Address review feedback about repository formats

Codex review noted that default initialization in SHA256-only builds wrote a v0 repository without extensions.objectFormat, causing gix::init() to fail when reopening the repository. Default creation options now select Sha256 when SHA1 support is unavailable, so the written repository can be opened by the same build.

Codex review also noted that repository format versions greater than 1 were treated as supporting extensions.objectFormat. Opening now rejects unsupported repository format versions before interpreting extensions, matching Git's fail-closed behavior.

Validated with:
- cargo test -p gix --lib default_object_hash_matches_available_hash_support
- cargo test -p gix --no-default-features --features sha256 --lib default_object_hash_matches_available_hash_support
- cargo test -p gix --test gix rejects_future_repository_format_versions
- cargo test -p gix --test gix rejects_object_format_on_v0_repo
- cargo check -p gix --no-default-features --features sha256

Author: codex

gix/src/config/cache/incubate.rs

@@ -45,11 +45,12 @@ impl StageOne {
             .map(|version| Core::REPOSITORY_FORMAT_VERSION.try_into_usize(version))
             .transpose()?
             .unwrap_or_default();
-        let object_hash = match config.string(Extensions::OBJECT_FORMAT) {
-            // objectFormat is honored from repository format version 1 onwards.
-            Some(format) if repo_format_version >= 1 => Extensions::OBJECT_FORMAT.try_into_object_format(format)?,
-            Some(_) => return Err(Error::ObjectFormatRequiresV1),
-            None => legacy_object_hash()?,
+        let object_hash = match (repo_format_version, config.string(Extensions::OBJECT_FORMAT)) {
+            // objectFormat is a repository format version 1 extension.
+            (1, Some(format)) => Extensions::OBJECT_FORMAT.try_into_object_format(format)?,
+            (0, Some(_)) => return Err(Error::ObjectFormatRequiresV1),
+            (0 | 1, None) => legacy_object_hash()?,
+            (version, _) => return Err(Error::UnsupportedRepositoryFormatVersion { version }),
         };
 
         let extension_worktree = util::config_bool(

gix/src/config/mod.rs

@@ -91,6 +91,8 @@ pub enum Error {
          set core.repositoryFormatVersion=1 to use it, or remove extensions.objectFormat to fall back to the default Sha1 format (if supported by this build)"
     )]
     ObjectFormatRequiresV1,
+    #[error("Unsupported repository format version {version}; only versions 0 and 1 are supported")]
+    UnsupportedRepositoryFormatVersion { version: usize },
     #[error(transparent)]
     CoreAbbrev(#[from] abbrev::Error),
     #[error("Could not read configuration file at \"{}\"", path.display())]

gix/src/create.rs

@@ -108,7 +108,7 @@ fn create_dir(p: &Path) -> Result<(), Error> {
 }
 
 /// Options for use in [`into()`];
-#[derive(Copy, Default, Clone)]
+#[derive(Copy, Clone)]
 pub struct Options {
     /// Control whether the destination directory must be empty when creating a repository with a worktree.
     ///
@@ -134,6 +134,31 @@ pub struct Options {
     pub object_hash: Option<gix_hash::Kind>,
 }
 
+impl Default for Options {
+    fn default() -> Self {
+        Options {
+            destination_must_be_empty: None,
+            fs_capabilities: None,
+            object_hash: default_object_hash(),
+        }
+    }
+}
+
+fn default_object_hash() -> Option<gix_hash::Kind> {
+    #[cfg(feature = "sha1")]
+    {
+        None
+    }
+    #[cfg(all(not(feature = "sha1"), feature = "sha256"))]
+    {
+        Some(gix_hash::Kind::Sha256)
+    }
+    #[cfg(all(not(feature = "sha1"), not(feature = "sha256")))]
+    {
+        unreachable!("hash support features are validated by gix-hash")
+    }
+}
+
 /// Create a new `.git` repository of `kind` within the possibly non-existing `directory`
 /// and return its path.
 /// Note that this is a simple template-based initialization routine which should be accompanied with additional corrections
@@ -286,3 +311,22 @@ fn bool(v: bool) -> &'static str {
         false => "false",
     }
 }
+
+#[cfg(test)]
+mod tests {
+    #[test]
+    fn default_object_hash_matches_available_hash_support() {
+        let object_hash = super::Options::default().object_hash;
+        #[cfg(feature = "sha1")]
+        assert_eq!(
+            object_hash, None,
+            "SHA1-capable builds keep Git's implicit legacy object format"
+        );
+        #[cfg(all(not(feature = "sha1"), feature = "sha256"))]
+        assert_eq!(
+            object_hash,
+            Some(gix_hash::Kind::Sha256),
+            "SHA256-only builds must initialize repositories that can be reopened"
+        );
+    }
+}

gix/tests/fixtures/generated-archives/make_config_repos.tar

@@ -178,6 +178,18 @@ EOF
   )
 done
 
+git init repository-format-v2-with-objectformat-sha1
+(cd repository-format-v2-with-objectformat-sha1
+  # Future repository formats may change invariants beyond the object hash. Git
+  # refuses such repositories before interpreting extensions; gix should too.
+  cat <<EOF >>.git/config
+[core]
+	repositoryFormatVersion = 2
+[extensions]
+	objectFormat = sha1
+EOF
+)
+
 git init ssl-verify-disabled
 (cd ssl-verify-disabled
   git config http.sslVerify false

gix/tests/fixtures/make_config_repos.sh

@@ -378,6 +378,24 @@ mod object_format_extension {
         }
         Ok(())
     }
+
+    #[test]
+    fn rejects_future_repository_format_versions() -> crate::Result {
+        let err = named_subrepo_opts(
+            "make_config_repos.sh",
+            "repository-format-v2-with-objectformat-sha1",
+            gix::open::Options::isolated(),
+        )
+        .expect_err("future repository format versions must be rejected");
+        assert!(
+            matches!(
+                err,
+                gix::open::Error::Config(gix::config::Error::UnsupportedRepositoryFormatVersion { version: 2 })
+            ),
+            "future repository format versions must be rejected before interpreting extensions, got {err:?}"
+        );
+        Ok(())
+    }
 }
 
 mod open_path_as_is {