A Fossil sync request names what it is for. pull asks for content, push
offers it, and a sync sends both. Fossil's server trusts the offer only when
the request said push and the account may write; a file card in any
other request is refused with not authorized to write.
zit's server did not ask. It stored every file card a request carried, and
treated every igot as an offer, asking the client for anything it named.
The push card was checked by nobody. quarry, zit's forge, found it from the
outside: its front lets anonymous pulls through and checks logins only on
requests that say push. A pull request with a file card in it passed
the front, and the zit behind it stored the artifact.
0.3.37 takes Fossil's rule. Content comes only with a push, and only from a
login when the server has one. Anything else is refused whole, before a byte
is stored. An igot from a client that is not pushing is an announcement,
not an offer, so it no longer makes the server ask for the content. Nothing
changes for zit's own client, which has always sent push when it pushed.
zit serve on its own still takes any push: it has no logins to check. It is
meant to run behind a front that has them, as quarry's does, or on hosts you
trust.
The same release adds cherry-picks and backouts to zit crosslink, one
cherrypick +HASH or cherrypick -HASH line per Q card, so an indexer can
draw them without parsing manifests again.