Fair enough about the security requirements. I'm still not sure that a dependency on ```git_buf``` is appropriate for formatting a date.

How about implementing in a similar fashion as this:
```
char *git_oid_allocfmt(const git_oid *oid)
{
	char *str = git__malloc(GIT_OID_HEXSZ + 1);
	if (!str)
		return NULL;
	git_oid_nfmt(str, GIT_OID_HEXSZ + 1, oid);
	return str;
}
```

Where ```git_oid_nfmt``` will be replaced by a ```snprintf``` which (on Windows) maps to

```
#if _MSC_VER >= 1400
# define snprintf(BUF, SZ, FMT, ...) _snprintf_s(BUF, SZ, _TRUNCATE, FMT, __VA_ARGS__)
#else
# define snprintf _snprintf
#endif
```