109 releases 109 tags

RSS feed

• v1.10.1 51b1d1ba77

  Compare

  Morphit v1.10.1 Stable

  agorise released this 2026-08-07 04:23:29 +00:00 | 0 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.10.1

  Theme: a node you can look after with less effort. This release is a cluster of practical improvements for the people who run Morphit instances — clearer status while a fresh node catches up, at-a-glance proof that your node is helping host the release, one command that hands your whole health picture to a monitor, and upgrades that keep working when the internet doesn't. Underneath, a brand-new node now writes its catch-up to the database in safer, bounded batches.

  This is a maintenance release. There are no database migrations and no breaking changes; an ordinary online instance behaves exactly as before.

  Added

  See whether your node is seeding the release. Every instance runs a small IPFS node that pins the signed release and rebroadcasts the ipns:// record so releases stay hosted and resolvable as long as any instance is alive. The node-health view now shows an IPFS/IPNS release seeding line — ok, degraded, down, or not-configured — so you can tell at a glance that your box is doing its share, without digging through logs.

  One command for monitoring. morphit-ops health --json now prints the whole node-health view as one machine-readable object — indexer, relay, system (CPU/memory/disk), background services, backups, the warrant canary, and the new IPFS/IPNS seeding state. Point Zabbix (or any monitor) at it — run it on a timer into a file, or through an agent — and alert on any section leaving its healthy state. Host-level operational detail like this stays out of the public health endpoint on purpose, so a passing stranger can't learn that your backups are failing or your disk is full.

  Upgrade with no internet, from a USB stick or a folder. Copy the signed -offline tarball (and its signature) onto the box and run morphit-ops upgrade --from-file=…, or simply drop it into the offline release folder — the main menu then shows ● update available (offline tarball ready) on its own, and a normal upgrade uses it automatically whenever the network can't be reached. An upgrade that begins online even finishes from that dropped tarball if the connection drops partway through. Unsigned tarballs are refused.

  Set up your warrant canary during install. The guided home install now offers to set up your warrant canary right then, instead of leaving it as a separate follow-up step.

  Clearer instance status. The public instances list now tells apart a node that is still catching up (Syncing) from one that has genuinely fallen behind (stale), and the status dropdown uses plain-language labels for each state.

  Changed

  Safer initial sync. When a fresh node replays the Blurt chain to build its local view, it now commits each window of blocks in one bounded database transaction rather than one transaction per block. If the machine crashes mid-catch-up, the partial window rolls back cleanly and the node resumes from exactly where it left off — with no half-written state and no risk of a long transaction stalling the database. The same data ends up stored; there is nothing to configure.

  Releases mirrored automatically. Each release is now also published to the codeberg.org and gitea.com mirrors (when their tokens are configured), so upgrades keep finding a release even if the main forge is unreachable.

  Fixed

  IPNS rebroadcast on ansible-managed nodes. An instance installed through the ansible role now also rebroadcasts its IPNS record on a timer. Previously only the hand-run IPFS setup did this, so an ansible-managed node could quietly stop keeping the ipns:// name alive. The rebroadcast needs no key — it simply re-announces the release's own on-chain-signed record — and now runs everywhere.

  Notes

  • No database migrations. No breaking changes.
  • The complete node-health picture (including backups, disk, and IPFS seeding) is available through morphit-ops health --json, locally or over SSH; it is deliberately not exposed on the public /v1/health endpoint.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    2 downloads · 2026-08-07 04:59:36 +00:00 · 1 KiB
  • morphit-v1.10.1-offline.tar.gz
    3 downloads · 2026-08-07 04:59:52 +00:00 · 704 MiB
  • morphit-v1.10.1-offline.tar.gz.sha256
    3 downloads · 2026-08-07 04:59:52 +00:00 · 97 B
  • morphit-v1.10.1.tar.gz
    1 download · 2026-08-07 04:59:36 +00:00 · 12 MiB
  • morphit-v1.10.1.tar.gz.sha256
    1 download · 2026-08-07 04:59:36 +00:00 · 89 B
• v1.10.0 0ecced72b7

  Compare

  Morphit v1.10.0 Stable

  agorise released this 2026-08-06 22:15:48 +00:00 | 1 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.10.0

  Theme: Morphit now installs completely offline. From a single self-contained download, with the network cable unplugged, the guided install runs start to finish — and the few steps that genuinely need the internet (your real HTTPS certificate, connecting to Blurt, and, if you opt in, listing your instance on-chain) complete themselves automatically the first time the box sees a connection.

  This finishes the offline appliance. An instance can be brought up in a place with no internet at all, on the local network, and it upgrades itself the moment a real link appears — retrying quietly until it succeeds, then stepping out of the way.

  Added

  Completely offline install. There are now two downloads on each release:

  • the usual slim source tarball, which fetches its dependencies while installing (needs internet), and
  • a self-contained -offline tarball, which bundles everything — the application libraries, the operating-system packages, the Docker images, the Node runtime, and Kubo. Installing from it touches the network for nothing: apt, Docker, and every other step install from the bundle. It is a large download by design.

  To install with no internet: download the -offline tarball on any machine, copy it to the target, extract it, and run the guided install. When the box is later connected, normal package updates are automatically restored (the offline install temporarily points apt at the bundled packages using a reversible setting that leaves your system's own package sources untouched; the finish-when-online helper removes it once you're online).

  Finish-when-online. After the install, a background helper (morphit-first-online) watches for a real internet connection — it actually checks that it can reach several Blurt nodes, not just that a cable is plugged in. The first time it succeeds it obtains your real Let's Encrypt certificate (until then the site is served over HTTPS on your local network with a self-signed certificate, so it still works), connects the indexer and relay to Blurt, and — if you opted in — publishes your on-chain instance listing. Each step is done once and remembered; anything that can't finish yet is retried on the next cycle; when everything is done the helper retires itself.

  Opt-in automatic on-chain listing. The guided install asks whether to list your instance on-chain automatically once online, or leave it for you to run morphit-ops register yourself later. The unattended path reuses the same relay key and passphrase your relay already runs with — no key is entered by hand.

  Fast initial sync. A brand-new instance replays the Blurt chain from the beginning to build its local view. That catch-up used to fetch one block-window at a time; it now fetches several windows at once, each aimed at a different one of your configured Blurt nodes — so no single node is leaned on, and a slow or failing node is stepped around automatically — while still writing every block in strict order, one per transaction. A fresh instance reaches the chain head dramatically faster, and exactly the same data ends up stored. Nothing to configure; a tuning knob (MORPHIT_INDEXER_BACKFILL_CONCURRENCY) exists for the curious but defaults to one window per node.

  Changed

  The HTTPS step never blocks the install. If Let's Encrypt can't be reached when you install (offline, or your domain isn't resolving yet), the certificate step is deferred to the finish-when-online helper instead of stopping the install. The site comes up immediately and upgrades to the real certificate automatically once it can.

  Fixed

  Guided-install robustness — from the first real federated deployment. Standing up the first independent Morphit instance surfaced a batch of first-install issues, all now fixed so a fresh install comes up cleanly end to end:

  • The real HTTPS certificate is made readable by the proxy on both first issue and on renewal, so the site keeps serving over the renewed certificate without hand-holding.
  • The reverse-proxy and firewall containers now start in the right order, with the file permissions and controlled Docker access they need, instead of racing each other on a cold boot.
  • The single shared database is set up once and used by both the indexer and the relay (an earlier layout created a second, empty database the relay then couldn't use).
  • A multi-word instance name — and your optional Tor and I2P addresses — are now captured and stored intact, so your instance's name and onion/I2P links show up correctly.

  Notes

  • No database migrations. No breaking changes. An ordinary online install behaves exactly as before — every offline mechanism is dormant unless a bundle is actually present.
  • Building the -offline tarball (for release maintainers): run bash scripts/build-offline-bundle.sh on an Ubuntu 24.04 machine with Docker; it assembles the bundle and writes morphit-v1.10.0-offline.tar.gz. The release CI attempts this automatically on a best-effort basis, so a build machine without Docker never blocks a release.
  • If a past install stopped waiting on a certificate or a Blurt connection, nothing needs undoing — re-run the guided install with this version; it finishes offline and the helper takes care of the rest when you're online.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    2 downloads · 2026-08-06 22:50:53 +00:00 · 1 KiB
  • morphit-v1.10.0-offline.tar.gz
    1 download · 2026-08-06 22:51:08 +00:00 · 706 MiB
  • morphit-v1.10.0-offline.tar.gz.sha256
    1 download · 2026-08-06 22:51:09 +00:00 · 97 B
  • morphit-v1.10.0.tar.gz
    1 download · 2026-08-06 22:50:53 +00:00 · 12 MiB
  • morphit-v1.10.0.tar.gz.sha256
    1 download · 2026-08-06 22:50:53 +00:00 · 89 B
• v1.9.22 ae2299309c

  Compare

  Morphit v1.9.22 Stable

  agorise released this 2026-08-04 05:25:13 +00:00 | 19 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.9.22

  Theme: the guided install now creates every drop-in configuration directory it writes into, so hardening can't stop on a "directory does not exist" error.

  This is the companion hotfix to v1.9.21. That release fixed the SSH-hardening step for machines without an SSH server; this one fixes the same class of problem one step later. On some machines the password-policy step stopped with "/etc/security/pwquality.conf.d does not exist" — the password-quality package installs its main config file but doesn't create the drop-in directory, so writing into it failed.

  Fixed

  Every hardening drop-in now ensures its directory first. Instead of trusting each system package to have created its own .d drop-in directory (some do, some don't), the installer now creates the directory before writing into it — for the password policy, the audit rules, the AIDE integrity rules, and the SSH hardening. The result is the same hardened configuration; it simply no longer depends on a package having pre-made a directory.

  We also added an internal build check that fails if any future drop-in write forgets to ensure its directory, so this whole class of "directory does not exist" install stoppage can't come back.

  Notes

  • No database migrations. No breaking changes.
  • If your last install stopped at the password-policy step, nothing needs undoing — re-run the guided install with this version and it will pick up cleanly and finish.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    2 downloads · 2026-08-04 05:56:28 +00:00 · 1 KiB
  • morphit-v1.9.22.tar.gz
    2 downloads · 2026-08-04 05:56:28 +00:00 · 12 MiB
  • morphit-v1.9.22.tar.gz.sha256
    2 downloads · 2026-08-04 05:56:28 +00:00 · 89 B
• v1.9.21 82937660e5

  Compare

  Morphit v1.9.21 Stable

  agorise released this 2026-08-04 03:27:15 +00:00 | 20 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.9.21

  Theme: home-desktop installs no longer stop at the SSH-hardening step when the machine has no SSH server.

  This is a small hotfix for the guided install. If you install Morphit on a home computer that doesn't run an SSH server (common for a desktop you sit at and administer locally), the previous version stopped during setup with an error like "Destination directory /etc/ssh/sshd_config.d does not exist." Rented servers (VPS) always have an SSH server, so they were unaffected — but a home node could get stuck here.

  Fixed

  SSH hardening now applies only when an SSH server is actually installed. The installer checks for an SSH server first:

  • If one is present (always the case on a VPS, and on any machine where you added SSH for remote access), it is hardened exactly as before — root login and password login are turned off.
  • If there is none (a typical home desktop you run locally), the installer prints a short note explaining there is nothing to harden and moves on, instead of stopping.

  We deliberately do not install an SSH server for you. Whether to run one — and expose it — is your decision, not something the marketplace installer should make on your behalf. If you add an SSH server later for remote access, just re-run the installer and it will harden it.

  Two small belt-and-braces fixes ride along so the same class of problem can't surface elsewhere: the scheduled security scans (AIDE, rkhunter) are guaranteed their scheduling directories, and the certificate-renewal hook is guaranteed its directory before it's written.

  Notes

  • No database migrations. No breaking changes.
  • If your last install stopped at the SSH step, you don't need to undo anything — just re-run the guided install with this version and it will pick up cleanly and finish.

  Downloads

  • Source code (ZIP)
    1 download
  • Source code (TAR.GZ)
    1 download

  ---

  • distribution-anchor.env
    2 downloads · 2026-08-04 03:59:45 +00:00 · 1 KiB
  • morphit-v1.9.21.tar.gz
    3 downloads · 2026-08-04 03:59:44 +00:00 · 12 MiB
  • morphit-v1.9.21.tar.gz.sha256
    2 downloads · 2026-08-04 03:59:45 +00:00 · 89 B
• v1.9.20 9f2a2b7396

  Compare

  Morphit v1.9.20 Stable

  agorise released this 2026-08-03 22:50:48 +00:00 | 21 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.9.20

  Theme: the end-of-install summary now checks and shows the health of every part of your node — not just "installed and running."

  When the guided install finishes, it prints a summary of what came up. In v1.9.20 that summary is far more thorough: instead of a short list, it verifies and displays the status of every subsystem, so you can tell at a glance that your whole node is actually healthy before you announce it.

  New

  The install summary now covers everything, with a live status for each. After the install, you'll see a checked line for each of:

  • Database, signup relay, and marketplace indexer — including a live "is it actually responding?" check against each service's health endpoint, and whether the indexer is caught up or still catching up (which is normal on a fresh node).
  • Blurt RPC connectivity and the BTC/XMR price feeds (FX).
  • Your verified relay balance, read live from the chain, shown as an amount and an estimate of how many signups it funds.
  • The MCP read-only API server.
  • The web firewall (BunkerWeb) and your website.
  • HTTPS certificate.
  • Firewall (UFW) and intrusion protection (fail2ban), now shown as two separate lines.
  • Your Tor onion address — the actual .onion is shown so you can copy it — and your I2P address.
  • The IPFS node and the hourly release-pinning that keeps the release available over IPFS/IPNS.
  • Your warrant canary (with a freshness check) and PGP contact key.
  • SEO surfaces (robots.txt and sitemap).
  • Your instance settings, nightly backups, and (on a home install) automatic address updates.
  • System resources (free disk and memory).
  • A final roll-up confirming every background service and timer is active.

  Anything still warming up shows a "?", not a failure. A fresh node often needs a minute for the indexer to respond, the price feeds to connect, or RPC to dial in. Those now show a neutral "still starting" marker and no longer hold up the offer to announce your instance — only a genuine failure (a service down, a missing certificate, an inactive firewall, an unfunded relay) does.

  Your "Contact this operator" link can now point to a Matrix room, not just an account. The optional Matrix contact in the setup wizard now accepts either your account (@you:matrix.org) or a room (#support:matrix.org), so you can send traders to a shared support channel instead of a personal account if you prefer. It remains entirely optional — press Enter to skip.

  Notes

  • No database migrations. No breaking changes.
  • If any line shows a ✗ or ? right after install, it usually just means that piece is still starting — re-check any time with sudo morphit-ops status.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    1 download

  ---

  • distribution-anchor.env
    2 downloads · 2026-08-03 23:22:38 +00:00 · 1 KiB
  • morphit-v1.9.20.tar.gz
    3 downloads · 2026-08-03 23:22:38 +00:00 · 12 MiB
  • morphit-v1.9.20.tar.gz.sha256
    2 downloads · 2026-08-03 23:22:38 +00:00 · 89 B
• v1.9.18 e316a4abe8

  Compare

  Morphit v1.9.18 Stable

  agorise released this 2026-08-03 07:34:49 +00:00 | 23 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.9.18

  Theme: another hotfix on the guided local-install path — the installer now gets through system-account setup and on into deploying the stack.

  A small follow-up to v1.9.17. Anyone installing locally (home computer, Raspberry Pi, or an old laptop running Linux) should use v1.9.18.

  Fixed

  The installer no longer stops while creating its system accounts. On v1.9.17, a "Full guided install" got past the safety checks and began setting up, then stopped with Group morphit-mcp does not exist while creating one of Morphit's background-service accounts. One of those accounts was being created before its group existed. It now creates the group first, matching how the other service accounts are handled, so setup continues on into installing the database, relay, indexer, and web server.

  Changed

  Clearer wording about the download. The "run a node" guide now notes that what you download is Morphit's source (a few tens of MB), and that the installer's first step downloads the software libraries (a few hundred MB) — so the npm install wait at the start is expected, not a hang.

  Notes

  • No database migrations. No breaking changes.
  • If a v1.9.17 local install stopped at the morphit-mcp group error, nothing needs undoing — the run stopped before deploying anything. Re-run the installer from a fresh v1.9.18 download.

  Downloads

  • Source code (ZIP)
    1 download
  • Source code (TAR.GZ)
    1 download

  ---

  • distribution-anchor.env
    3 downloads · 2026-08-03 08:06:33 +00:00 · 1 KiB
  • morphit-v1.9.18.tar.gz
    4 downloads · 2026-08-03 08:06:33 +00:00 · 12 MiB
  • morphit-v1.9.18.tar.gz.sha256
    2 downloads · 2026-08-03 08:06:33 +00:00 · 89 B
• v1.9.17 12556319c5

  Compare

  Morphit v1.9.17 Stable

  agorise released this 2026-08-03 03:01:13 +00:00 | 24 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.9.17

  Theme: a hotfix for v1.9.16 — the guided installer now completes on a home computer or a local Raspberry Pi / old laptop.

  This is a small, targeted follow-up to v1.9.16. If you already run a node, or install onto a remote server over SSH, nothing here affects you. Everyone installing locally should use v1.9.17.

  Fixed

  The guided installer no longer crashes partway through a local install. On v1.9.16, a "Full guided install" on your own machine got as far as the safety checks and then stopped with an 'ansible_user' is undefined error — before anything was actually set up. The pre-flight that checks you're not about to lock yourself out over SSH was evaluating a value that simply doesn't exist on a local install. It now recognises a local install correctly (and still refuses a risky root-over-SSH remote install), so the installer runs all the way through to the summary and the "put your instance on the shared map" step.

  A harmless-but-alarming warning is gone. The installer no longer prints Ansible's "discovered Python interpreter… future installation could change the meaning of that path" notice during setup. Nothing was wrong; it just looked scarier than it was.

  Notes

  • No database migrations. No breaking changes.
  • If your v1.9.16 local install stopped at the safety-check error, you don't need to undo anything — nothing was deployed. Just re-run the installer from a fresh v1.9.17 download (see the recovery steps if you were following along with support).

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    2 downloads · 2026-08-03 03:33:36 +00:00 · 1 KiB
  • morphit-v1.9.17.tar.gz
    3 downloads · 2026-08-03 03:33:36 +00:00 · 12 MiB
  • morphit-v1.9.17.tar.gz.sha256
    2 downloads · 2026-08-03 03:33:36 +00:00 · 89 B
• v1.9.16 cf80a67533

  Compare

  Morphit v1.9.16 Stable

  agorise released this 2026-08-02 22:10:22 +00:00 | 26 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.9.16

  Theme: a smoother path to running your own node — the guided installer now works the same however you install it, confirms more of what it set up, and can point visitors to your Matrix — plus a few interface fixes.

  Most of this release is for people running (or about to run) their own Morphit
  instance. If you only trade, the visible changes are that usernames read
  correctly in more places and the instances directory is a little tidier.

  Fixed

  Usernames read correctly in right-to-left languages, everywhere. A follow-up
  to v1.9.15: with Persian (Farsi) selected, a handle like @alice still rendered
  as alice@ in a few remaining spots — the operator handle on an instance card,
  the account menu, the block explorer, and the compare view. All of those now
  render left-to-right, @ first, like the rest of the app.

  The guided installer no longer claims success when nothing installed. A local
  install could print "installed and running" while the playbook had actually
  matched zero hosts and done nothing. The installer now confirms it has a host to
  act on before it starts, and reports honestly.

  Several guided-setup fixes for operators, including: the dynamic-DNS step no
  longer insists on an {ip} placeholder your provider fills in for you; the fees
  account defaults sensibly; and morphit-ops now installs as a real command, so
  sudo morphit-ops register works from anywhere.

  Added

  The installer now asks for your instance title, a one-line description, and an
  optional Matrix account. The title and description appear on the shared
  /instances directory that traders on other nodes browse. If you add a Matrix
  account (like @you:matrix.org), the "Contact this operator" link on your
  instance's card becomes live so traders can reach you — leave it blank if you
  don't have one yet.

  The end-of-install summary confirms more of what it set up. Your Tor onion
  address, your I2P address, your warrant canary, and your PGP contact key each now
  get a green check when they're in place, alongside the database, relay, indexer,
  and HTTPS certificate.

  morphit-ops harden can set up your warrant canary and PGP contact key — a
  guided step that signs the canary off your public server (so it can't keep
  stamping "all clear" if the box is ever seized) and posts your own PGP key.

  Changed

  Registering your instance works the same however you install it — over SSH on
  a VPS, locally on a Raspberry Pi or an old laptop, or by hand after the fact.
  Running sudo morphit-ops register now finds everything it needs in all three
  cases.

  The "you are here" marker on the instances directory is centered between your
  instance's name and its status, on the same line.

  Notes

  • No database migrations. No breaking changes.
  • The right-to-left handle fix is structural — applied to interface strings as
    they load — so it stays correct as translations change; the fixes in this
    release cover the few handles that are drawn directly rather than from a
    translation string.

  Downloads

  • Source code (ZIP)
    1 download
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    2 downloads · 2026-08-02 22:41:02 +00:00 · 1 KiB
  • morphit-v1.9.16.tar.gz
    5 downloads · 2026-08-02 22:41:02 +00:00 · 12 MiB
  • morphit-v1.9.16.tar.gz.sha256
    3 downloads · 2026-08-02 22:41:02 +00:00 · 89 B
• v1.9.15 986da164b9

  Compare

  Morphit v1.9.15 Stable

  agorise released this 2026-08-02 03:45:54 +00:00 | 27 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.9.15

  Theme: interface polish — correct right-to-left usernames, a tidier footer, and a calmer orderbook.

  This release is a batch of front-end fixes and cleanups, most visible if you use
  Morphit in Persian or spend time on the orderbook.

  Fixed

  Usernames read correctly in right-to-left languages. With Persian (Farsi)
  selected, a handle like @alice was rendering as alice@ — and since the address
  only works as /@alice, never /alice@, the misplaced @ read as a different,
  invalid handle. Handles now always render left-to-right, @ first, in every
  language.

  Changed

  The orderbook hides the "Featured" card when nothing is featured. Instead of
  showing an empty "no featured-slot bids yet — be the first" card, the card simply
  isn't there until a featured order or bid exists.

  A tidier footer. Dropped two lines of chrome (the "Peer-to-peer. Private.
  Yours." tagline and the "Also reachable via" label) and reorganized the footer
  links into five clear, labeled columns — Federation, Resources, Security, Media,
  and Support — that stack cleanly on a phone and lay out correctly in right-to-left
  languages.

  The run-a-node page's "See the repo" button now opens the download page, where
  the guided setup and every download live.

  Notes

  • No database migrations. No breaking changes.
  • The right-to-left handle fix is structural: it's applied to every interface
    string as it loads, so it can't drift back out of sync as translations change.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    1 download

  ---

  • distribution-anchor.env
    2 downloads · 2026-08-02 04:16:44 +00:00 · 1 KiB
  • morphit-v1.9.15.tar.gz
    3 downloads · 2026-08-02 04:16:44 +00:00 · 12 MiB
  • morphit-v1.9.15.tar.gz.sha256
    2 downloads · 2026-08-02 04:16:44 +00:00 · 89 B
• v1.9.14 e64dc8bb21

  Compare

  Morphit v1.9.14 Stable

  agorise released this 2026-08-01 23:30:40 +00:00 | 28 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.9.14

  Theme: the warrant canary is now hands-off across upgrades — the served folder can't stay broken.

  Two things now protect the canary upload from an upgrade re-rooting the served
  folder. The ownership-preserving fix from v1.9.13 takes effect for every upgrade
  run by v1.9.13-or-newer code, so upgrades stop re-rooting the folder. On top of
  that, the weekly canary refresh now self-heals: if it ever finds the served folder
  re-rooted, it takes it back before uploading. Between the two, a canary upload can
  no longer be left broken by an upgrade.

  Added

  The canary refresh self-heals a re-rooted folder. The weekly refresh
  (~/.morphit/update-canary.sh, written by scripts/canary/setup.sh) now makes the
  served build/ folder writable again — best-effort, before every upload — so even
  if something leaves it root-owned, the next refresh fixes it and uploads cleanly
  instead of failing with "permission denied." This runs from the machine you sign on,
  not the server's installed code, so it protects the canary on any version. Re-run
  scripts/canary/setup.sh once to pick it up.

  Notes

  • No database migrations. No breaking changes.
  • The self-heal fixes the folder with sudo on the server, and an unattended weekly
    timer can't type a password — so the self-heal runs on its own only if the upload
    account has passwordless sudo. Without it, the v1.9.13 ownership-preserving fix
    is what keeps upgrades from re-rooting the folder in the first place.
  • New operators: scripts/canary/setup.sh already makes the served folder writable
    for you at setup time, so your first canary upload works; from then on it stays
    that way across upgrades.
  • The canary's signing model is unchanged: signed with your own PGP key, off the
    served box when you want it that way, so it goes stale exactly when it should.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    2 downloads · 2026-08-01 23:59:46 +00:00 · 1 KiB
  • morphit-v1.9.14.tar.gz
    2 downloads · 2026-08-01 23:59:46 +00:00 · 12 MiB
  • morphit-v1.9.14.tar.gz.sha256
    2 downloads · 2026-08-01 23:59:46 +00:00 · 89 B