# zit 0.14.5

zit 0.14.5 confines where a sync connects and what it sends there: it no
longer follows a redirect to another host, and a caller can pin the address
it dials.

This release is from trunk. Stores, caches and the wire are unchanged from
0.14.4; nothing is rebuilt on upgrade.

## Redirects stay on the host

`push`, `pull`, `sync` and `clone` followed an HTTP redirect to any host.
The request was sent again to the new host as it stood: the login card,
which names the user and carries a signature made with the saved secret,
and on a push the content itself. Upgrade if you sync with a server you do
not fully trust, or through one that can be made to redirect.

- A redirect is now followed only to the same host and port. An upgrade
  from http to https on the same host, both on their default ports, still
  follows.
- Any other redirect stops the command before anything is sent to the
  target: "the peer redirected to URL, another host or port; not followed".
  Run the command against that URL if you trust it.
- The existing rules stand: at most 19 redirects, and never from https to
  http.

This is stricter than Fossil, which follows a redirect to another host.

## --resolve

`--resolve HOST:PORT:ADDR` on `push`, `pull`, `sync` and `clone` makes zit
dial ADDR for HOST:PORT instead of resolving the name, as curl's option
does. The TLS server name, the certificate check and the Host header stay
HOST. ADDR is an IPv4 address, or an IPv6 address with or without square
brackets. Up to 8 may be given.

When any is given, zit connects only to a host and port that has an entry,
and refuses any other: "no --resolve entry for HOST:PORT; not connecting".
A caller that must not reach certain addresses, such as a forge syncing
with a URL a user supplied, resolves the name itself, checks the address
and passes it. zit holds no address rules of its own.

## Qualification

The release manifest records native qualification against the exact tagged
source archive on macOS ARM64, Linux x86-64 and Linux ARM64, using the pinned
Zig 0.17.0 toolchain. Publication is gated on unit and end-to-end tests, Git
differentials, deterministic simulation, seeded fuzzing, and Fossil
interoperability checks on every distributed target.

For the basis of the conformance claim, see
[the 0.1.0 release notes](RELEASE-NOTES-0.1.0.md).