HPT

HPT is the package manager for HBOS and HIVE. It brings an apt-style workflow to HAX applications: update repository metadata, search packages, resolve dependencies, verify SHA-256 digests, install, remove, upgrade, and run applications from disk.

HPT is an independent project and is included by HIVE as a Git submodule. It is part of every regular HIVE build—there is no supported “HIVE without a package manager” variant. Only a future, fully kernel-only HBOS profile may omit the complete HIVE/HPT user-space stack.

Features

• Local-directory, IPv4 HTTP, and verified TLS 1.2 HTTPS repositories
• DNS names, IPv4, and IPv6 literals for HTTPS sources
• Mandatory X.509 CA-chain, validity-period, and hostname/SAN verification
• Strict HTTP framing with Content-Length checks and chunked decoding
• Deterministic Packages indexes and HAX metadata validation
• Validated, cycle-free dependencies and reverse-dependency protection
• Package size and SHA-256 integrity checks before installation
• Staged upgrades with payload/database verification and rollback
• On-demand verification of every installed package
• Installed-package database under /var/lib/hpt
• Standalone host tests and HAX build

Build and test

Clone the standalone project with:

git clone https://github.com/HeBitOS/HPT.git
cd HPT

The host-side parser and cryptographic tests have no HBOS dependency:

make test

To build hpt.hax, keep HIVE and HBOS checkouts next to this repository or provide their locations:

make app HIVE_DIR=/path/to/HIVE HBOS_DIR=/path/to/HBOS

Build an example repository containing HPT itself:

make repo HIVE_DIR=/path/to/HIVE HBOS_DIR=/path/to/HBOS

HIVE owns the official application manifest and uses this repository's tools/hpt_repo.py when running make repo.

When working through HIVE, initialize this repository with git submodule update --init --recursive; HIVE's build stops with a clear error instead of silently producing an image without HPT.

Use on HBOS

run hpt init
run hpt source http 10.0.2.2 8080 /
run hpt update
run hpt search calculator
run hpt install calc
run hpt list --installed
run hpt verify
run hpt run calc

For an HTTPS repository:

run hpt ca /packages/hpt-root-ca.pem
run hpt source https repo.example 8443 /
run hpt update

For an IPv6 literal, both command forms below are accepted and stored without URI brackets:

run hpt source https [2001:db8::2] 8443 /
run hpt source https 2001:db8::2 8443 /

The CA file can contain one or more trusted root certificates in PEM format. The server must send its leaf certificate and intermediate certificates. HBOS rejects an untrusted chain, an expired/not-yet-valid certificate, and a DNS/IP SAN mismatch. DNS sources query AAAA first and use IPv6 when SLAAC is available, then fall back to an A record and IPv4. Direct IPv6 sources use lwIP NDP, SLAAC, and TCPv6. Package SHA-256 checks remain mandatory because repository indexes are not yet signed. See docs/HPT.md for the command reference, repository format, and current limits.

update rejects duplicate package names, unsupported architectures, unsafe payload paths, missing dependencies, dependency cycles, oversized payload declarations, and malformed HTTP framing. install stages and re-reads a payload before replacing /bin/<name>; an upgrade keeps a verified rollback copy until both the payload and installation database have been written.

Use HPT-server to serve repositories on Linux. Its platform boundary is designed for a future native HBOS build.

Repository layout

app/hpt.c             HAX client application
app/include/hpt.h     Index parser, version comparison, and SHA-256
tools/hpt_repo.py     Repository index generator
tests/test_hpt.c      Portable host tests
tests/test_hpt_repo.py Repository metadata and dependency-graph tests
examples/             Example package manifest
docs/                 Protocol and usage documentation

License

HPT is licensed under the GNU General Public License v3.0. See LICENSE.