0.25.5.0

Adds Tor onion-service support (PEP-05): an hbs2 peer can run as a v3
hidden service, dial other peers' .onion addresses over SOCKS5, and
keep onion and clearnet address classes isolated so a clearnet peer
never learns onion addresses. Plus follow-up robustness and
observability fixes.

Features

• Tor onion-service support (PEP-05). A peer can operate
  onion-only or as a bridge:
  • Outbound dialing of .onion peers through a SOCKS5 proxy
    (tcp.socks5 "127.0.0.1:9050" plus
    known-peer "tcp://<id>.onion:<port>"); the hidden-service
    name is handed to the proxy unresolved, so no name leaks to a
    local resolver. DNS host names under tcp:// now work too.
  • TCP-only operation with local-discovery and bootstrap gated off
    (multicast off, bootstrap off, listen "off").
  • Network-class PEX policy. A peer declares how it is
    reachable in the handshake
    (network-class "clearnet" | "onion" | "bridge", default
    clearnet); PEX forwards an address only to peers reachable on
    that class, so a clearnet peer never learns onion addresses
    while onion peers still discover each other. The PeerData
    handshake payload gains a backward-compatible reachableVia
    field, so old peers (defaulting to clearnet) do not partition.
  • peer-public-address. A peer advertises its own public
    address(es) to neighbours reachable on that class, so a peer
    reached over Tor (which otherwise sees only the Tor exit) learns
    its real .onion and can redial and gossip it.
  • NixOS services.hbs2-peer.enableTor. Wires services.tor,
    a v3 hidden service, the SOCKS proxy, and the onion-only config
    in one option.

Fixes

• Onion peers stay known by their .onion, not 127.0.0.1. An
  inbound onion connection arrives from the local Tor exit as a
  loopback address. Two issues left a peer stuck under that useless
  address: the peer-dedup preferred a lower-RTT loopback over the
  routable .onion, and the TCP cookie dedup dropped the symmetric
  outbound .onion dial. The dedup now ranks by routability, and an
  inbound connection is re-keyed onto the .onion the peer
  advertises, so every peer in a meshed onion deployment knows its
  neighbours by .onion.
• Worker-thread supervision. A failing worker thread is now
  restarted in place instead of throwing GoAgainException and
  respawning the whole peer, which previously turned a single bad
  bootstrap or PEX address into a crash loop.
• hbs2-peer -r/--rpc now selects the RPC socket. The flag was
  parsed but ignored, so every CLI call fell back to the default
  /tmp/hbs2-rpc.socket; it now overrides the socket path, letting
  you target a specific peer (e.g. several peers on one host).
• .onion addresses redacted in default logs. Default-level log
  lines render a peer's .onion as a short one-way fingerprint
  (<onion:NNNN>), so an operator's journald output does not leak
  where their peers are. Verbose -d/-t logs still print full
  addresses and should be treated as sensitive.

Docs

• New docs/TOR_DEPLOYMENT.md end-to-end recipe (NixOS, manual, and
  outbound-only); docs/multi-machine.md gains a Tor-outbound
  pointer; the PEP-05 draft is updated to reflect the implemented
  design; PROTOCOL.md documents the hand-rolled PeerData
  versioning.

0.25.4.0

Feature and maintenance release. Adds an opt-in announce flag to the
CLI, de-vendors four bundled libraries onto Hackage, restores
annotated tag push, and ships new documentation.

Features

• block:put --announce. hbs2-cli hbs2:peer:storage:block:put
  now accepts an optional --announce flag that broadcasts a
  BlockAnnounce right after storing, so a "put on A, get on B" flow
  works without a separate hbs2-peer announce. Off by default so
  encrypted-refchan and group-key workflows that gate publication are
  not surprised; higher-level flows (git push, sync) announce
  internally and do not need it. Closes
  #5.

Fixes

• Annotated tag push to hbs23://. git push hbs2 <annotated-tag>
  previously failed with a generic "failed to push some refs" because
  r:push handed the tag-object SHA straight to the commit-chain
  walker; the walker then tried to parse the tag body as a commit
  and threw InvalidObjectFormat. The remote helper now inspects
  the type of the pushed SHA via git cat-file -t. For a tag
  object it peels to the commit with <sha>^{commit} for the
  chain walk and passes the tag SHA as an extra object so the
  final segment includes the tag body itself. The export pipeline
  grows a third [GitHash] "extras" parameter that is serialised
  into the same source queue after the commit workers finish.
  GitObjectType gains a Tag constructor, the segment encoding
  learns an 'A' short marker, and gitPackTypeOf maps Tag to
  OBJ_TAG so git index-pack accepts the resulting pack on the
  fetch side. Lightweight tag push is unchanged. Closes
  #7.
• r:list emits HEAD as a symbolic ref instead of a duplicate
  object line, so clients resolve the default branch correctly.
• NixOS module: create and whitelist the hbs2-mailbox sibling
  directory, and grant the RPC group access to the peer socket.

Dependencies

• hbs2 no longer vendors saltine, bytestring-mmap, db-pipe, or
  suckless-conf. They are now consumed from Hackage
  (saltine-0.2.2.0, bytestring-mmap-compat-0.2.3,
  db-pipe-0.1.0.1, suckless-conf-0.1.2.9; the latter three are
  published and maintained under https://github.com/NCrashed).
  This is a step toward a plain cabal install story; there are no
  runtime behaviour changes.

Docs

• New walkthroughs: docs/multi-machine.md (replicating a
  repository to a second machine) and docs/encrypted-repos.md
  (group-key encrypted repositories, including key backup).
• Design proposals published under docs/drafts/: PEP-05 (Tor
  transport), PEP-13 (post-quantum encryption), PEP-14 (encrypted
  keystore), PEP-15 (HD keys from a mnemonic), PEP-16 (barter
  storage).

Compatibility

• Segment marker 'A' (annotated tags) is new since 0.25.3.2.
  Peers from 0.25.3.0..0.25.3.2 decoding a segment that contains an
  annotated tag will fall through the FromStringMaybe (Short ...)
  default branch and silently relabel the tag object as Blob.
  Concretely: on replication from a 0.25.4.0 peer to an older peer,
  annotated tags become unreachable on the older peer. The on-wire
  fix is to upgrade the receiving peer to 0.25.4.0. There is no
  mixed-cluster fallback.

0.25.3.2

Patch release. Adds a Docker image as a third distribution path
alongside the static tarball.

Release

• Docker image published on tag push. The release workflow
  grows a second job (docker-linux-x86_64) that runs in parallel
  with the static tarball build. It produces a single OCI image
  bundling the full hbs2 binary surface (hbs2-peer, hbs2-cli,
  hbs2-keyman, hbs2-git3, git-remote-hbs23, git-hbs2, hbs2-sync,
  ncq3) on top of the musl-static binaries, and pushes it to
  ghcr.io/${owner}/hbs2-peer:${TAG} and :latest. Total size is
  ~40 MB compressed. This follows the postgres/redis convention of
  shipping the admin CLI alongside the daemon so that all common
  operator tasks work via docker exec. Image config: HOME=/data
  routes config (~/.config/hbs2-peer), keys
  (~/.hbs2-keyman/keys/), and storage (~/.local/share/hbs2)
  into a single /data volume; no Entrypoint, so docker run image hbs2-cli ... works as smoothly as the default hbs2-peer run.

Build internals

• New flake output packages.x86_64-linux.docker built via
  dockerTools.buildImage. A stripPackageToBin helper re-derives
  each shipped binary through a one-shot cp -L so the image's
  runtime closure carries only the actual binary content rather
  than the Haskell lib/ outputs, which would otherwise drag in
  the GHC + GCC toolchain for every package (~3 GiB per package,
  432 MB compressed for the image without the trim).
• bf6-git-hbs2 is excluded from the image because it is a
  shebang script hardcoding a /nix/store/...-suckless-conf
  path, which would re-introduce the GHC toolchain into the
  closure. git hbs2 ... dispatching is provided instead by a
  symlink /bin/git-hbs2 -> hbs2-git3, mirroring the cabal-install
  fallback documented in INSTALL.md.

Documentation

• INSTALL.md: Docker becomes Option 2; gains a section with
  common docker exec operator commands (peer poke, poll add,
  metadata lookup, initial setup, etc.). Cabal, Nix flake, and
  Home Manager paths bumped by one.
• CONTRIBUTING.md: release section describes the two parallel
  jobs and a local-build fallback for both the tarball and the
  image.

0.25.3.1

release: 0.25.3.1

Patch release bumping every shipped package from 0.25.3.0 and adding
a CHANGELOG entry covering:

- recover-pattern fix that lets hbs2-cli read piped stdin (#4)
- unix 2.7 compat shim that makes .#static build end-to-end (#6)
- FAQ, COOKBOOK, and hbs2-storage-ncq README ported from
voidlizard's site
- release.yml workflow publishing a musl-static tarball on tag push

First release under new maintenance

First release under new maintenance, continuing the dev-0.25.3 line @voidlizard left in flight. See CHANGELOG.md for the full set of changes.

Highlights:

• New maintainer @NCrashed after @voidlizard's passing in 2025
• Primary CLI is now hbs2-cli, primary storage is hbs2-storage-ncq (NCQ3)
• Git remote helper is hbs2-git3 (URL scheme hbs23://)
• Reproducible build pinned to GHC 9.6.6 + cabal index-state 2026-05-31, full cabal.project.freeze
• NixOS module shipped (nixosModules.default flake output)
• Public bootstrap node at bootstrap.hbs2.app, repo self-mirrored at hbs23://9gtFy65ap1Hk9Mc71pMjc32zFsKcNZLVPWbBAbnkE4dP
• Wire protocol frozen at this surface; future features get new ProtocolIds

Known issues filed as #4, #5, #6.