The kstring integration in gix-attributes is unsound
gix-attributes (in state::ValueRef) unsafely creates a &str from a &[u8] containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB: // SAFETY: our API makes accessing that value as str impossible, so illformed UTF8 is never exposed as such. The problem is that the non-UTF8 str is exposed to outside code: first to …