zit 0.3.43

zit 0.3.43 targets revision -01 of the Fossil drafts, which fold every erratum into the text, and brings its behaviour into line with them where Fossil and the -00 text disagreed. It also closes a weakness in the sync server's handling of authentication.

zit version now reports targets Fossil RFC rev 01. The -01 drafts ship in docs/rfcs/ beside the -00 texts they replace.

No artifact, tag namespace, wire, or on-disk repository format changed. The repository cache's layout version changed, so the first command after upgrading rebuilds derived state once.

Security: cards before a valid login no longer borrow its rights

The sync server used to grant a request's rights once, after verifying its login card, to every card in the request, including cards placed before the login. A captured signed request could be extended with cards ahead of the login card, and those cards ran with the signer's rights. Each card is now judged by the rights in force where it appears, as the draft requires and as Fossil does. Hosts that serve a repository over zit serve should upgrade.

Check-in times follow a date tag

A check-in amended with a date tag is ordered by the tag's value, not by its original D card, as Fossil orders it. The newest date tag wins, a cancelled one restores the original time, and a value that does not parse is ignored. Tips, leaves, tip, plain-name resolution, info, timeline and log --long all follow the retimed check-in. log --long now prints the event time in whole seconds, as info and timeline do, rather than the D card's milliseconds. Dates before 1970 are outside zit's time range, for D cards and date tags alike, as before.

A reply cut short no longer aborts the sync

A sync reply whose body ends inside a file, cfile or uvfile payload used to abort the exchange. pull, push, sync, config and uv now keep everything they processed before the cut, print one warning naming the count, and continue as after any other handler error, exiting 0 as Fossil's do. clone prints the warning, says the clone is incomplete, leaves the directory for you to remove, and exits non-zero, as Fossil's clone fails. The server's answer to a short payload is unchanged: malformed file line.

Artifact format

• An F card naming a reserved filename is dropped before it can set the artifact's type, as Fossil drops it; a manifest whose only F cards are reserved resolves to a control artifact and is rejected.
• A delta manifest whose baseline is itself a delta is read as Fossil reads it: one level, from the baseline's own F cards. zit used to reject it. A commit atop such a baseline writes a full manifest.
• An F card without a hash in a manifest that is not a delta is rejected.

Repository state

• A singleton tag applied by a T card now walks the check-in's descendants as a cancel, removing the same-named inherited tag, as Fossil's crosslink does.
• A tag operation that is skipped as older than the row it would replace no longer starts a propagation walk.
• Trailing punctuation in a symbolic name is retried exactly as Fossil retries it: one or two of . _ ) > ! ? , are stripped from a name long enough to carry them. trunk^, rel. and release; no longer resolve; 0.3.0's notes advertised trunk^, and that form is gone.

Sync protocol

• Artifact names on file and cfile cards are validated as 40 or 64 lowercase hex characters; anything else is malformed file line.
• A second login card is multiple login cards.
• A duplicate delta card is ignored, and an absent delta source becomes a phantom that a later gimme requests, as in Fossil.
• A failed login's reply carries the timestamp line, and a push refused after an accepted pull is answered with message pull only - not authorized to push rather than an error.
• A redirect target has one trailing /xfer stripped, not every one.

Compatibility

• The release ships docs/rfcs/draft-fossil-{artifact-format,repo-state, sync-protocol}-01.txt; section numbers are unchanged from -00, and each -01 ends with an appendix listing its changes.
• trunk^ and other non-Fossil trailing punctuation no longer resolve.
• No other command's output changed.

Qualification

Qualified on macos-aarch64 with the full local battery: format check, ReleaseSafe build, unit tests, e2e, deterministic simulation (seed 1, 1000 steps), all 32 fuzz targets at 100 rounds, and the smoke suite three times against fossil 2.28 [52445a27f1]. Linux targets are qualified when the release is cut.