Update Changes.
Disallow "." and ".." in package descriptors.
Initial SFTP support.