182 releases 182 tags

RSS feed

• v1.17.11 3e5a5a3762

  Compare

  Morphit v1.17.11 Stable

  agorise released this 2026-09-16 20:09:36 +00:00 | 1 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.17.11

  Fixes the last reason a Tor/I2P-only instance could not mirror the federation
  snapshot, and stops two checks reporting healthy instances as broken. No protocol
  or consensus change.

  Fixed

  • A privacy-network-only instance can finally mirror the snapshot. Requests to
    the chain were given ten seconds to complete. That is generous for the ordinary
    internet and impossible over Tor or I2P, where the connection has to be built
    before any data moves and half a minute is normal. So every attempt was
    cancelled before it could succeed — on working and broken addresses alike — and
    reported as "no usable endpoint", while the very same address answered a manual
    request in seconds. The allowance now depends on how the address is reached:
    ordinary addresses keep the short limit, privacy-network ones get a much longer
    one.

  • An instance no longer accuses itself of advertising the wrong address. The
    new check read the first privacy address its router reported, which is only
    correct on a machine hosting exactly one. A machine hosting several compared a
    stranger's address against its own and declared correct settings wrong — while
    the line below confirmed that same address was serving. It now looks at the
    right entry, and says nothing at all when it cannot tell which one is ours.

  • An instance without ordinary internet is no longer reported as broken. One
    check tried to reach the site the way an ordinary visitor would. A
    privacy-only instance has no such entrance — it is reached through its Tor and
    I2P addresses — so the check always failed and warned about an instance whose
    Tor and I2P checks passed two lines later. It is now skipped for those
    instances, with the reason stated.

  • Every part of Morphit now uses the full list of chain nodes. The instance
    publishes a list of chain nodes on-chain so instances always have plenty to
    choose from. The part of Morphit that reads the chain used that full list; the
    part that sends things to the chain — account signups and transfers — did
    not, and stayed on the handful written into its configuration. That is
    backwards: sending is exactly what you least want failing when ordinary
    internet nodes go down, and it is what the privacy-network nodes exist to keep
    working. Both now use the whole list.

  • Short-lived jobs no longer start from scratch. Your instance continuously
    learns which nodes are fast and which are down. Anything that runs and exits —
    the mirror job, a fast-sync, any one-off command — threw all of that away and
    worked through nodes in the order they happen to be listed, waiting out a full
    timeout on one that was already known to be down. That knowledge is now shared,
    so a one-off job goes straight to a good node. Nothing is ever struck off the
    list: a node that was down a minute ago may be back, and still gets its turn.

  Notes

  • No protocol/consensus change. Everything here is operator-facing.
  • An instance that could not mirror will do so on its next upgrade or its next
    scheduled attempt.
  • If a recent upgrade warned that your privacy address was "advertised wrong",
    check it against what your router reports before changing anything — that
    warning was unreliable before this release.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    1 download · 2026-09-16 20:44:19 +00:00 · 1 KiB
  • morphit-v1.17.11.tar.gz
    2 downloads · 2026-09-16 20:44:19 +00:00 · 32 MiB
  • morphit-v1.17.11.tar.gz.sha256
    2 downloads · 2026-09-16 20:44:19 +00:00 · 90 B
• v1.17.10 7c59ff43b2

  Compare

  Morphit v1.17.10 Stable

  agorise released this 2026-09-15 05:47:57 +00:00 | 2 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.17.10

  Removes a step that could hold a release hostage, and finishes the operator-facing
  follow-ups from v1.17.9. No protocol or consensus change.

  Fixed

  • Publishing a release no longer waits on anyone else. The release checklist
    ended with a step that asked a public gateway whether it could see the new
    version yet. Those gateways take minutes to notice fresh content, so a perfectly
    good release could sit there for half an hour, repeating "not yet" — and the
    operator had no way to tell a slow gateway from a real problem. That step is
    gone. The upgrade already proves the same thing better and earlier: it confirms
    the file it produced matches the one recorded for the release, and that it is
    being served over the instance's own address, its Tor address and its I2P
    address — which are the paths other instances actually use. A public gateway
    noticing later adds nothing and is outside anyone's control. The check is still
    available to run by hand if you ever want it; it simply cannot block a release.
  • When it is run by hand, it answers immediately. Given the instance that just
    published, it asks that instance and returns in about a second instead of
    polling. Without one it says so plainly, with the exact command to re-run,
    rather than grinding through a long wait and looking like something is broken.

  Notes

  • No protocol/consensus change. This is release-process and operator-facing only.
  • Nothing you run on your servers changes. The difference is in the release
    checklist itself.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    5 downloads · 2026-09-15 06:21:37 +00:00 · 1 KiB
  • morphit-v1.17.10.tar.gz
    3 downloads · 2026-09-15 06:21:37 +00:00 · 32 MiB
  • morphit-v1.17.10.tar.gz.sha256
    3 downloads · 2026-09-15 06:21:37 +00:00 · 90 B
• v1.17.9 adcaf972f2

  Compare

  Morphit v1.17.9 Stable

  agorise released this 2026-09-14 23:30:53 +00:00 | 3 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.17.9

  Clears the whole remaining follow-up list. Mostly about instances telling you the
  truth: catching an advertised address your own router does not actually host,
  and not burying you in repeats of the same alert. No protocol or consensus change.

  Fixed

  • An instance now notices when it is advertising an address it does not host.
    One instance published a privacy-network address that its own router had stopped
    serving — the key had been regenerated at some point and the setting was never
    updated. Every peer trying to reach it that way failed, for an unknown length of
    time, hidden by its other address still working. Your machine already knows the
    answer: both privacy services publish locally what they are really hosting. An
    upgrade now compares the two and, if they differ, prints both and the exact
    setting to change.
  • A check no longer explains away its own finding. When that address was
    broken, the message said privacy tunnels are slow to start and to try again
    later — so nobody investigated. It now distinguishes "no answer yet", which
    genuinely deserves patience, from "an answer came back", which means the tunnel
    is working and something further along is wrong.
  • Alerts stop repeating themselves. Background checks run on a timer, so an
    unchanged problem was re-announced every few minutes. The same condition is now
    reported at most once every six hours; any change is reported immediately, and a
    persisting problem still re-announces on that cadence so nothing is forgotten.
    If the bookkeeping cannot be written it goes back to reporting every time —
    never to silence.

  Added

  • You can now rehearse fast-sync from the menu. "Fast-sync" accepts a rehearse
    option that finds, downloads and verifies the newest snapshot and then stops,
    touching nothing. It is safe on a running instance. Previously this required a
    hand-typed developer command, which meant the one thing most worth testing was
    never tested.

  Notes

  • No protocol/consensus change. Everything here is operator-facing.
  • If an upgrade reports an address mismatch, fix the setting it names and then
    re-publish your registration so other instances learn the working address.
  • To rehearse: sudo morphit-ops fast-sync --rehearse.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    9 downloads · 2026-09-15 00:04:51 +00:00 · 1 KiB
  • morphit-v1.17.9.tar.gz
    3 downloads · 2026-09-15 00:04:51 +00:00 · 32 MiB
  • morphit-v1.17.9.tar.gz.sha256
    3 downloads · 2026-09-15 00:04:51 +00:00 · 89 B
• v1.17.8 70c1ffa7f1

  Compare

  Morphit v1.17.8 Stable

  agorise released this 2026-09-14 04:56:15 +00:00 | 5 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.17.8

  Makes fast-sync actually work on a node with no clearnet — the case the whole
  feature exists for, and the one that had never been tested. No protocol or
  consensus change.

  Fixed

  • A Tor/I2P-only node can now fast-sync at all. Routing for hidden addresses
    was switched on by the indexer service and nowhere else, so the service read
    the chain happily over I2P while any of the tools running beside it aimed the
    same request straight at a hidden address with no proxy and got a bare
    "failed". A hidden-only node therefore could not even look up where the
    snapshot was, let alone fetch it — which is why one such instance would not
    mirror. Both the snapshot fetcher and the mirror now switch routing on
    themselves, and still refuse to fall back to the open internet.
  • Serving snapshots over the web works on more instances. The web front end
    passed the visitor's own hostname through to the local IPFS gateway. A gateway
    treats an unfamiliar hostname as a name it might have to look up, and on a node
    configured not to fetch, that request simply hangs — so the page eventually
    returned "not found". It now passes an address the gateway recognises. The
    affected instance's Tor and I2P paths were unaffected throughout, which is why
    this went unnoticed.
  • The gateway self-check stops reporting a healthy box as broken. It was
    asking with the same unusable hostname, so it declared the connection blocked
    on machines where it was fine, and its firewall repairs were aimed at a problem
    that did not exist.
  • Mirroring waits for the network to come up. A node restarts IPFS during an
    upgrade and the mirror ran immediately afterwards, when IPFS was answering but
    had no connections yet. It spent ten minutes trying to fetch from a network it
    had not joined, then gave up. It now waits for connections and, if there are
    none, says so and retries later instead of stalling.

  Added

  • Fast-sync is now genuinely tested on a simulated zero-clearnet node, over
    Tor and I2P separately — they are different code paths, so passing one proves
    nothing about the other. The tests use faithful stand-ins for both proxies and
    confirm the traffic really went through them, rather than trusting that the
    request succeeded.
  • That test also proves the privacy guarantee: offered a working open-internet
    source, a hidden-only node still refuses it rather than quietly using it to
    finish sooner.

  Notes

  • No protocol/consensus change. Everything here is operator-facing.
  • An instance that could not mirror before will do so on its next upgrade, or
    at its next scheduled attempt.
  • OPERATIONS.md §52 covers the snapshot pipeline and how to check it.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    14 downloads · 2026-09-14 05:29:56 +00:00 · 1 KiB
  • morphit-v1.17.8.tar.gz
    3 downloads · 2026-09-14 05:29:56 +00:00 · 32 MiB
  • morphit-v1.17.8.tar.gz.sha256
    3 downloads · 2026-09-14 05:29:56 +00:00 · 89 B
• v1.17.7 81c4ff4e33

  Compare

  Morphit v1.17.7 Stable

  agorise released this 2026-09-13 22:21:49 +00:00 | 6 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.17.7

  Finishes what v1.17.6 started: the snapshot publisher now works when run on a
  schedule, and operator alerts stop repeating themselves. No protocol or consensus
  change.

  Fixed

  • The snapshot publisher works on a timer. It talks to IPFS by switching to
    the IPFS account first — and on a hardened server, both of the standard tools
    for doing that are blocked: one is refused outright by the service's security
    settings, the other is not permitted to change accounts at all. The job is
    already running with full privileges and does not need to switch accounts: the
    IPFS command line only reads a small file and then talks to the running service
    over a local connection. It now tries talking directly first, falls back to
    each account-switching tool in turn, and uses whichever actually works —
    reporting which one it chose. Guessing which tool a given server permits is
    what made this fail repeatedly.
  • Alerts stop repeating. A unit that stayed broken produced a CRITICAL alert
    every five minutes, over and over, for the same unchanged fact. Alerts now fire
    when something changes: once when a unit fails, once when it recovers, and
    again if it fails afresh. A repeat failure is never swallowed, and if the
    bookkeeping cannot be written the behaviour falls back to alerting every scan
    — never to silence.

  Added

  • The alert monitor is now genuinely run during testing, driven through a
    whole failure → recovery → failure-again cycle, because "alerts once and then
    stays quiet" is a property you can only observe by running it repeatedly.
  • The publish test now reproduces a server where both account-switching tools
    are blocked, which is the exact situation that broke the live publisher.

  Notes

  • No protocol/consensus change. Everything here is operator-facing.
  • If you disabled the publish timer to stop the alerts, re-enable it after
    upgrading: sudo systemctl enable --now morphit-snapshot-publish.timer.
  • OPERATIONS.md §52 covers the snapshot pipeline and how to check it.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    7 downloads · 2026-09-13 22:53:00 +00:00 · 1 KiB
  • morphit-v1.17.7.tar.gz
    3 downloads · 2026-09-13 22:53:00 +00:00 · 32 MiB
  • morphit-v1.17.7.tar.gz.sha256
    3 downloads · 2026-09-13 22:53:00 +00:00 · 89 B
• v1.17.6 1c699b070e

  Compare

  Morphit v1.17.6 Stable

  agorise released this 2026-09-13 19:42:30 +00:00 | 7 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.17.6

  Two things get fixed here: operator alerts that were unreadable, and a snapshot
  publish timer that could not complete a single run. Both had the same underlying
  cause — code that was only ever run by hand, never under the conditions it runs
  in for real. No protocol or consensus change.

  Fixed

  • Operator alerts arrive in ONE conversation, and you can read them. The alert
    bot remembered which private conversation to use only until it restarted — and
    it restarts on every upgrade. So each upgrade started a brand-new conversation,
    filling your inbox with duplicates, and because each new one needed its own
    encryption keys shared to a device the bot had never been introduced to, most
    alerts arrived as "Unable to decrypt message". The conversation is now
    remembered across restarts, and encryption is off by default for alerts: an
    alert you cannot read is worth nothing, and these are notices to your own
    account, not secrets. Set MORPHIT_MATRIX_ENCRYPT=1 to turn it back on.
  • Recovering from an encryption-key conflict no longer loses your place. That
    recovery deleted the bot's entire saved state — which also held its position in
    the alert stream and the conversation it uses — so "fixing" encryption started
    yet another conversation. It now clears only the encryption keys.
  • The snapshot publish job can complete a run. Under the service manager it
    failed at a different step each time, for five unrelated reasons, none of which
    appeared when the same script was run by hand: the file was not marked
    executable; a failure discarded the explanation instead of printing it; moving
    the finished snapshot out of a private temporary area failed because it crossed
    a storage boundary; the tool used to switch to the IPFS account is not permitted
    under the service's own security settings; and the check for "is IPFS up?" gave
    up instantly even though this very script restarts IPFS moments earlier.
  • Two other background jobs could never start either. The release monitor and
    the treasury re-pin were shipped without the executable flag, so the service
    manager refused to run them. Probably for some time, silently.
  • A failing publish now tells you why. Several steps sent a failed command's
    output to the bin and reported only "failed". They now print what the command
    actually said.

  Added

  • The publish and mirror jobs are now really run during testing, against
    stand-in IPFS and chain services, instead of only being read. Every failure
    listed above was reproduced and confirmed to be caught by these new tests. The
    mirror test also confirms it refuses a snapshot whose contents do not match the
    published fingerprint, and one published for a different chain.
  • A standing check across every background job: each must be executable, must
    not use a privilege tool its own security settings forbid, and must not discard
    the output of a command whose failure it is reporting.

  Notes

  • No protocol/consensus change. Everything here is operator-facing.
  • If your alert inbox has several "Morphit alerts" conversations, you can leave
    the old ones; after upgrading, the bot settles on one and stays there.
  • OPERATIONS.md §52 covers the snapshot pipeline, publishing, and how to check
    it.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    3 downloads · 2026-09-13 20:14:41 +00:00 · 1 KiB
  • morphit-v1.17.6.tar.gz
    2 downloads · 2026-09-13 20:14:41 +00:00 · 32 MiB
  • morphit-v1.17.6.tar.gz.sha256
    2 downloads · 2026-09-13 20:14:41 +00:00 · 89 B
• v1.17.5 f0d4d74573

  Compare

  Morphit v1.17.5 Stable

  agorise released this 2026-09-13 03:59:01 +00:00 | 8 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.17.5

  The fast-sync snapshot pipeline now actually runs. Three separate faults meant it
  had never worked end to end — which is why no snapshot had ever been published
  since the feature shipped. All three were found by rehearsing the thing for real
  rather than by inspecting it. No protocol or consensus change.

  Fixed

  • Publishing a snapshot works. The publisher read the snapshot's own
    description sheet by handing it to a small helper program down the same channel
    the program itself arrives on — so the description was discarded and the helper
    received nothing. It failed on the very first attempt, every time, which is why
    no federation snapshot had ever been published. The description is now handed
    over separately.
  • Mirroring a snapshot works. The mirror job looked for the IPFS data store in
    the wrong place: it ran as the system administrator, whose data store is empty,
    rather than as the account that owns the real one. So it refused to fetch a file
    the very same machine was already serving. It now uses the right account, and
    its start-up check confirms the data store is genuinely reachable instead of
    merely confirming the software is installed — a check that could not tell the
    two situations apart.
  • The fast-sync rehearsal needs no database. --verify-only was meant to
    fetch and check a snapshot without touching anything, but one leftover database
    lookup ran before it finished, so it failed on any machine without a configured
    indexer. That lookup is only needed when actually restoring, and is now skipped.
  • A rehearsal no longer demands invented settings. It insisted on four
    configuration values it never used. It now fills in the ones it does not need
    and asks only for the chain identifier — which is deliberately never guessed,
    because it is the check that stops a node accepting a snapshot from a different
    chain.
  • Snapshot size reads correctly. A 583 kB snapshot was reported as "0 MB",
    which looked like the export had failed.

  Notes

  • No protocol/consensus change. Everything here is publisher- and
    operator-facing.
  • The first federation snapshot is now published and anchored on-chain, and has
    been fetched and verified from an unrelated machine over a public gateway. New
    instances can fast-sync.
  • OPERATIONS.md §52 covers the pipeline, how to publish, and how to check it.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    4 downloads · 2026-09-13 04:27:15 +00:00 · 1 KiB
  • morphit-v1.17.5.tar.gz
    2 downloads · 2026-09-13 04:27:15 +00:00 · 32 MiB
  • morphit-v1.17.5.tar.gz.sha256
    2 downloads · 2026-09-13 04:27:15 +00:00 · 89 B
• v1.17.4 6c5d7be15b

  Compare

  Morphit v1.17.4 Stable

  agorise released this 2026-09-12 20:39:29 +00:00 | 9 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.17.4

  A polish release, written entirely from watching three real upgrades. Nothing
  here changes what Morphit does — it changes what the upgrade tells you while
  it does it. No protocol or consensus change.

  Fixed

  • Long steps no longer look frozen. Installing dependencies, redeploying the
    MCP server, seeding to IPFS and refreshing the snapshot mirror could each sit
    silent for a minute or more with nothing on screen. Every one of them now turns
    a spinner while it works, so you can always tell the difference between "busy"
    and "stuck". Their output is replayed in full when the step finishes.

  • The seeding self-check can finally see your addresses. It reported "no
    public origin found" and "no hidden address configured" on all three
    instances — including one that is reachable only over Tor and I2P, where the
    message was plainly absurd. Cause: it read one config file and your settings
    live in the other one. It now reads both, plus the web-firewall's own hostname
    as a last resort.

  • Hidden-only upgrades show their release notes. A node that fetches over
    Tor/I2P had no release page to read notes from, so it printed an empty heading
    and you upgraded blind. The notes ship inside the tarball, so they are now read
    from there — the same bytes the SHA-256 already covers.

  • The gateway check no longer raises a false alarm. It asked the gateway for
    an address the gateway does not serve, then read the resulting error as proof
    the connection was blocked — so it announced a problem on every instance,
    including ones demonstrably working. It now asks for something the gateway does
    serve, and treats any reply at all as proof the path is open.

  • Your own instance card now shows your own badge. A node scores its
    clearnet-elimination gate for peers, but never recorded it for itself — so the
    one instance that had actually earned the "Zero use of clearnet internet" medal
    was the only place it didn't appear. Every peer showed it correctly. The self
    card now reads the same gate everyone else sees.

  • Your own instance card no longer disagrees with your peers about your
    status. A node labelled itself only "Good" or "Syncing", while peers applied
    an orderbook-activity rule and could show "Quiet" — the same instance described
    two ways with nothing to explain the gap. The self card now applies the same
    rule. It only relabels on a definite answer, so a lookup that tells it nothing
    can never mark a busy instance quiet.

  Added

  • A safe way to rehearse fast-sync. --verify-only runs the entire consumer
    path — find the signed snapshot on-chain, pick a mirror, download it over
    whichever transport suits the node, and prove every byte against the on-chain
    SHA-256 — then stops before touching any database and tells you what it found.
    It needs no indexer, no Postgres and no server, so you can rehearse the whole
    thing from a laptop and know it works before a brand-new instance depends on
    it.
  • The snapshot publisher's timer installs itself. The publish units were only
    laid down by the automated server setup, which never runs on a hand-built
    install — including the canonical one. They are now installed on every upgrade
    but stay inert until you opt in by creating /etc/morphit/snapshot-publish.env,
    so exactly one instance publishes and no upgrade can make a box start signing
    snapshots by surprise.

  Changed

  • Less alarming output when a check is inconclusive. The gateway check used to
    end with a warning that hidden-only peers could not upgrade from your box — a
    consequence it had not actually established, printed after the upgrade's own
    success message. It now reports only what it observed, says plainly that it can
    be wrong, and makes clear that nothing about it blocks your upgrade.

  Notes

  • No protocol/consensus change. Everything here is operator-facing output quality.
  • If v1.17.3 told you your box had no hidden address or warned that hidden peers
    could not upgrade from it, neither was true — both were reporting bugs, fixed
    here.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    6 downloads · 2026-09-12 21:09:23 +00:00 · 1 KiB
  • morphit-v1.17.4.tar.gz
    1 download · 2026-09-12 21:09:22 +00:00 · 32 MiB
  • morphit-v1.17.4.tar.gz.sha256
    1 download · 2026-09-12 21:09:22 +00:00 · 89 B
• v1.17.3 b977135513

  Compare

  Morphit v1.17.3 Stable

  agorise released this 2026-09-12 05:10:51 +00:00 | 10 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.17.3

  Follow-up to v1.17.2, driven entirely by what two real upgrades revealed. The
  headline item is that nobody could set up a warrant canary — the setup script
  was being killed mid-prompt by a shell error, and the same defect sat in the
  weekly refresh that keeps an existing canary alive. No protocol or consensus
  change.

  Fixed

  • Warrant-canary setup no longer dies mid-prompt. Answering the questions
    would get as far as "Operator name" and then stop with "Canary setup didn't
    finish", with no explanation. The script was not finishing early — it was being
    terminated. It looks for your instance URL to offer as a default, and the
    search used a pipeline that reports "not found" as an error; combined with the
    script's own abort-on-any-error setting, the first configuration file that
    lacked that setting killed it outright. Since almost no existing instance has
    that setting recorded, this affected essentially everyone. The lookup now
    tolerates a miss, tries more places, and on a Tor-only box falls back to your
    .onion as the default.
  • The weekly canary refresh had the same defect. Identical construct in the
    refresh job that the timer runs. A node whose configuration lacked one
    particular setting — or that simply had no .onion among its chain endpoints —
    would have its refresh killed silently, letting a published canary go stale on
    its own schedule with no error any operator would ever see. That is the worse
    version of the bug, because nothing surfaces it until readers notice the date.
  • The seeding self-check can find your addresses again. Every instance was
    reporting "no hidden address configured" and skipping the frontend check, even
    with a live .onion and a working domain. Two causes: the check read one
    setting from one file, and it runs as an unprivileged user that cannot read
    Tor's address file at all. The upgrade now looks these up itself — where it has
    the permission to — and hands them down, with more fallbacks and a message
    naming exactly where it looked when it still finds nothing.
  • The snapshot mirror installs itself on hand-built servers. Its weekly timer
    was only installed by the automated server setup, which never runs on an
    instance that was installed by hand — including the canonical one. The upgrade
    now installs and enables the timer directly, so the feature is not silently
    inert on exactly the servers that matter most.
  • The stray "New major version of npm available!" banner is gone. It was
    printing after the upgrade's own success message, which read like part of the
    result. Suppressed at the last step that could emit it, so it holds however
    that step is run.

  Changed

  • The "Zero use of clearnet internet" badge now shows a medal (🏅) instead of a
    shield (🛡️) in the instance directory. It marks an achievement a node has
    earned by proving all seven outbound paths are hidden, not a protective
    feature — the medal reads that way.

  Security

  • The address lookup deliberately does not read hidden addresses from the
    chain-endpoint configuration. That file lists other operators' .onion
    addresses, and reading it would have made this instance probe a stranger's node
    and report it as its own working seeder.

  Notes

  • No protocol/consensus change. Everything here is operator-facing: setup,
    upgrade, seeding and reporting accuracy.
  • If your canary setup failed on v1.17.2, re-run it after upgrading —
    sudo morphit-ops → "Harden this server", or
    sudo bash /opt/morphit/scripts/canary/setup.sh.
  • OPERATIONS.md §52 covers the snapshot mirror pipeline and how to check it.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    4 downloads · 2026-09-12 05:38:36 +00:00 · 1 KiB
  • morphit-v1.17.3.tar.gz
    3 downloads · 2026-09-12 05:38:35 +00:00 · 32 MiB
  • morphit-v1.17.3.tar.gz.sha256
    4 downloads · 2026-09-12 05:38:36 +00:00 · 89 B
• v1.17.2 f71dcbb2bc

  Compare

  Morphit v1.17.2 Stable

  agorise released this 2026-09-12 02:07:57 +00:00 | 11 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.17.2

  Hidden-seeding and fast-sync release. Two things were quietly broken in the same
  place: a Tor/I2P-only instance could not upgrade from the federation for weeks
  because of a single missing firewall rule, and a Tor/I2P-only instance could not
  fast-sync at all because the snapshot it needs was only ever reachable over
  clearnet. Both are fixed, along with the checks that reported success while the
  first one was broken. No protocol or consensus change.

  Added

  • Every instance now mirrors the federation indexer snapshot. Fast-sync is
    what gets a brand-new node from an empty database to a live orderbook in
    minutes instead of days, and it depends on one small (~600 kB) file that
    @morphit anchors on-chain. Until now nothing kept that file reachable from
    anywhere except the canonical box and a few public clearnet IPFS gateways —
    which made one box a single point of failure for every new instance, and made
    fast-sync impossible for a zero-clearnet node. Your instance now pins that file
    and re-serves it over your clearnet origin, your .onion and your .b32.i2p,
    refreshing weekly and after every upgrade. Mirroring is not a trust claim: a
    newcomer proves every byte against the signed on-chain SHA-256, so a bad mirror
    is caught by arithmetic rather than by reputation. Nothing to configure.
  • Fast-sync works over Tor and I2P. A new node now prefers federation peers
    on the transport it already speaks, ahead of any clearnet source. A hidden-only
    node omits clearnet sources entirely and falls back to a full replay rather than
    reaching for a public gateway — finishing faster is never worth deanonymising
    the box. Peers are discovered from the same chain history the node already reads
    to find the snapshot, so a brand-new box with no indexer yet still finds a
    private mirror, and no address is baked into the source tree to go stale.
  • The frontend-to-gateway firewall path now repairs itself. Every upgrade
    probes the connection from inside the frontend container and, if it is being
    dropped, fixes it in place — firewall rule, then a fallback rule, then a
    container restart, verifying after each and reporting which one worked. An
    instance admin is never asked to paste a firewall command.

  Fixed

  • Hidden-only instances can upgrade from the federation again. The frontend
    proxies /ipfs/ and /ipns/ to the IPFS gateway on the host, but the firewall
    had no rule for that port — so the container-to-host connection was dropped, nginx
    timed out, and every .onion / .b32.i2p release fetch returned a stock 404. Any
    instance running the web firewall was therefore unable to serve releases over
    Tor or I2P, which is why hidden-only nodes fell back to stale copies from
    elsewhere and failed their integrity check. Hardening now opens that port to the
    web-firewall network only (never the public), when this box hosts IPFS — and the
    self-heal above delivers the same fix to instances the installer never manages.
  • The seeding self-check actually runs now. The check introduced for this
    release used a Bash-only construct in a script that runs under /bin/sh, which
    on Ubuntu aborts the moment it is called. In practice the entire per-transport
    verification — and the step after it — never executed on a single real box. It
    is now plain POSIX shell, and a probe that cannot connect reports that instead
    of killing the script, which matters because an unreachable gateway is exactly
    what it exists to detect.
  • No more false "your firewall is broken" warning. The same check asked the
    frontend for the release using the loopback address, which the web firewall
    rejects on every path even on a perfectly healthy box — so it would have told
    every operator at once that their firewall was dropping connections. It now asks
    using the instance's real hostname, and treats a refusal from its own probe as
    inconclusive rather than as a fault.
  • Reachability checks no longer time out on healthy nodes. The Tor and I2P
    checks downloaded the full ~33 MB release tarball, which routinely outruns any
    sane timeout over a hidden transport and reported working nodes as broken. They
    now fetch a small file over the identical path.
  • "Working seeder" is verified, not assumed. The previous self-check asked
    the local gateway whether it served the release and then announced the box was a
    working seeder over every transport. That passed happily while no peer could fetch
    anything. It now checks the path a peer actually uses — through the frontend, then
    end-to-end over each configured .onion and .b32.i2p — and reports each
    transport separately, with the exact fix when one fails.
  • No more false "unsigned tarball will be refused" warning. A release fetched
    over Tor/I2P carries no detached signature by design: it is verified against the
    SHA-256 anchored on-chain, read from the node's own indexer. The warning now
    describes what actually happens — the on-chain hash is used, and the upgrade is
    refused only if neither a signature nor a matching hash can be established.

  Changed

  • The health report no longer overstates IPFS seeding. Its "ok" verdict is based
    on local timer runs (the release is pinned, the IPNS record was rebroadcast), which
    does not prove a peer can fetch it. The wording now says exactly that, and points at
    the upgrade's seed step for the real per-transport reachability check.
  • Snapshot publishing is a single-signer job, and is off by default. Exactly one
    instance in the federation exports and anchors the snapshot; everyone else mirrors
    it. An ordinary instance will never begin anchoring snapshots under its own account
    just because it was installed with defaults.

  Security

  • The new firewall rule is scoped to the pinned web-firewall network and opens only
    the read-only release gateway, which serves pinned releases and nothing else. It is
    gated on the box actually hosting IPFS, so a node without IPFS opens no new port,
    and a Tor/I2P-only box gains no clearnet exposure.
  • A mirroring instance verifies the snapshot against the on-chain SHA-256 before it
    will serve it, and removes the pin if the hash does not match — so a box can never
    become a mirror for content the signer did not publish.
  • The self-heal only ever adds a rule permitting the pinned container network to reach
    the local read-only gateway, and verifies by observing the connection rather than
    trusting a command's exit code.

  Notes

  • No protocol/consensus change. All changes are operator-facing seeding, upgrade,
    fast-sync and reporting accuracy.
  • Mirroring rides on IPFS release hosting: a box without Kubo skips it silently.
    OPERATIONS.md §52 covers the whole pipeline, including how to opt out.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    3 downloads · 2026-09-12 02:36:07 +00:00 · 1 KiB
  • morphit-v1.17.2.tar.gz
    3 downloads · 2026-09-12 02:36:07 +00:00 · 32 MiB
  • morphit-v1.17.2.tar.gz.sha256
    3 downloads · 2026-09-12 02:36:07 +00:00 · 89 B