fix: index.add() now supports filters (#2021)

This is done by calling into `git hash-object` for correctness, instead
of using a mostly incorrect custom implementation for this (lacks filters).

<!-- agent -->
GitCmdObjectDB inherited LooseObjectDB.store(), so despite its name, object
writes bypassed Git and used gitdb's loose-object implementation. That path
creates and chmods object files itself, which can fail during Index.add() on
filesystems where those permission changes are unsupported.

Override store() to stream new objects through `git hash-object -w --stdin`.
This lets Git manage object creation and permissions consistently with the
repository configuration. Retain the inherited implementation for pre-hashed
objects and custom output streams, whose existing semantics hash-object cannot
provide.

Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <codex@openai.com>

Author: Byron

git/db.py

@@ -5,9 +5,12 @@
 
 __all__ = ["GitCmdObjectDB", "GitDB"]
 
-from gitdb.base import OInfo, OStream
+from subprocess import PIPE
+
+from gitdb.base import IStream, OInfo, OStream
 from gitdb.db import GitDB, LooseObjectDB
 from gitdb.exc import BadObject
+from gitdb.fun import stream_copy
 
 from git.util import bin_to_hex, hex_to_bin
 from git.exc import GitCommandError
@@ -46,6 +49,23 @@ def stream(self, binsha: bytes) -> OStream:
         hexsha, typename, size, stream = self._git.stream_object_data(bin_to_hex(binsha))
         return OStream(hex_to_bin(hexsha), typename, size, stream)
 
+    def store(self, istream: IStream) -> IStream:
+        """Store an object using git itself."""
+        if istream.binsha is not None or self.ostream() is not None:
+            return super().store(istream)
+
+        proc = self._git.hash_object("-t", istream.type, "-w", "--stdin", as_process=True, istream=PIPE)
+        assert proc.stdin is not None
+        try:
+            stream_copy(istream.read, proc.stdin.write, istream.size, self.stream_chunk_size)
+        finally:
+            proc.stdin.close()
+        assert proc.stdout is not None
+        hexsha = proc.stdout.read().strip()
+        proc.wait()
+        istream.binsha = hex_to_bin(hexsha)
+        return istream
+
     # { Interface
 
     def partial_to_complete_sha_hex(self, partial_hexsha: str) -> bytes:

test/test_db.py

@@ -3,16 +3,29 @@
 # This module is part of GitPython and is released under the
 # 3-Clause BSD License: https://opensource.org/license/bsd-3-clause/
 
+from io import BytesIO
 import os.path as osp
+from unittest import mock
+
+from gitdb import IStream
+from gitdb.db import LooseObjectDB
 
 from git.db import GitCmdObjectDB
 from git.exc import BadObject
 from git.util import bin_to_hex
 
-from test.lib import TestBase
+from test.lib import TestBase, with_rw_repo
 
 
 class TestDB(TestBase):
+    @with_rw_repo("HEAD")
+    def test_store_uses_hash_object(self, rw_repo):
+        data = b"hello world"
+        with mock.patch.object(LooseObjectDB, "store", side_effect=AssertionError("unexpected loose-object write")):
+            istream = rw_repo.odb.store(IStream("blob", len(data), BytesIO(data)))
+
+        assert rw_repo.odb.stream(istream.binsha).read() == data
+
     def test_base(self):
         gdb = GitCmdObjectDB(osp.join(self.rorepo.git_dir, "objects"), self.rorepo.git)