186 releases 186 tags

RSS feed

• v1.16.9 98b8b405ad

  Compare

  Morphit v1.16.9 Stable

  agorise released this 2026-09-07 22:42:22 +00:00 | 28 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.16.9

  Installs and upgrades self-heal the reverse-proxy WAF, and hidden/offline
  upgrades no longer need a hand-signed tarball. This release closes a cluster of
  real operator-reported issues — a JSON-API firewall that was 4xx-ing legitimate
  avatar/order broadcasts, a warrant canary that wouldn't publish on a same-box
  setup, and several UI papercuts — and hardens the BunkerWeb self-heal so an admin
  never has to run a diagnostic for something the upgrade can detect and fix itself.

  Fixed

  • BunkerWeb WAF no longer blocks the JSON APIs — self-healed on upgrade, three
    ways. Three independent BunkerWeb layers were rejecting a legitimate
    POST /v1/broadcast (e.g. an avatar upload): (1) MAX_CLIENT_SIZE defaulted
    below the ~8 KB broadcast body → 413; (2) bad-behavior counted the routine
    400s a JSON API returns when it rejects an invalid/expired broadcast, banning
    the client IP → 403 on everything; (3) OWASP CRS false-positived on the
    base64 payload → 403. The upgrade now self-heals all three: sets
    MAX_CLIENT_SIZE=1m (the relay's 64 KB stays the real cap), removes 400 from
    the bad-behavior triggers, and exempts /v1/+/relay/ from ModSecurity. Each
    fix is applied more than one way (the ModSec exemption as both an env var and
    a mounted config file), the reload uses a fallback chain, and the result is
    verified against the running container — no admin diagnostics, no
    back-and-forth. Fresh installs get the same settings from the Ansible template.
  • Offline / hidden-only upgrades verify against the on-chain SHA-256 — no more
    hand-signing. A zero-clearnet or air-gapped node can now apply an offline
    tarball by checking it against the release hash @morphit published on-chain
    (read from the node's own indexer over its hidden RPC), instead of requiring a
    hand-made GPG .asc. The release also anchors the -offline bundle's own
    offline_sha256, and decideTrust gained an onchain-anchored-sha256 proof.
  • Offline-bundle upgrades no longer print a scary "CID MISMATCH." A
    -offline bundle is a different artifact than the standard tarball the on-chain
    IPFS CID anchors, so the self-seed can never match it — the upgrade now skips
    the seed cleanly with a one-line note instead.
  • operator_tag is stamped into the served verify.json on every deploy, so
    a prebuilt-tarball upgrade no longer serves operator_tag: null.
  • Operators-page contact links render every scheme. The operators page used
    an https-only validator that silently dropped email / Matrix / XMPP / Discord-
    invite / nostr / session / cwtch contacts; it now uses the shared, scheme-aware
    contact policy (and repairs a bare email to mailto:), matching the instances
    page.
  • Warrant canary: same-box setup publishes immediately. Local (same-box)
    canary setup now hands the served build/ dir over before the first publish
    (so it isn't a root-owned "permission denied"), and verifies the file actually
    landed. In the health report, a not-yet-published canary is now a yellow
    "pending" ⚠ with the exact publish command, not an alarming red ✗ — only an
    expired canary is red.
  • Compare-orderbooks page handles zero-clearnet + http/https, with accurate
    errors. The instance-URL validator now accepts http:// and https:// (and
    defaults bare .onion/.i2p/.loki hosts to http://), so zero-clearnet
    instances can be compared. The stale "could not fetch" error now clears the
    moment you edit the field, so it never describes a previous input.
  • Sign-in key field resists Firefox autofill. The import page's posting-key
    field starts read-only (unlocked on focus) with a unique name, so Firefox no
    longer dumps a saved site password into it on load.
  • The sliding "⇨" link arrow has breathing room. A small text-facing gap
    (logical, so it's correct in RTL too) keeps the glyph from jamming against the
    label.

  Added

  • Two FAQ articles, in all 10 locales, for the two things operators kept
    asking about: why login asks for your posting key instead of the password you
    set, and why a brand-new chat/order can take a moment to appear (indexer catch-
    up), with search-friendly wording.

  Notes

  • No protocol/consensus change. Clearnet instances are unaffected by the
    offline/hidden verification change. The WAF self-heal only touches a BunkerWeb
    deployment and no-ops elsewhere; it is idempotent and skips its reload when the
    settings are already in place.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    6 downloads · 2026-09-07 23:11:18 +00:00 · 1.1 KiB
  • morphit-v1.16.9-offline.tar.gz
    1 download · 2026-09-07 23:11:33 +00:00 · 722 MiB
  • morphit-v1.16.9-offline.tar.gz.sha256
    1 download · 2026-09-07 23:11:33 +00:00 · 97 B
  • morphit-v1.16.9.tar.gz
    2 downloads · 2026-09-07 23:11:18 +00:00 · 32 MiB
  • morphit-v1.16.9.tar.gz.sha256
    2 downloads · 2026-09-07 23:11:18 +00:00 · 89 B
• v1.16.8 e1946e9945

  Compare

  Morphit v1.16.8 Stable

  agorise released this 2026-09-07 04:45:29 +00:00 | 29 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.16.8

  Hidden-only upgrades can now actually find their peers. v1.16.6 made a
  hidden-only node correctly resolve its upgrade over Tor/I2P and refuse clearnet —
  but a field-name bug meant it never actually saw any federation peer's hidden
  address, so every hidden-only upgrade dead-ended at "no federation peer exposes a
  hidden IPFS gateway yet." This fixes the discovery.

  Fixed

  • Hidden-only upgrade now discovers peer gateways. The upgrade reads the
    federation directory (/v1/instances) to find peers' Tor/I2P addresses, but the
    resolver read i.tor / i.reg_alt_networks, while the response actually nests
    them under i.alt_networks (alt_networks.tor, alt_networks.i2p_b32). So it
    found zero peers and always reported "no hidden gateway." It now reads
    alt_networks (with the others as fallbacks), so a hidden-only node sees every
    peer that advertises a hidden address and fetches the release over Tor/I2P.
  • Clearer fail-closed messaging. When no peer serves the release (as opposed
    to none advertising an address), the error now names the fix: a federation peer
    must expose its IPFS gateway over Tor/I2P (morphit-ops → Web firewall / IPFS gateway), instead of a generic "no gateway."

  Notes

  • No protocol/consensus change; clearnet instances are unaffected (they never use
    the hidden path). hidden-upgrade-detection-smoke now pins that the resolver
    reads alt_networks so this field-name mismatch can't recur.
  • Operator note for hidden-only nodes: for a hidden-only node (e.g. one that
    eliminates clearnet entirely) to upgrade over Tor/I2P, at least one federation
    peer with a Tor/I2P address must expose its IPFS gateway over that hidden
    service. Enable it on a well-connected clearnet peer (one that already has a
    .onion/.i2p) so hidden-only nodes have a private source for releases.
  • A node currently on the buggy v1.16.6/v1.16.7 hidden resolver cannot pull this
    fix over Tor/I2P (its own resolver can't find peers) — deliver v1.16.8 to it
    once via the offline / local-tarball upgrade path over a channel you control;
    every hidden upgrade after that works automatically.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    7 downloads · 2026-09-07 05:13:50 +00:00 · 1 KiB
  • morphit-v1.16.8-offline.tar.gz
    1 download · 2026-09-07 05:14:12 +00:00 · 722 MiB
  • morphit-v1.16.8-offline.tar.gz.sha256
    2 downloads · 2026-09-07 05:14:12 +00:00 · 97 B
  • morphit-v1.16.8.tar.gz
    3 downloads · 2026-09-07 05:13:49 +00:00 · 32 MiB
  • morphit-v1.16.8.tar.gz.sha256
    4 downloads · 2026-09-07 05:13:49 +00:00 · 89 B
• v1.16.7 fc1eda71ea

  Compare

  Morphit v1.16.7 Stable

  agorise released this 2026-09-07 00:46:41 +00:00 | 30 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.16.7

  Three operator-facing robustness fixes, all found by one node's real incident.
  A cosmetic branding field could crash-loop and take an instance offline; an
  operator's tag could read as null even when correctly registered; and the WAF
  could 403 a legitimate avatar upload. All three are fixed, and the fixes apply
  themselves on upgrade — no ansible re-run, nothing to do by hand.

  Fixed

  • A bad contact URL can no longer take an instance down. A bare email typed
    into edit → branding (no scheme, so not a URL) used to fail the indexer's
    config validation and crash-loop the whole node offline. Now:
    • the indexer treats an invalid MORPHIT_INSTANCE_CONTACT_URL as unset with a
      warning instead of a fatal error — a contact typo degrades gracefully;
    • edit → branding validates the link, repairs a bare email to mailto:…, and
      refuses anything it can't make into an allowlisted contact URL — with a clear
      message, before writing;
    • upgrade auto-repairs a bare-email contact URL already on disk, so any node
      that has one is healed by upgrading rather than left broken.
  • operator_tag no longer reads as null when it's actually set. verify.json's
    builder resolved the operator tag from a config path that the upgrade's frontend
    build didn't always see (it can run from a subdirectory), leaving operator_tag: null even when the tag was correctly registered on-chain. It now resolves the
    install-root config via absolute paths and a walk-up, so a set tag is reported.
  • The WAF no longer 403s the avatar upload. bunkerweb's OWASP CRS at high
    paranoia flagged the base64 payload of a legitimate avatar broadcast. The
    /v1/ (indexer) and /relay/ (relay) JSON APIs — which are validated by their
    own op-allowlist, schema, invite gate, altcha, and rate limits — are now exempt
    from ModSecurity; the human-facing web surface keeps full WAF protection. The
    upgrade applies this to existing nodes automatically and reloads bunkerweb.

  Notes

  • No protocol/consensus change, no migration, no data change; offline-first
    preserved. morphit-ops upgrade applies all three fixes on its own — operators
    don't re-run the installer or touch bunkerweb by hand.
  • New contact-url-resilience-smoke (17 checks) pins every part: the
    normalize/repair helper, the indexer's non-fatal load, the edit-branding
    validation, the upgrade auto-repair (contact URL + WAF), and the verify.json
    path resolution.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    3 downloads · 2026-09-07 01:15:11 +00:00 · 1 KiB
  • morphit-v1.16.7-offline.tar.gz
    0 downloads · 2026-09-07 01:15:26 +00:00 · 722 MiB
  • morphit-v1.16.7-offline.tar.gz.sha256
    0 downloads · 2026-09-07 01:15:26 +00:00 · 97 B
  • morphit-v1.16.7.tar.gz
    2 downloads · 2026-09-07 01:15:11 +00:00 · 32 MiB
  • morphit-v1.16.7.tar.gz.sha256
    4 downloads · 2026-09-07 01:15:11 +00:00 · 89 B
• v1.16.6 a426626d2c

  Compare

  Morphit v1.16.6 Stable

  agorise released this 2026-09-06 03:37:18 +00:00 | 31 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.16.6

  A privacy-critical fix. A hidden-only, zero-clearnet instance was fetching its
  own software upgrade over clearnet (git.agorise.net, with a Codeberg probe) instead
  of over Tor/I2P. This release makes a hidden-only node resolve its upgrade entirely
  over hidden services — or refuse — and say exactly which hidden gateways it used.
  Ship this immediately if you run any hidden-only node.

  Fixed

  • Hidden-only upgrades no longer touch clearnet. The upgrade's hidden-only
    detection had two faults, each enough to send a zero-clearnet node down the
    clearnet path:
    1. It read morphit.config.env, but the RPC pool that signals hidden-only
       (MORPHIT_INDEXER_RPC_ENDPOINTS) lives in indexer.env — so it never found
       the key and defaulted to clearnet.
    2. Even against the right file, the value-matching regex used \s*, which
       matches newlines, so an empty MORPHIT_INDEXER_RPC_ENDPOINTS= captured the
       next config line and read as non-empty.
       The result: on a hidden-only box the release was downloaded from git.agorise.net
       over HTTPS. Both are fixed, and the detection is now authoritative: it asks
       the local indexer's /v1/instance for clearnet_eliminated — the same
       seven-leg gate that earns the directory badge — and only falls back to the
       (now correctly-read) config file if the indexer is unreachable. A hidden-only
       node fetches the release over Tor/I2P from a federation peer's IPFS gateway,
       verified against the on-chain SHA-256, and fails closed — it never falls
       back to a clearnet mirror.

  Changed

  • The upgrade now names the hidden services it used. On a hidden-only node it
    reports the IPNS target, the hidden gateways it is fetching over (host + Tor/I2P
    tag), and the gateway that served the verified tarball — and states plainly that
    no clearnet host was touched. No more guessing where the bytes came from.

  Notes

  • No behaviour change for clearnet instances; no protocol change; no migration.
  • New hidden-upgrade-detection-smoke (13 checks) pins both faults closed: the
    file heuristic keys off the right variable and can't be fooled by an empty
    value, the detector prefers clearnet_eliminated, the caller reads
    indexer.env, and the resolver reports the hidden gateway and states
    "zero clearnet."
  • If you already upgraded a hidden-only node to v1.16.5 (which fetched over
    clearnet), upgrading to v1.16.6 restores the hidden-only path for all future
    upgrades.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    5 downloads · 2026-09-06 04:08:10 +00:00 · 1 KiB
  • morphit-v1.16.6-offline.tar.gz
    0 downloads · 2026-09-06 04:08:30 +00:00 · 722 MiB
  • morphit-v1.16.6-offline.tar.gz.sha256
    0 downloads · 2026-09-06 04:08:30 +00:00 · 97 B
  • morphit-v1.16.6.tar.gz
    4 downloads · 2026-09-06 04:08:10 +00:00 · 32 MiB
  • morphit-v1.16.6.tar.gz.sha256
    4 downloads · 2026-09-06 04:08:10 +00:00 · 89 B
• v1.16.5 f3127270fb

  Compare

  Morphit v1.16.5 Stable

  agorise released this 2026-09-05 21:12:21 +00:00 | 32 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.16.5

  A big usability + robustness release, all in the browser client. One source of
  truth for chain-write errors so no save ever fails cryptically, a real fix for
  duplicate operator identicons, the zero-clearnet story on the privacy policy, a
  guard that stops a doomed operator re-registration, and a hardened avatar upload.
  No consensus or protocol change; no migration.

  Added

  • One source of truth for chain-write errors. Every operation that writes to
    the chain — saving your profile, posting an order, leaving or responding to
    feedback, blocking someone — now routes failures through a single classifier
    that names the exact problem and the fix, in all ten locales, and never a
    dead-end "try again" or "open DevTools." Covered causes: your instance being
    unreachable or unable to reach the Blurt network (including network/country
    filtering), you being offline, too little liquid BLURT for the operation fee, an
    oversized payload, an unauthorized signing key, a device-clock skew that expires
    the transaction, a duplicate, and — for anything unrecognized — the raw chain
    reason verbatim.
  • Zero-clearnet on the Privacy policy. The privacy-terms page now explains, in
    all ten locales, that a Morphit node can run with zero use of the clearnet
    internet (every path over Tor/I2P, verified) — alongside the existing Security
    page, FAQ, brag list, and comparison coverage.

  Changed

  • Operator-page identicons are unique again — for real this time. The fix now
    lives in the component that actually renders them (IdentityLabel), which was
    seeding from raw UTF-8 bytes, so accounts sharing a prefix (morphit,
    morphitir, morphitlat) drew near-identical hearts. String seeds are now
    avalanche-hashed; real avatar-byte seeds are untouched. A structural regression
    pins that the render path uses the hasher, so a fix that misses it can't pass.
  • Avatar upload, hardened end to end. The "getting close to the size limit"
    nag is gone (a file under the cap needs no warning); a very long or space-laden
    filename is shown truncated and can't overflow the card; a double-click can't
    fire — or pay the fee for — the broadcast twice; and a pixel-bomb (a small file
    that decodes to enormous dimensions) is rejected up front by reading the header,
    before it can freeze the tab, with an accurate "downscale it" message.
  • Wording: Blurt uses a liquid-BLURT fee, not resource credits. Broadcast
    error copy now describes the real Blurt model (a small per-operation fee paid
    from liquid BLURT) instead of the Steem/Hive "resource credits" it does not use.

  Notes

  • A doomed operator re-registration is now caught before broadcast. The
    federation tag is immutable; morphit-ops register now checks your account's
    existing on-chain tag against the local indexer first and refuses (with the
    exact fix) if they differ, instead of emitting an op the chain silently rejects
    as tag_immutable.
  • No behaviour change for existing data; offline-first preserved; no new external
    dependency. New guard smokes pin the classifier (39 checks), avatar robustness
    (44), and the tag guard (9).

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    1 download · 2026-09-05 21:40:05 +00:00 · 1 KiB
  • morphit-v1.16.5-offline.tar.gz
    0 downloads · 2026-09-05 21:40:25 +00:00 · 722 MiB
  • morphit-v1.16.5-offline.tar.gz.sha256
    1 download · 2026-09-05 21:40:26 +00:00 · 97 B
  • morphit-v1.16.5.tar.gz
    1 download · 2026-09-05 21:40:05 +00:00 · 32 MiB
  • morphit-v1.16.5.tar.gz.sha256
    2 downloads · 2026-09-05 21:40:05 +00:00 · 89 B
• v1.16.4 0a22cf036b

  Compare

  Morphit v1.16.4 Stable

  agorise released this 2026-09-05 08:59:48 +00:00 | 33 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.16.4

  Supersedes v1.16.3 (never released). A content + hardening release: the "zero
  clearnet" story is now documented across the site (it's true and proven), two
  defense-in-depth security fixes from a fresh audit of the v1.16.x delta, a shield
  on the verified badge, a fixed operators-page identicon, and a CI gap closed. No
  consensus or protocol change.

  Added

  • "Run with zero clearnet" is documented everywhere it should be. With
    hidden-only clearnet elimination proven live in the directory, the capability
    is explained across the site — a new Security-page section, an expanded
    operator FAQ answer, a rewritten brag-list entry, a new row in the comparison
    image, and a network-privacy note on the Privacy page — all across the ten
    locales. The framing is per-node and honest: a Morphit node can run with
    zero clearnet (every outbound path over Tor/I2P, verified by the seven-leg
    gate), and one — morphitlat — does, while a clearnet instance still uses
    clearnet by design.
  • A 🛡️ on the verified badge. Instances that qualify now show
    "🛡️ Zero use of clearnet internet" in the directory — the shield renders only
    on the strong, provably-earned label.

  Changed

  • Contact-link phishing hardening (audit v16-2). Userinfo-phishing rejection
    (https://matrix.to@evil.com) now lives in the shared contact-URL detector and
    render sanitiser, not only the on-chain gate, so all four consumers enforce it
    and can't drift.
  • Hidden-transport address validation (audit v16-1). The clearnet_eliminated
    transport legs now validate that an advertised Tor/I2P address is a real
    .onion / .i2p host, so a typo can't assert the leg.
  • Operators-page identicons are unique again. Account-name identicons were
    seeded from raw UTF-8 bytes, so accounts sharing a prefix (e.g. morphit,
    morphitir, morphitlat) rendered near-identical hearts. String seeds are now
    avalanche-hashed so any name change diverges every byte; real avatar-byte seeds
    are unchanged.

  Notes

  • No behaviour change for clearnet nodes, no migration, no protocol change.
    Offline-first preserved; no new external dependency.
  • Fresh security audit of the v1.16.0→v1.16.2 delta
    (docs/AUDIT-v1.16.x-DELTA-DEEP-DEEP.md): the clearnet-elimination gate and
    hidden-transport layer verified sound; the two findings above were the only
    gaps, both fixed. Threat models refreshed
    (docs/audit/2026-09-v1.16-delta-threat-model.md).
  • CI now catches browser-bundle breaks. A new web-build-smoke runs
    vite build in the battery, so a Node-only import reaching the client bundle
    fails on push (and locally) rather than at release time. Two guard smokes pin
    the audit invariants.
  • Operator note (not shipped in code): an instance's operators-page title is
    the on-chain operator display_name, set from MORPHIT_INSTANCE_NAME at
    registration. Changing the instance name updates the /instances card but not
    the operator record until the operator re-registers (morphit-ops register,
    an account-keyed upsert).

  Downloads

  • Source code (ZIP)
    1 download
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    5 downloads · 2026-09-05 09:33:07 +00:00 · 1 KiB
  • morphit-v1.16.4-offline.tar.gz
    0 downloads · 2026-09-05 09:33:28 +00:00 · 722 MiB
  • morphit-v1.16.4-offline.tar.gz.sha256
    1 download · 2026-09-05 09:33:28 +00:00 · 97 B
  • morphit-v1.16.4.tar.gz
    3 downloads · 2026-09-05 09:33:07 +00:00 · 32 MiB
  • morphit-v1.16.4.tar.gz.sha256
    4 downloads · 2026-09-05 09:33:07 +00:00 · 89 B
• v1.16.2 77b7af9413

  Compare

  Morphit v1.16.2 Stable

  agorise released this 2026-09-05 01:22:18 +00:00 | 35 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.16.2

  Operators can point "Contact this operator" at any messenger, the minimum system requirements read the same everywhere, the setup/upgrade screens never sit silent, and hosting instances can serve their pinned release over .onion/.i2p. A batch of operator-experience fixes plus the serving half of the hidden-only upgrade path that v1.16.1 flagged as still to come.

  Added

  • Messenger contact links. An operator's contact_url now accepts the common secure messengers and app-handoff schemes — Matrix, Session, Signal, Telegram, Discord, XMPP, Briar, Cwtch, Jami, SimpleX, email, or a plain https:// page — so "Contact this operator" deep-links straight to the operator's chosen channel. Addresses with no URL handler (Session, Cwtch) render as one-tap copy buttons instead of dead links. A single allowlist is the one source of truth for the on-chain registration gate, the installer, the frontend validator, and the render sanitizer, so all four agree; http:// is refused everywhere (it was already refused on-chain). Translated across all ten locales.
  • Serve the pinned release over .onion/.i2p (the piece v1.16.1 flagged). A hosting instance can now expose its Kubo gateway on the frontend at /ipfs/<cid> and /ipns/<name>, so a clearnet-censored node can fetch a release over the instance's hidden addresses — no clearnet, no third-party pinning service. Gateway.NoFetch=true is now always set, so the gateway serves only the CIDs this node has pinned (its own ~12 MB signed release) and never fetches an arbitrary CID — it is not an open proxy. Exposure is opt-in and off by default (morphit_ipfs_gateway_expose, default false): the default posture is unchanged (gateway loopback-only, and the frontend /ipfs routes return a clean 404). When enabled it binds the gateway to the Docker bridge exactly the way the relay and indexer already bind — public inbound stays closed by UFW default-deny.

  Changed

  • The braille spinner now covers every silent wait. In addition to the wizard's DNS / chain-lookup / system-check / Tor-I2P steps, it now turns during the on-chain registration broadcast (install) and during release-source discovery, the tarball download, and the post-upgrade service poll (upgrade) — so a slow network step never looks frozen. TTY-aware; the security-critical key-wipe on the registration path is untouched.
  • Consistent minimum system requirements: 2+ CPUs, 4+ GB RAM, 80+ GB drive (SSD is best). The frontend copy and the operator docs already said this; the installer's own pre-flight system check was still recommending ≥2 GB RAM / ≥20 GB disk. It now recommends ≥4 GB / ≥80 GB with matching ok/warn/error bands, so what the installer tells you matches what everything else does.

  Notes

  • No change for clearnet nodes, and no change to any node's default posture: Gateway.NoFetch is a pure hardening win, and the gateway stays loopback-only unless an operator opts in.
  • The gateway-exposure path is unvalidated in CI — it needs a live box that runs IPFS hosting to prove end-to-end, so it rides live-box validation before an operator turns it on. The always-on NoFetch setting and the default-safe routing are the parts that ship proven.
  • Offline-first preserved. No new external dependency anywhere; the whole tree still installs and upgrades from the bundled tarball with no network.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    3 downloads · 2026-09-05 03:04:24 +00:00 · 1 KiB
  • morphit-v1.16.2-offline.tar.gz
    0 downloads · 2026-09-05 03:04:44 +00:00 · 722 MiB
  • morphit-v1.16.2-offline.tar.gz.sha256
    0 downloads · 2026-09-05 03:04:45 +00:00 · 97 B
  • morphit-v1.16.2.tar.gz
    3 downloads · 2026-09-05 03:04:24 +00:00 · 32 MiB
  • morphit-v1.16.2.tar.gz.sha256
    3 downloads · 2026-09-05 03:04:24 +00:00 · 89 B
• v1.16.1 295c946c62

  Compare

  Morphit v1.16.1 Stable

  agorise released this 2026-09-04 19:16:56 +00:00 | 37 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.16.1

  Hidden-only nodes now upgrade over Tor/I2P and can honestly claim "Zero use of clearnet internet." This completes the hidden-only privacy path started in v1.16.0: the last outbound leg — software upgrades — now rides the federation over Tor/I2P, fully verified and fail-closed, so a hidden-only node never touches a clearnet host for anything. The clearnet_eliminated gate flips true when a node proves every leg, and the directory shows it.

  Added

  • Hidden IPFS-over-Tor/I2P upgrades (fail-closed). On a hidden-only node (clearnet RPC pool empty), morphit-ops upgrade fetches the release from federation peers' IPFS gateways over Tor/I2P — the stable on-chain IPNS pointer, raced across several peers, verified against the on-chain SHA-256 (anti-rollback), and fail-closed: if it can't get the release privately it stays on the current version, it never falls back to a clearnet mirror. A clearnet node's upgrade path is byte-for-byte unchanged.
  • @morphit/hidden-transport — a new dependency-free workspace package holding the shared SOCKS5/Tor + I2P transport core, so the indexer and ops-cli use one copy with no drift. Pure node built-ins; bundles and installs fully offline.
  • The "Zero use of clearnet internet" directory label. The federation probe now captures each peer's clearnet_eliminated gate and the directory card renders the strong claim when it's true (falling back to "No clearnet reliance" for a hidden-origin instance that hasn't proven every leg). Translated across all ten locales.

  Changed

  • clearnet_eliminated flips true for a node that proves all seven legs — chain over onion/i2p, Tor and I2P transports (both required), federation-syndicated price, local-only frontend, the fail-closed hidden upgrade, and a clean (or absent) Matrix homeserver. /v1/instance also exposes clearnet_eliminated_missing listing any open legs, so an operator sees exactly what's left.

  Notes

  • No change for clearnet nodes. Every hidden-only behaviour activates only when the clearnet RPC pool is empty; clearnet nodes upgrade exactly as before.
  • Additive schema (v59), safe to upgrade mid-sync. known_instances.cached_clearnet_eliminated is additive with a false default; the probe fills it each cycle, older peers stay false.
  • Offline-first preserved. No new external dependency anywhere; the hidden-transport package is workspace-linked and the whole tree still installs/upgrades from the bundled tarball with no network.
  • Still to come (separate, box-validated): exposing each hosting instance's kubo gateway over its .onion/.i2p with Gateway.NoFetch=true, so hidden-only nodes can actually fetch the release from peers. Until that lands, a hidden-only morphit-ops upgrade fail-closes cleanly (the node upgrades offline as it does today) — the "zero clearnet" claim holds either way because the path never touches clearnet.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    4 downloads · 2026-09-04 19:47:18 +00:00 · 1 KiB
  • morphit-v1.16.1-offline.tar.gz
    0 downloads · 2026-09-04 19:47:34 +00:00 · 722 MiB
  • morphit-v1.16.1-offline.tar.gz.sha256
    0 downloads · 2026-09-04 19:47:34 +00:00 · 97 B
  • morphit-v1.16.1.tar.gz
    3 downloads · 2026-09-04 19:47:17 +00:00 · 32 MiB
  • morphit-v1.16.1.tar.gz.sha256
    4 downloads · 2026-09-04 19:47:17 +00:00 · 89 B
• v1.16.0 291b3330ef

  Compare

  Morphit v1.16.0 Stable

  agorise released this 2026-09-04 02:02:28 +00:00 | 38 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.16.0

  The privacy foundation for max-privacy "hidden-only" nodes (Tor and I2P as equals), a faster optional catch-up engine, and two fixes that were locking operators out of their own servers.

  This is a feature release. The headline work is the first wave of the hidden-only architecture — a node that reaches the chain, its prices, and (soon) its upgrades over Tor/I2P and never touches a clearnet host. It ships behind a strict, provable gate that stays off until every leg is real, so nothing claims more than the code enforces.

  Added

  Hidden-only privacy foundation (opt-in; a node becomes hidden-only when its clearnet RPC pool is empty).

  • Fail-closed clearnet routing. On a hidden-only node, a public clearnet origin is refused at the dispatcher — errored, never sent over the open internet — so the node can't deanonymize itself even if a code path slips a clearnet URL through. Local/loopback and .loki are unaffected; .onion→Tor and .i2p→i2pd still route. Clearnet-RPC nodes are byte-for-byte unchanged.
  • Federation-syndicated pricing. A hidden-only node no longer calls any clearnet price API. It prices from the federation median of peers' signed morphit_native receipts, fetched over each peer's on-chain .onion/.i2p address (I2P preferred). The peer set is chain-driven, so a newly-registered instance joins the syndication automatically — no config anywhere.
  • Local-only frontend, enforced. A build-time smoke fails CI if the served bundle ever auto-loads an external clearnet resource (font/script/style/analytics). Today it's clean.
  • Verified hidden upgrade fetch (core). The release-fetch logic pulls the tarball from peers' hidden IPFS gateways, races several peers (first verified wins), checks it against the on-chain SHA-256 (anti-rollback), and fails closed with no clearnet fallback. (Transport wiring into the upgrade command lands next.)
  • The clearnet_eliminated gate. A strict AND of seven legs — chain-hidden, Tor, I2P, price-federated, frontend-local, upgrade-hidden, matrix-clean. Dual-transport is mandatory (a Tor-only node can't claim it), and a clearnet Matrix homeserver voids it. Exposed on /v1/instance with a clearnet_eliminated_missing diagnostic so an operator sees exactly which legs are open. Currently false everywhere — the strong "zero clearnet" claim renders nowhere until a node proves every leg.

  Adaptive flow-backfill (opt-in, default fifo). A new out-of-order reorder-buffer catch-up path (MORPHIT_INDEXER_BACKFILL_MODE=flow) that keeps every healthy RPC endpoint busy and applies the contiguous block prefix as it fills, so a slow Tor/I2P endpoint no longer head-of-line-blocks a genesis replay. Memory-governed (cgroup-aware, backpressure + RSS safety valve), with a cursor-window hedge and bounded retries. Strict in-order apply is preserved.

  Fixed

  The hardening step no longer locks you out of your own server. On a Contabo/OVH-style box (password-only root, no SSH key), enabling hardening used to disable password + root login with no key in place — a guaranteed lockout. Hardening now detects whether any SSH public key exists and, if none does, leaves password login enabled and prints exactly how to add a key and re-run — so it can never lock you out, and never silently half-hardens.

  The warrant-canary refresh stops asking for your passphrase three times. The refresh made several separate SSH connections (a dir check + two uploads), each prompting again. It now reuses one authenticated SSH connection (ControlMaster) across all of them, so a remote-hosted canary refresh prompts once for SSH instead of per-operation.

  Docs

  • The "Make it your own" section now lists the exact brand files and their sizes (mark ~1.55:1, wordmark ~5.8:1, favicon, PWA icons 512×512 with a maskable safe-margin), plus the hero_title/hero_body and header/footer i18n keys — so a new operator can rebrand without guessing.

  Notes

  • No breaking change for existing clearnet nodes. Every hidden-only behaviour activates only when the clearnet RPC pool is empty; flow-backfill is opt-in. Upgrade in place.
  • Additive schema only; safe to upgrade mid-sync (migrations are idempotent and the indexer resumes from its persisted cursor).
  • New env: MORPHIT_INDEXER_BACKFILL_MODE/_MAX_BUFFER_MB/_MEM_FRACTION/_HEDGE_FACTOR, MORPHIT_INSTANCE_MATRIX_HOMESERVER (all optional, safe defaults).
  • Still in flight for a later release: the upgrade command's Tor/I2P transport + peer kubo-gateway-over-hidden infra (the upgradeHidden leg), and the operator-facing "zero clearnet" content — both land only once provable on a live box, keeping the gate honest.

  Downloads

  • Source code (ZIP)
    1 download
  • Source code (TAR.GZ)
    1 download

  ---

  • distribution-anchor.env
    7 downloads · 2026-09-04 02:51:45 +00:00 · 1 KiB
  • morphit-v1.16.0-offline.tar.gz
    1 download · 2026-09-04 02:51:59 +00:00 · 717 MiB
  • morphit-v1.16.0-offline.tar.gz.sha256
    4 downloads · 2026-09-04 02:52:00 +00:00 · 97 B
  • morphit-v1.16.0.tar.gz
    4 downloads · 2026-09-04 02:51:45 +00:00 · 32 MiB
  • morphit-v1.16.0.tar.gz.sha256
    5 downloads · 2026-09-04 02:51:45 +00:00 · 89 B
• v1.15.7 a189679766

  Compare

  Morphit v1.15.7 Stable

  agorise released this 2026-09-03 06:58:14 +00:00 | 39 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.15.7

  Fixes a crash that silently froze every instance's directory listing: the federation probe was reading a database column that didn't exist, so no node was ever re-probed and directory names/taglines went stale.

  Fixed

  The federation probe no longer crashes on a missing column. The clearnet-blocked detection added in v1.15.3 ("Fix B") queried operators.last_action_block_num, but that column was never added to the operators table. Against a live database the probe scan threw column o.last_action_block_num does not exist on every cycle — so no instance was ever re-probed, and each instance's cached name/tagline in the /instances directory stayed frozen at whatever was there before (a renamed instance kept showing its old name even though its on-chain registration was correct). This release adds the column (migration v58, additive/nullable, backfilled to registered_in_block) and advances it on each operator registration, so the probe runs again and the directory refreshes. The unit smoke that covers the probe mocks the database, so it never ran the real SQL — a new query↔schema parity smoke now reconciles every operators-aliased column the probe selects against the actual schema (CREATE TABLE + migrations), which would have caught this before it shipped.

  Re-registration now broadcasts a legacy-stored I2P b32 address. An instance whose .b32.i2p address is held in the older single MORPHIT_INSTANCE_I2P_ADDRESS variable (rather than the split MORPHIT_INSTANCE_I2P_B32_ADDRESS) had its b32 shown in the edit wizard but dropped from the on-chain register op — the wizard applied the legacy fallback and the register command did not. register now applies the same fallback, so the b32 is published like the other addresses.

  Notes

  • Operators upgrading from an affected version should re-run morphit-ops → option 2 (upgrade); migration v58 adds and backfills the column automatically. No manual step. (If you already added the column by hand as a hotfix, the migration is idempotent — ADD COLUMN IF NOT EXISTS — and leaves your data alone.)
  • Includes v1.15.6 (sealed-credential auto-unlock + paste-hardened prompt), v1.15.5 (contact-URL re-register + disambiguated prompt), and v1.15.4 (noble-only installer gating).
  • Known limitation: last_action_block_num advances on registration; richer per-op aliveness tracking (so a long-running censored node stays classified clearnet_blocked between registrations) is a follow-up. Until then a censored node that hasn't re-registered within the window classifies as unreachable — the safe default.

  Downloads

  • Source code (ZIP)
    1 download
  • Source code (TAR.GZ)
    1 download

  ---

  • distribution-anchor.env
    3 downloads · 2026-09-03 07:28:45 +00:00 · 1 KiB
  • morphit-v1.15.7-offline.tar.gz
    0 downloads · 2026-09-03 07:29:03 +00:00 · 724 MiB
  • morphit-v1.15.7-offline.tar.gz.sha256
    1 download · 2026-09-03 07:29:03 +00:00 · 97 B
  • morphit-v1.15.7.tar.gz
    2 downloads · 2026-09-03 07:28:45 +00:00 · 32 MiB
  • morphit-v1.15.7.tar.gz.sha256
    2 downloads · 2026-09-03 07:28:45 +00:00 · 89 B