throw new CancellationError();
+				// Short SHA(s) matched no commit: return empty (empty stdin to `--no-walk --stdin`
+				// would return HEAD, so we must not fall through to git).
+				if (!resolvedShas.size) {
+					return {
+						search: search,
+						log: {
+							repoPath: repoPath,
+							commits: new Map(),
+							sha: undefined,
+							searchFilters: filters,
+							count: 0,
+							limit: options?.limit ?? cfg?.search?.maxItems ?? 0,
+							hasMore: false,
+						},
+					};
+				}
+			}
+
+			if (resolvedShas?.size) {
+				stdin = join(resolvedShas, '\n');
 				args.push('--no-walk');
 			} else if (!filters.refs) {
 				// Don't include stashes when using ref: filter, as they would add unrelated commits
@@ -1476,6 +1506,69 @@ export class CommitsGitSubProvider implements GitCommitsSubProvider {
 			return false;
 		}
 	}
+
+	@debug()
+	async getCommitsSshSigners(repoPath: string, shas: string[]): Promise<Map<string, SshSignedCommit>> {
+		const scope = getScopedLogger();
+
+		const result = new Map<string, SshSignedCommit>();
+		if (shas.length === 0) return result;
+
+		try {
+			// Read every commit object in a single `cat-file --batch` process (the SHAs are piped to stdin) rather than
+			// spawning one `git` per commit — the embedded SSH signature and committer identity are then parsed from
+			// each raw object, avoiding a separate (and far heavier) `git log` pass to enumerate identities.
+			const data = await this.git.run<Buffer>(
+				{ cwd: repoPath, errors: 'ignore', stdin: `${shas.join('\n')}\n`, encoding: 'buffer' },
+				'cat-file',
+				'--batch',
+			);
+			parseCatFileBatchForSshSigners(data.stdout, new Set(shas), result);
+		} catch (ex) {
+			scope?.error(ex);
+		}
+		return result;
+	}
+}
+
+/**
+ * Parses `git cat-file --batch` output, extracting the embedded SSH public key (if any) from each requested commit
+ * object. Each record is `<sha> <type> <size>` LF `<content>` LF (or `<sha> missing` LF), and the object's bytes are
+ * consumed using the header's `<size>` rather than scanned line-by-line — so a commit/tag body line that happens to
+ * look like an object header can never be misread as a boundary. Operates on the raw `Buffer` because `<size>` counts
+ * bytes, not decoded characters.
+ *
+ * Exported for unit testing.
+ */
+export function parseCatFileBatchForSshSigners(
+	stdout: Buffer,
+	requestedShas: Set<string>,
+	out: Map<string, SshSignedCommit>,
+): void {
+	const headerRegex = /^([0-9a-f]{40,64}) (commit|tag|blob|missing)(?: (\d+))?$/;
+
+	let offset = 0;
+	while (offset < stdout.length) {
+		const newline = stdout.indexOf(0x0a, offset);
+		if (newline === -1) break;
+
+		const match = headerRegex.exec(stdout.toString('utf8', offset, newline));
+		offset = newline + 1;
+		// A missing object (or an unrecognizable header) has no content body following its header line.
+		if (match == null || match[2] === 'missing') continue;
+
+		const sha = match[1];
+		const object = stdout.toString('utf8', offset, offset + Number(match[3]));
+		offset += Number(match[3]) + 1; // consume the object's bytes and the trailing newline that separates records
+
+		if (!requestedShas.has(sha)) continue;
+
+		const key = extractSshPublicKeyFromCommitObject(object);
+		if (key == null) continue;
+
+		const committer = extractCommitterFromCommitObject(object);
+		out.set(sha, { key: key, name: committer?.name, email: committer?.email });
+	}
 }
 
 function toCommit(c: ParsedCommit, repoPath: string, pathspec: string | undefined, currentUser: GitUser | undefined) {