zit 0.14.4

zit 0.14.4 stops a saved login from being sent to any server but the one it was saved for, lets a Git mirror be refreshed from a small throwaway fetch instead of a kept clone, and imports three kinds of Git history that 0.14.3 refused.

This release is from trunk. Stores, caches and the wire are unchanged from 0.14.3; nothing is rebuilt on upgrade.

A saved login belongs to the saved remote

After zit push URL --user U, zit saved the derived secret in the store and signed a login as U on every later push, pull or sync that named no user, whatever URL it contacted. A server other than the one the login was made for was told the user name and received a signature made with the secret. Upgrade if a store that holds a saved login also talks to other servers.

• Sent only to the saved remote. The saved login is used only when the URL contacted is the saved remote (zit remote), compared without any user@. To any other URL, a push, pull or sync without --user is anonymous, and one with --user needs the password.
• Saved only for the saved remote. A login is saved after an authenticated push, pull or sync to the saved remote. With no remote saved, that URL becomes the saved remote. To any other URL nothing is saved, and zit says so: "login not saved: URL is not the saved remote".
• --once on push, pull and sync authenticates that run and saves nothing, as Fossil's flag does. clone --once no longer saves a login either.
• zit remote. Setting a different URL, or --unset, drops the saved login.
• After upgrading. A store that holds a login and a saved remote keeps using it for that remote. A store that holds a login but no saved remote no longer sends it: pass --user once more, or set the remote first.

import-git

• Adding from a fetch that holds only what is new. import-git --into refused a shallow source unless every file beneath its cut was present. It now accepts a source cut off at commits the destination already holds, without the files only those commits carry: the new commits need them only to diff against, and the destination has them. So a mirror can be refreshed from a fresh shallow, partial fetch of the new commits and no clone has to be kept between pulls. A cut at a commit the destination does not hold is refused, as before.
• --recorded-refs DEST lists the refs DEST's last import recorded, without a Git source: OID<TAB>REFNAME per line, sorted by name, the format git ls-remote prints. A caller compares the two to see whether anything moved before it fetches. Heads and tags only; each OID is the commit the ref resolved to, so an annotated tag matches ls-remote's REFNAME^{} line. Pull-request refs and tags of blobs are not recorded and so are not listed. -F json prints {"schema_version":1,"refs":[{"name":...,"oid":...}]}. A destination with no commit map fails with exit 1.
• A commit whose encoding Git cannot name. A commit that declares an encoding Git has no converter for (curl's history has one, spelled with quotes) stopped the import with "a header line is not original-oid, author, committer or data". Such a commit now keeps its message bytes as stored. A commit whose declared encoding Git knows is converted to UTF-8, as before.
• A tag of a tag stopped the import with UnresolvedMark. It now names the check-in it peels to.
• A tag of a blob (Git's own history tags a public key this way) stopped the import the same way. No check-in can carry it, so it is left out, and the import reports how many it left out and the first.

Qualification

The release manifest records native qualification against the exact tagged source archive on macOS ARM64, Linux x86-64 and Linux ARM64, using the pinned Zig 0.17.0 toolchain. Publication is gated on unit and end-to-end tests, Git differentials, deterministic simulation, seeded fuzzing, and Fossil interoperability checks on every distributed target.

For the basis of the conformance claim, see the 0.1.0 release notes.