# zit 0.3.37
zit 0.3.37 closes a hole in the sync server: it stored content from requests
that were not pushes, including anonymous ones. It also adds cherry-picks and
backouts to the `zit crosslink` stream.
No artifact, tag namespace, or on-disk repository format changed.
## Only a push writes
`zit serve` stored every `file` card a request carried, whether or not the
request had sent `push`, and made a phantom of every `igot`, so the next reply
asked the client for it. A front that gates pushes by looking for the `push`
card, as quarry does, was bypassed by a `pull` request carrying content. The
responder also let a request with no login push when it was given a
credential.
The server now follows Fossil's rule. File content is taken only from a
request that sent `push`, and when the responder has a credential, only from
one that also logged in. Anything else is refused whole with Fossil's own
`error not authorized to write`, and nothing is stored. An `igot` from a
client that may not write no longer makes a phantom. Pulls are answered as
before. `zit serve` itself has no credential and still takes any push: put it
behind a front that checks logins, or keep it to hosts you trust.
zit's own client always sends `push` when it pushes, so `push` and `sync`
between zit peers are unchanged.
## `crosslink` names cherry-picks
Each `zit crosslink` record now has one line per Q card:
```
cherrypick (+|-)HASH
```
`+` is a check-in cherry-picked into this one and `-` one it backs out, signed
as the Q card writes it. The line comes after the `tag` lines and before the
`file` lines. The stream stays `crosslink 1`: a consumer skips a line it does
not know.
## Compatibility
- No on-disk repository or wire format changed; Fossil RFC revision 00
remains the target.
- A client that sent file content without a push card, or pushed anonymously
to a server with a credential, is now refused. Fossil's server refuses both.
- `zit crosslink` records may carry the new `cherrypick` line.
## Qualification
`zig fmt --check`, `zig build test`, `e2e`, `smoke` (18 scenarios),
`git-import-e2e`, `git-export-e2e`, and `dst`, plus the three-runner battery.