show package/resource revision_ids, disallow setting them

new PR because the old one #1430 was accidentally closed