C Only\sa\spush\swrites
D 2026-10-04T18:10:39.877
E 2026-10-04T18:10:39 d4ac392196a8d8aa58deb2c1ba563d3b33ea583c
N text/x-markdown
U dmestas
W 1449
A Fossil sync request names what it is for. `pull` asks for content, `push`
offers it, and a sync sends both. Fossil's server trusts the offer only when
the request said `push` and the account may write; a `file` card in any
other request is refused with `not authorized to write`.

zit's server did not ask. It stored every `file` card a request carried, and
treated every `igot` as an offer, asking the client for anything it named.
The push card was checked by nobody. quarry, zit's forge, found it from the
outside: its front lets anonymous pulls through and checks logins only on
requests that say `push`. A `pull` request with a `file` card in it passed
the front, and the zit behind it stored the artifact.

0.3.37 takes Fossil's rule. Content comes only with a push, and only from a
login when the server has one. Anything else is refused whole, before a byte
is stored. An `igot` from a client that is not pushing is an announcement,
not an offer, so it no longer makes the server ask for the content. Nothing
changes for zit's own client, which has always sent `push` when it pushed.

`zit serve` on its own still takes any push: it has no logins to check. It is
meant to run behind a front that has them, as quarry's does, or on hosts you
trust.

The same release adds cherry-picks and backouts to `zit crosslink`, one
`cherrypick +HASH` or `cherrypick -HASH` line per Q card, so an indexer can
draw them without parsing manifests again.

Z e7b0981cb3259e8196c13af6e5669f92