= Release Cycle 2022-03-01

It's March 1st, the sun is out, the days are getting longer, and
Catholic traditions says to eat pancakes for some reason which I'm not
going to debate. Great changes are coming!

Tagged-As: 516a6feda58f0edb4b4863835a106738058a8c46

== Breaking Changes

. All `rad-` prefixed packages and binaries are now prefixed by
`lnk-`. This was to avoid overlap of naming in subcommands of the main
executable.

== New Features

. Nada

== Improvements

. `bins` now has a `Cargo.lock` file. The fact that it didn't have one
was an oversight when first introducing the workspace.

. The codebase is now rust-1.59 compliant.

. Replication now verifies all identity updates.

. Replication enforces that sigrefs and fetched refs are consistent.

. Replication minimises the transfers by not asking for what it
already has.

. The SPDX identifier for licensing is used instead, savipng a whopping
total of 150 bytes of blurb per source file.

. The MacOS build was failing due to some imports, this was fixed.

== Shortlog

Alex Good (1):
      Rename rad-* binaries to lnk-*

Fintan Halpenny (10):
      Merge tag 'kim/patches/repl3/veriall/v2'
      bins: add Cargo.lock
      ci(macos): fix imports
      Merge tag 'patches/fix-macos-build/v1'
      clippy: update to rust-1.59
      Merge tag 'patches/rust-1-59/v1'
      Merge tag 'kim/patches/repl3/must-sigref/v1'
      Merge tag 'alx/patches/rename-rad-to-lnk/v3'
      Merge tag 'patches/bins-cargo-lock/v1'
      Merge tag 'kim/patches/repl3/minimal-transfers/v2'

Kim Altintop (6):
      replication: verify all identity updates
      link-replication: enforce sigrefs
      meta: update TODO.md
      replication: minimal transfers
      replication: simplify control flow
      meta: use SPDX identifier in license header

> . Replication now verifies all identity updates.
> . Replication enforces that sigrefs and fetched refs are consistent.

Please note that, while these are not _technically_ breaking changes:

- they apply to replication-v3
- they accept _less_ remote trees, specifically:
  - if the identity histories are broken
  - if ref trees are not properly signed
  - if the signed refs mention objects which are not actually present

  We try to make it so that the invalid trees are pruned, but there are
  situations in which there is little choice but to fail the entire transfer.
  Iow, it is advisable to only serve validated data.