186 releases 186 tags

RSS feed

• v1.17.5 f0d4d74573

  Compare

  Morphit v1.17.5 Stable

  agorise released this 2026-09-13 03:59:01 +00:00 | 11 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.17.5

  The fast-sync snapshot pipeline now actually runs. Three separate faults meant it
  had never worked end to end — which is why no snapshot had ever been published
  since the feature shipped. All three were found by rehearsing the thing for real
  rather than by inspecting it. No protocol or consensus change.

  Fixed

  • Publishing a snapshot works. The publisher read the snapshot's own
    description sheet by handing it to a small helper program down the same channel
    the program itself arrives on — so the description was discarded and the helper
    received nothing. It failed on the very first attempt, every time, which is why
    no federation snapshot had ever been published. The description is now handed
    over separately.
  • Mirroring a snapshot works. The mirror job looked for the IPFS data store in
    the wrong place: it ran as the system administrator, whose data store is empty,
    rather than as the account that owns the real one. So it refused to fetch a file
    the very same machine was already serving. It now uses the right account, and
    its start-up check confirms the data store is genuinely reachable instead of
    merely confirming the software is installed — a check that could not tell the
    two situations apart.
  • The fast-sync rehearsal needs no database. --verify-only was meant to
    fetch and check a snapshot without touching anything, but one leftover database
    lookup ran before it finished, so it failed on any machine without a configured
    indexer. That lookup is only needed when actually restoring, and is now skipped.
  • A rehearsal no longer demands invented settings. It insisted on four
    configuration values it never used. It now fills in the ones it does not need
    and asks only for the chain identifier — which is deliberately never guessed,
    because it is the check that stops a node accepting a snapshot from a different
    chain.
  • Snapshot size reads correctly. A 583 kB snapshot was reported as "0 MB",
    which looked like the export had failed.

  Notes

  • No protocol/consensus change. Everything here is publisher- and
    operator-facing.
  • The first federation snapshot is now published and anchored on-chain, and has
    been fetched and verified from an unrelated machine over a public gateway. New
    instances can fast-sync.
  • OPERATIONS.md §52 covers the pipeline, how to publish, and how to check it.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    5 downloads · 2026-09-13 04:27:15 +00:00 · 1 KiB
  • morphit-v1.17.5.tar.gz
    2 downloads · 2026-09-13 04:27:15 +00:00 · 32 MiB
  • morphit-v1.17.5.tar.gz.sha256
    2 downloads · 2026-09-13 04:27:15 +00:00 · 89 B
• v1.17.4 6c5d7be15b

  Compare

  Morphit v1.17.4 Stable

  agorise released this 2026-09-12 20:39:29 +00:00 | 12 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.17.4

  A polish release, written entirely from watching three real upgrades. Nothing
  here changes what Morphit does — it changes what the upgrade tells you while
  it does it. No protocol or consensus change.

  Fixed

  • Long steps no longer look frozen. Installing dependencies, redeploying the
    MCP server, seeding to IPFS and refreshing the snapshot mirror could each sit
    silent for a minute or more with nothing on screen. Every one of them now turns
    a spinner while it works, so you can always tell the difference between "busy"
    and "stuck". Their output is replayed in full when the step finishes.

  • The seeding self-check can finally see your addresses. It reported "no
    public origin found" and "no hidden address configured" on all three
    instances — including one that is reachable only over Tor and I2P, where the
    message was plainly absurd. Cause: it read one config file and your settings
    live in the other one. It now reads both, plus the web-firewall's own hostname
    as a last resort.

  • Hidden-only upgrades show their release notes. A node that fetches over
    Tor/I2P had no release page to read notes from, so it printed an empty heading
    and you upgraded blind. The notes ship inside the tarball, so they are now read
    from there — the same bytes the SHA-256 already covers.

  • The gateway check no longer raises a false alarm. It asked the gateway for
    an address the gateway does not serve, then read the resulting error as proof
    the connection was blocked — so it announced a problem on every instance,
    including ones demonstrably working. It now asks for something the gateway does
    serve, and treats any reply at all as proof the path is open.

  • Your own instance card now shows your own badge. A node scores its
    clearnet-elimination gate for peers, but never recorded it for itself — so the
    one instance that had actually earned the "Zero use of clearnet internet" medal
    was the only place it didn't appear. Every peer showed it correctly. The self
    card now reads the same gate everyone else sees.

  • Your own instance card no longer disagrees with your peers about your
    status. A node labelled itself only "Good" or "Syncing", while peers applied
    an orderbook-activity rule and could show "Quiet" — the same instance described
    two ways with nothing to explain the gap. The self card now applies the same
    rule. It only relabels on a definite answer, so a lookup that tells it nothing
    can never mark a busy instance quiet.

  Added

  • A safe way to rehearse fast-sync. --verify-only runs the entire consumer
    path — find the signed snapshot on-chain, pick a mirror, download it over
    whichever transport suits the node, and prove every byte against the on-chain
    SHA-256 — then stops before touching any database and tells you what it found.
    It needs no indexer, no Postgres and no server, so you can rehearse the whole
    thing from a laptop and know it works before a brand-new instance depends on
    it.
  • The snapshot publisher's timer installs itself. The publish units were only
    laid down by the automated server setup, which never runs on a hand-built
    install — including the canonical one. They are now installed on every upgrade
    but stay inert until you opt in by creating /etc/morphit/snapshot-publish.env,
    so exactly one instance publishes and no upgrade can make a box start signing
    snapshots by surprise.

  Changed

  • Less alarming output when a check is inconclusive. The gateway check used to
    end with a warning that hidden-only peers could not upgrade from your box — a
    consequence it had not actually established, printed after the upgrade's own
    success message. It now reports only what it observed, says plainly that it can
    be wrong, and makes clear that nothing about it blocks your upgrade.

  Notes

  • No protocol/consensus change. Everything here is operator-facing output quality.
  • If v1.17.3 told you your box had no hidden address or warned that hidden peers
    could not upgrade from it, neither was true — both were reporting bugs, fixed
    here.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    6 downloads · 2026-09-12 21:09:23 +00:00 · 1 KiB
  • morphit-v1.17.4.tar.gz
    1 download · 2026-09-12 21:09:22 +00:00 · 32 MiB
  • morphit-v1.17.4.tar.gz.sha256
    1 download · 2026-09-12 21:09:22 +00:00 · 89 B
• v1.17.3 b977135513

  Compare

  Morphit v1.17.3 Stable

  agorise released this 2026-09-12 05:10:51 +00:00 | 13 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.17.3

  Follow-up to v1.17.2, driven entirely by what two real upgrades revealed. The
  headline item is that nobody could set up a warrant canary — the setup script
  was being killed mid-prompt by a shell error, and the same defect sat in the
  weekly refresh that keeps an existing canary alive. No protocol or consensus
  change.

  Fixed

  • Warrant-canary setup no longer dies mid-prompt. Answering the questions
    would get as far as "Operator name" and then stop with "Canary setup didn't
    finish", with no explanation. The script was not finishing early — it was being
    terminated. It looks for your instance URL to offer as a default, and the
    search used a pipeline that reports "not found" as an error; combined with the
    script's own abort-on-any-error setting, the first configuration file that
    lacked that setting killed it outright. Since almost no existing instance has
    that setting recorded, this affected essentially everyone. The lookup now
    tolerates a miss, tries more places, and on a Tor-only box falls back to your
    .onion as the default.
  • The weekly canary refresh had the same defect. Identical construct in the
    refresh job that the timer runs. A node whose configuration lacked one
    particular setting — or that simply had no .onion among its chain endpoints —
    would have its refresh killed silently, letting a published canary go stale on
    its own schedule with no error any operator would ever see. That is the worse
    version of the bug, because nothing surfaces it until readers notice the date.
  • The seeding self-check can find your addresses again. Every instance was
    reporting "no hidden address configured" and skipping the frontend check, even
    with a live .onion and a working domain. Two causes: the check read one
    setting from one file, and it runs as an unprivileged user that cannot read
    Tor's address file at all. The upgrade now looks these up itself — where it has
    the permission to — and hands them down, with more fallbacks and a message
    naming exactly where it looked when it still finds nothing.
  • The snapshot mirror installs itself on hand-built servers. Its weekly timer
    was only installed by the automated server setup, which never runs on an
    instance that was installed by hand — including the canonical one. The upgrade
    now installs and enables the timer directly, so the feature is not silently
    inert on exactly the servers that matter most.
  • The stray "New major version of npm available!" banner is gone. It was
    printing after the upgrade's own success message, which read like part of the
    result. Suppressed at the last step that could emit it, so it holds however
    that step is run.

  Changed

  • The "Zero use of clearnet internet" badge now shows a medal (🏅) instead of a
    shield (🛡️) in the instance directory. It marks an achievement a node has
    earned by proving all seven outbound paths are hidden, not a protective
    feature — the medal reads that way.

  Security

  • The address lookup deliberately does not read hidden addresses from the
    chain-endpoint configuration. That file lists other operators' .onion
    addresses, and reading it would have made this instance probe a stranger's node
    and report it as its own working seeder.

  Notes

  • No protocol/consensus change. Everything here is operator-facing: setup,
    upgrade, seeding and reporting accuracy.
  • If your canary setup failed on v1.17.2, re-run it after upgrading —
    sudo morphit-ops → "Harden this server", or
    sudo bash /opt/morphit/scripts/canary/setup.sh.
  • OPERATIONS.md §52 covers the snapshot mirror pipeline and how to check it.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    8 downloads · 2026-09-12 05:38:36 +00:00 · 1 KiB
  • morphit-v1.17.3.tar.gz
    3 downloads · 2026-09-12 05:38:35 +00:00 · 32 MiB
  • morphit-v1.17.3.tar.gz.sha256
    4 downloads · 2026-09-12 05:38:36 +00:00 · 89 B
• v1.17.2 f71dcbb2bc

  Compare

  Morphit v1.17.2 Stable

  agorise released this 2026-09-12 02:07:57 +00:00 | 14 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.17.2

  Hidden-seeding and fast-sync release. Two things were quietly broken in the same
  place: a Tor/I2P-only instance could not upgrade from the federation for weeks
  because of a single missing firewall rule, and a Tor/I2P-only instance could not
  fast-sync at all because the snapshot it needs was only ever reachable over
  clearnet. Both are fixed, along with the checks that reported success while the
  first one was broken. No protocol or consensus change.

  Added

  • Every instance now mirrors the federation indexer snapshot. Fast-sync is
    what gets a brand-new node from an empty database to a live orderbook in
    minutes instead of days, and it depends on one small (~600 kB) file that
    @morphit anchors on-chain. Until now nothing kept that file reachable from
    anywhere except the canonical box and a few public clearnet IPFS gateways —
    which made one box a single point of failure for every new instance, and made
    fast-sync impossible for a zero-clearnet node. Your instance now pins that file
    and re-serves it over your clearnet origin, your .onion and your .b32.i2p,
    refreshing weekly and after every upgrade. Mirroring is not a trust claim: a
    newcomer proves every byte against the signed on-chain SHA-256, so a bad mirror
    is caught by arithmetic rather than by reputation. Nothing to configure.
  • Fast-sync works over Tor and I2P. A new node now prefers federation peers
    on the transport it already speaks, ahead of any clearnet source. A hidden-only
    node omits clearnet sources entirely and falls back to a full replay rather than
    reaching for a public gateway — finishing faster is never worth deanonymising
    the box. Peers are discovered from the same chain history the node already reads
    to find the snapshot, so a brand-new box with no indexer yet still finds a
    private mirror, and no address is baked into the source tree to go stale.
  • The frontend-to-gateway firewall path now repairs itself. Every upgrade
    probes the connection from inside the frontend container and, if it is being
    dropped, fixes it in place — firewall rule, then a fallback rule, then a
    container restart, verifying after each and reporting which one worked. An
    instance admin is never asked to paste a firewall command.

  Fixed

  • Hidden-only instances can upgrade from the federation again. The frontend
    proxies /ipfs/ and /ipns/ to the IPFS gateway on the host, but the firewall
    had no rule for that port — so the container-to-host connection was dropped, nginx
    timed out, and every .onion / .b32.i2p release fetch returned a stock 404. Any
    instance running the web firewall was therefore unable to serve releases over
    Tor or I2P, which is why hidden-only nodes fell back to stale copies from
    elsewhere and failed their integrity check. Hardening now opens that port to the
    web-firewall network only (never the public), when this box hosts IPFS — and the
    self-heal above delivers the same fix to instances the installer never manages.
  • The seeding self-check actually runs now. The check introduced for this
    release used a Bash-only construct in a script that runs under /bin/sh, which
    on Ubuntu aborts the moment it is called. In practice the entire per-transport
    verification — and the step after it — never executed on a single real box. It
    is now plain POSIX shell, and a probe that cannot connect reports that instead
    of killing the script, which matters because an unreachable gateway is exactly
    what it exists to detect.
  • No more false "your firewall is broken" warning. The same check asked the
    frontend for the release using the loopback address, which the web firewall
    rejects on every path even on a perfectly healthy box — so it would have told
    every operator at once that their firewall was dropping connections. It now asks
    using the instance's real hostname, and treats a refusal from its own probe as
    inconclusive rather than as a fault.
  • Reachability checks no longer time out on healthy nodes. The Tor and I2P
    checks downloaded the full ~33 MB release tarball, which routinely outruns any
    sane timeout over a hidden transport and reported working nodes as broken. They
    now fetch a small file over the identical path.
  • "Working seeder" is verified, not assumed. The previous self-check asked
    the local gateway whether it served the release and then announced the box was a
    working seeder over every transport. That passed happily while no peer could fetch
    anything. It now checks the path a peer actually uses — through the frontend, then
    end-to-end over each configured .onion and .b32.i2p — and reports each
    transport separately, with the exact fix when one fails.
  • No more false "unsigned tarball will be refused" warning. A release fetched
    over Tor/I2P carries no detached signature by design: it is verified against the
    SHA-256 anchored on-chain, read from the node's own indexer. The warning now
    describes what actually happens — the on-chain hash is used, and the upgrade is
    refused only if neither a signature nor a matching hash can be established.

  Changed

  • The health report no longer overstates IPFS seeding. Its "ok" verdict is based
    on local timer runs (the release is pinned, the IPNS record was rebroadcast), which
    does not prove a peer can fetch it. The wording now says exactly that, and points at
    the upgrade's seed step for the real per-transport reachability check.
  • Snapshot publishing is a single-signer job, and is off by default. Exactly one
    instance in the federation exports and anchors the snapshot; everyone else mirrors
    it. An ordinary instance will never begin anchoring snapshots under its own account
    just because it was installed with defaults.

  Security

  • The new firewall rule is scoped to the pinned web-firewall network and opens only
    the read-only release gateway, which serves pinned releases and nothing else. It is
    gated on the box actually hosting IPFS, so a node without IPFS opens no new port,
    and a Tor/I2P-only box gains no clearnet exposure.
  • A mirroring instance verifies the snapshot against the on-chain SHA-256 before it
    will serve it, and removes the pin if the hash does not match — so a box can never
    become a mirror for content the signer did not publish.
  • The self-heal only ever adds a rule permitting the pinned container network to reach
    the local read-only gateway, and verifies by observing the connection rather than
    trusting a command's exit code.

  Notes

  • No protocol/consensus change. All changes are operator-facing seeding, upgrade,
    fast-sync and reporting accuracy.
  • Mirroring rides on IPFS release hosting: a box without Kubo skips it silently.
    OPERATIONS.md §52 covers the whole pipeline, including how to opt out.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    3 downloads · 2026-09-12 02:36:07 +00:00 · 1 KiB
  • morphit-v1.17.2.tar.gz
    3 downloads · 2026-09-12 02:36:07 +00:00 · 32 MiB
  • morphit-v1.17.2.tar.gz.sha256
    3 downloads · 2026-09-12 02:36:07 +00:00 · 89 B
• v1.17.1 a7356b760d

  Compare

  Morphit v1.17.1 Stable

  agorise released this 2026-09-11 04:57:46 +00:00 | 15 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.17.1

  Smooth-install / self-heal release. A run of real operator pain — a fresh OS
  reinstall, a Tor-only upgrade, and a censored-region node — surfaced a handful of
  places where an install or upgrade needed a human to notice and fix something by
  hand. Every one of them now handles itself, or fails loud with the exact fix. No
  protocol or consensus change.

  Fixed

  • An upgrade no longer leaves a containerized frontend serving the OLD build.
    The BunkerWeb/containerized frontend bind-mounts the built site, and a rebuilt
    image is byte-identical, so docker compose up left the running container pinned
    to the pre-upgrade build — the upgrade reported success while /verify.json still
    showed the old version. The frontend is now force-recreated so it re-binds the
    fresh build, and the post-upgrade check self-heals (restart + re-verify) before
    it will warn.
  • operator_tag now shows on containerized instances. The tag was stamped into
    the served verify.json only on the bare-metal deploy path, so every
    container-served instance read operator_tag: null despite a correct config and
    on-chain registration. The stamp now runs before both deploy paths. (Cosmetic —
    fee attribution always used the runtime config and was never affected.)
  • A reinstalled IPFS origin host no longer goes publicly dark on IPFS. Stock
    firewall opened only 22/80/443, so a fresh install left the IPFS swarm port closed
    and public gateways couldn't fetch the seeded release. Hardening now opens 4001
    (tcp + udp) automatically when the box hosts IPFS, and the post-harden self-test
    flags it if it's ever not open.
  • The warrant-canary upload survives a reinstall. A fresh OS re-keys only root,
    so the canary's morphit@ upload failed with "Permission denied". Install now
    propagates the operator's login keys to the morphit service user.
  • Canary autorenew no longer fails silently under nvm. The weekly timer runs with
    a minimal PATH and couldn't find a version-manager node; the generated service now
    pins node's directory into its PATH.

  Added

  • Turnkey canary setup. Remote (laptop-signed) setup now offers to generate a
    dedicated passphrase-less upload key, wires it behind an SSH alias, and points the
    refresh at it — so the weekly timer never prompts and the canary can't go falsely
    stale. Same-box setup is drivable with near-zero data entry.
  • Upgrade offers a canary when the footer link would 404. If the site footer's
    canary link has no canary behind it (bad for visitors and SEO), the upgrade offers a
    turnkey same-box setup — signing key, first canary, and weekly schedule, automatic —
    and is a single keystroke to decline. It stays silent for operators who already run
    a remote canary.
  • Every instance self-verifies it's a working release seeder. After seeding a
    release to IPFS, the instance now confirms its own gateway actually serves it (the
    path a peer uses) and says so plainly — or warns loudly if it doesn't — so the
    federation never silently loses a seeder.
  • Hidden-only nodes get a clear, verified offline path. When no federation peer
    yet serves a release over Tor/I2P, the fail-closed message now points to
    morphit-ops upgrade --from-file, which verifies the tarball against the SHA-256
    @morphit anchored on-chain (read from the node's own indexer — zero clearnet).

  Changed

  • morphit-ops edit already offered to re-publish your on-chain registration after a
    name/tag/origin/contact change; this is a reminder that the operator tag attributes
    fee earnings, so a config that drifts to a wrong/reserved tag is now easy to catch
    and correct.

  Security

  • Every change is hidden-only-safe: the 4001 rule is gated on the box actually hosting
    IPFS; the canary offer never fights a remote-signed canary; and the offline upgrade
    path verifies against the on-chain anchor with no clearnet dependency. No new network
    exposure on a Tor/I2P-only box.

  Notes

  • No protocol/consensus change. All changes are operator-facing install, upgrade,
    recovery, and seeding robustness.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    5 downloads · 2026-09-11 05:26:12 +00:00 · 1 KiB
  • morphit-v1.17.1.tar.gz
    4 downloads · 2026-09-11 05:26:12 +00:00 · 32 MiB
  • morphit-v1.17.1.tar.gz.sha256
    6 downloads · 2026-09-11 05:26:12 +00:00 · 89 B
• v1.17.0 c1fd9dff00

  Compare

  Morphit v1.17.0 Stable

  agorise released this 2026-09-10 23:37:58 +00:00 | 17 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.17.0

  Operator-safety release. Hardening can no longer strand an operator or take a site
  dark; fast-sync works on a stock box and recovers a stranded flagship from any
  synced peer; Matrix alerts set themselves up with zero hand-editing; and hidden-only
  instances are audited clean of any clearnet reliance.

  Fixed

  • Hardening can no longer lock you out of SSH. harden set PermitRootLogin no
    whenever any key was authorized — including a root-only key — locking out an
    operator whose only login was root. It now disables root login only when a
    non-root keyed user exists, and otherwise keeps key-only root
    (prohibit-password), so it can never strand the sole operator.
  • Hardening can no longer take the public site dark. Enabling UFW flushes
    nftables, wiping Docker's forwarding chains — external traffic reached the box
    but the DNAT-forward to the frontend container was dropped (the box looked
    healthy to itself while the world timed out). harden now re-asserts Docker's
    chains after the firewall change, verifies the NAT rules returned, and
    hard-fails if they didn't.
  • Fast-sync works on a stock box. The snapshot bootstrap validated against a
    half-loaded environment and bailed (MORPHIT_INDEXER_CHAIN_ID: Required) because
    the fast-sync wrapper only inherited part of the operator env. It now sources
    the same env files the indexer unit does, so a correctly-configured box can
    fast-sync.
  • matrix-bot no longer crash-loops on an E2EE key collision. Reusing an access
    token after a reinstall causes a "one time key … already exists" collision; the
    bot now self-clears the dead crypto store, prints a plain-language fix, and
    exits cleanly instead of hammering systemd.
  • timeapp language filter. Browsing in a locale no longer auto-locks the order
    language filter (which hid other-language orders and re-appeared on refresh);
    clearing the filter now re-queries immediately.

  Added

  • Fast-sync is the default, and can import a peer snapshot. The install offers
    it [Y/n]; the menu path now offers to stop the indexer (checking the real
    service state, no 90 s wait), offers to discard existing data (no --force
    archaeology), and auto-restarts after. New morphit-ops fast-sync --from-file <snapshot.tar.gz> imports a snapshot handed over from any synced peer — for when
    no fresh on-chain snapshot exists.
  • Harden self-heals a broken run (dead-man's-switch). After a run that changes
    SSH or the firewall, an automatic revert is armed via a transient systemd-run
    timer (independent of your SSH session). Confirm you can still reach the box and
    it cancels; otherwise it restores the exact pre-run SSH + firewall + Docker
    state within ~2 minutes. Plus a post-harden self-test that fails loud on a
    lockout.
  • Matrix alerts set themselves up — no hand-editing. morphit-ops matrix setup
    (and the install wizard, and harden) collect the recipient + the bot's
    username/password, mint a fresh token via the Matrix login API, persist it,
    clear the stale crypto store, start the bot, and send a test. Entering a Matrix
    address during setup wires the whole thing.
  • Health report: a "Generating your health report…" spinner; CPU/Memory now
    show free; a "Reachable at" list of every address the node serves (clearnet +
    Tor .onion + I2P .b32.i2p); and the install wizard now has an explicit warrant
    canary step and offers to serve the frontend on a new vanity .loki/.i2p.

  Changed

  • npm's update-notifier is silenced globally (no more "new major version of npm"
    noise on install/upgrade). Italian "commissione" → "commissione (fee)" on the
    order fee-status line. The redundant CryptoCompare price source is dropped
    (it required new auth); a source that's up for one asset but doesn't list another
    now reads "no market" instead of an alarming "down".

  Security

  • Hidden-only instances stay clearnet-free. Audited across all of the above:
    the harden auto-revert restores the exact pre-run firewall rules (never opens
    clearnet ports a hidden-only box didn't have); the post-harden self-test skips
    clearnet checks on a Tor/I2P-only box; the health "Reachable at" list never prints
    a clearnet address the node doesn't serve; and fast-sync's env-sourcing fix
    actually improves hidden-only sync (the bootstrap now gets the Tor/I2P proxy
    config). The Matrix token mint uses the same outbound path as the bot itself; a
    fully air-gapped box uses the paste-a-token path.
  • Matrix token stays 0600. The bot access token is written only to
    matrix-bot.env (0600, owner-only) and preserved from there on re-render; only
    the non-secret recipient MXID lives in the group-readable operator config.

  Notes

  • No protocol/consensus change. All changes are operator-facing safety, recovery,
    and privacy hardening.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    6 downloads · 2026-09-11 00:05:54 +00:00 · 1 KiB
  • morphit-v1.17.0.tar.gz
    3 downloads · 2026-09-11 00:05:54 +00:00 · 32 MiB
  • morphit-v1.17.0.tar.gz.sha256
    3 downloads · 2026-09-11 00:05:54 +00:00 · 89 B
• v1.16.13 48ae4504d2

  Compare

  Morphit v1.16.13 Stable

  agorise released this 2026-09-09 02:02:15 +00:00 | 23 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.16.13

  Upgrade robustness on slow/throttled links, an honest update-check, and one more
  self-heal moved onto the release that ships it.

  Fixed

  • Upgrades survive a slow connection. The release download used a fixed 30 s
    total deadline and buffered the whole tarball in memory, so a healthy-but-slow
    link (a throttled or filtered connection) got its download aborted mid-transfer
    ("this operation was aborted"). It now streams to disk with an idle timeout:
    the transfer is only aborted if no bytes arrive for 90 s, so a slow-but-steady
    download completes. Only a genuine stall aborts.
  • A failed update-check no longer looks like "up to date." When the version
    check couldn't reach the release server (e.g. a slow link timed out), the menu
    silently dropped the "update available" marker — indistinguishable from being
    current. It now shows (couldn't check for updates — network) so an outdated
    node is never mistaken for a current one.

  Changed

  • The frontend rebuild now runs in the post-upgrade self-heal phase, from the
    freshly-installed binary (via the re-exec), alongside the WAF and IPFS heals.
    The frontend's nginx.conf is baked into its image, so a config change (e.g. the
    v1.16.12 /v1/broadcast body-size cap) previously only landed on the next
    upgrade; now it applies on the upgrade that ships it. A no-change rebuild is
    cheap (Docker layer cache), and a box without a compose-managed frontend no-ops.

  Notes

  • No protocol/consensus change. All three are operational robustness only.
  • A node upgrading from a pre-v1.16.11 release (no re-exec phase) picks up the
    self-heal behaviour on its next upgrade, once it is driven by a v1.16.11+
    orchestrator.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    4 downloads · 2026-09-09 02:33:08 +00:00 · 1.1 KiB
  • morphit-v1.16.13-offline.tar.gz
    0 downloads · 2026-09-09 02:33:27 +00:00 · 754 MiB
  • morphit-v1.16.13-offline.tar.gz.sha256
    1 download · 2026-09-09 02:33:27 +00:00 · 98 B
  • morphit-v1.16.13.tar.gz
    5 downloads · 2026-09-09 02:33:08 +00:00 · 32 MiB
  • morphit-v1.16.13.tar.gz.sha256
    5 downloads · 2026-09-09 02:33:08 +00:00 · 90 B
• v1.16.12 d56e58d59a

  Compare

  Morphit v1.16.12 Stable

  agorise released this 2026-09-08 20:00:53 +00:00 | 25 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.16.12

  Two directory-accuracy fixes reported from live instances: a verify.json
operator_tag that stayed null, and an operator whose contact showed on the
  instances page but not the operators page.

  Fixed

  • verify.json operator_tag no longer stays null. The deploy stamps the
    served verify.json with this instance's tag, but it only read the local config
    — and on an instance whose tag was registered on-chain but never written to the
    local env, that read nothing and left null. It now falls back to the on-chain
    registration the local indexer already serves at /v1/instances (matched to this
    instance's own origin) — the same source that correctly shows the tag in the
    public directory — so a deployed verify.json shows the real tag.
  • Operators page shows a contact even when the on-chain operator record has
    none. An operator's contact renders from its on-chain operator_register
    contact, which can be empty even when the operator's instance publishes one
    (e.g. time.relay: a contact on /instances but blank on /operators). The
    operators page now falls back to that instance contact (keyed by operator tag)
    when the on-chain operator contact is empty, using the same scheme-aware policy
    (email / Matrix / XMPP / … render; bare emails repaired).

  Notes

  • No protocol/consensus change; both fixes are display/deploy only. operator_tag
    in verify.json remains informational (fee attribution comes from the runtime
    indexer config, unaffected).

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    4 downloads · 2026-09-08 20:31:05 +00:00 · 1.1 KiB
  • morphit-v1.16.12-offline.tar.gz
    0 downloads · 2026-09-08 20:31:22 +00:00 · 754 MiB
  • morphit-v1.16.12-offline.tar.gz.sha256
    1 download · 2026-09-08 20:31:22 +00:00 · 98 B
  • morphit-v1.16.12.tar.gz
    3 downloads · 2026-09-08 20:31:04 +00:00 · 32 MiB
  • morphit-v1.16.12.tar.gz.sha256
    3 downloads · 2026-09-08 20:31:05 +00:00 · 90 B
• v1.16.11 b0466a0829

  Compare

  Morphit v1.16.11 Stable

  agorise released this 2026-09-08 05:34:07 +00:00 | 26 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.16.11

  The hidden-upgrade path is now self-sufficient end to end, and a self-heal
  shipped in a release now takes effect on that upgrade instead of the next one.
  This closes out the zero-clearnet upgrade story: expose → advertise → discover →
  fetch, all automatic, no operator ever hand-signs or hand-configures anything.

  Fixed

  • The /ipns/… release pointer is signed again. The federation's stable IPNS
    name had frozen at an old release because the CI signing step is gated on a
    MORPHIT_IPNS_KEY secret that wasn't set — so every hidden upgrade that resolved
    the release by IPNS got stale bytes and (correctly) rejected them. With the key
    in place, each release re-signs the record and every instance rebroadcasts it, so
    /ipns/… resolves to the current release across the whole federation. The stable
    name is rotated to a fresh identity (k51qzi5uqu5dgkxm…); the site, docs, and the
    on-chain ipns_name all track it (the on-chain value is derived from the key at
    release time, so it can't drift from the site).
  • Hidden peer discovery no longer drops Tor. resolvePeerGateways used an
    else if that only kept a peer's .b32.i2p address whenever it had one, so
    .onion peers were never tried. It now offers both transports per peer.
  • Self-heals apply on the upgrade that ships them. After the upgrade rebuilds
    the new ops-cli bundle it re-execs the new binary for a dedicated self-heal
    phase (__post-upgrade-selfheal), falling back to in-process if that binary is
    too old. So from here on, a fix that self-heals a box lands on the upgrade that
    introduces it — no more "the fix is in, but you have to upgrade twice."

  Added

  • Seeder discoverability nudge. The health report now reminds a node that is
    seeding the release to publish its Tor/I2P address on-chain (via
    morphit-ops register) so hidden-only nodes can actually discover and fetch from
    it — the advertise half of "expose → advertise → discover."

  Notes

  • No protocol/consensus change; clearnet upgrades are unaffected. The IPNS-name
    rotation is transparent to users (the download page and on-chain pointer both
    carry the new name from this release forward). A node still on an older version
    that can only reach stale peers may need one offline hop to reach a version with
    fetch-by-CID (v1.16.10) — after which it upgrades over the hidden network with no
    further manual steps.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    0 downloads · 2026-09-08 06:05:58 +00:00 · 1.1 KiB
  • morphit-v1.16.11-offline.tar.gz
    1 download · 2026-09-08 06:06:18 +00:00 · 754 MiB
  • morphit-v1.16.11-offline.tar.gz.sha256
    1 download · 2026-09-08 06:06:18 +00:00 · 98 B
  • morphit-v1.16.11.tar.gz
    0 downloads · 2026-09-08 06:05:58 +00:00 · 32 MiB
  • morphit-v1.16.11.tar.gz.sha256
    1 download · 2026-09-08 06:05:58 +00:00 · 90 B
• v1.16.10 c22ae5779f

  Compare

  Morphit v1.16.10 Stable

  agorise released this 2026-09-08 02:32:28 +00:00 | 27 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.16.10

  Every instance is now a Tor/I2P release seeder by default — automatically.
  This makes zero-clearnet upgrades self-sufficient across the federation: a
  hidden-only node fetches the signed release from any peer over .onion/.i2p,
  verified against the on-chain SHA-256, with no hand-signing and no manual gateway
  setup. It's the piece that lets zero-clearnet instances proliferate without an
  operator ever touching IPFS config.

  Changed

  • IPFS gateway exposed over Tor/I2P by default. morphit_ipfs_gateway_expose
    now defaults on, and the upgrade self-heals it on every existing instance —
    no admin step. It sets Gateway.NoFetch=true first (so the gateway serves
    ONLY the release CIDs this node has pinned — never an arbitrary CID, never an
    open proxy), then binds the gateway bridge-reachable, restarts Kubo, ensures the
    IPNS rebroadcaster is running, and verifies the gateway is live. Best-effort and
    idempotent; a node without IPFS hosting simply no-ops.
  • Hidden-only nodes seed the canonical release too. The offline bundle now
    ships the canonical morphit-<ver>.tar.gz under .canonical-release/, and an
    offline upgrade seeds that — so a zero-clearnet node produces the CID that
    matches the on-chain anchor and becomes a real Tor/I2P origin host, not just a
    consumer.

  Fixed

  • Hidden upgrade fetches by the on-chain CID, not a peer's IPNS. It now tries
    /ipfs/<ipfs_cid>/… first — content-addressed, so it pulls the EXACT canonical
    bytes from any peer that has the CID pinned, regardless of that peer's IPNS
    freshness — with IPNS as a fallback. This is what let a stale/divergent peer
    break the fetch before; now a peer serving old bytes just loses the race to a
    canonical one. Every seeder also runs the IPNS rebroadcaster (anti-stale on the
    publisher side).
  • Deterministic seed across Kubo versions. The ipfs add DAG params
    (--chunker=size-262144 --raw-leaves) are now pinned in both the CI anchor
    computation and the node seed, so every node — on any Kubo version — reproduces
    the same CID as the on-chain anchor. (No-op for modern Kubo, which already
    matched; fixes older ones.)

  Notes

  • No protocol/consensus change. Clearnet upgrades are unchanged (git mirrors +
    on-chain SHA + HTTPS primary). The gateway exposure only affects a box that runs
    IPFS hosting and is safe by construction (NoFetch); the anchor CID for a given
    release only changes for releases cut after this one (v1.16.9's anchor is
    already published), so the deterministic-seed pinning takes effect going forward.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    6 downloads · 2026-09-08 03:03:39 +00:00 · 1.1 KiB
  • morphit-v1.16.10-offline.tar.gz
    0 downloads · 2026-09-08 03:04:05 +00:00 · 754 MiB
  • morphit-v1.16.10-offline.tar.gz.sha256
    0 downloads · 2026-09-08 03:04:05 +00:00 · 98 B
  • morphit-v1.16.10.tar.gz
    3 downloads · 2026-09-08 03:03:39 +00:00 · 32 MiB
  • morphit-v1.16.10.tar.gz.sha256
    3 downloads · 2026-09-08 03:03:39 +00:00 · 90 B