HPT-server

HPT-server is the repository service for the HPT package manager. It serves a generated Packages index and HAX payloads over the deliberately small HTTP subset used by HPT. It can listen on IPv4 or IPv6 with plain HTTP, or terminate HTTPS directly with a PEM X.509 certificate chain and private key.

Linux is supported now. Request parsing, path normalization, MIME selection, and repository semantics are kept in a platform-neutral C core so the network and filesystem adapter can be replaced by an HBOS implementation later.

Quick start

git clone https://github.com/HeBitOS/HPT-server.git
cd HPT-server
make

Build and test on Linux

make
make test

Generate an HPT repository from HIVE, then serve it:

make -C /path/to/HIVE repo
./build/hpt-server \
  --root /path/to/HIVE/build/repo \
  --bind 0.0.0.0 \
  --port 8080

Or use the Make target:

make run REPO=/path/to/repo BIND=0.0.0.0 PORT=8080

Health check:

curl http://127.0.0.1:8080/healthz

Enable HTTPS with a certificate and matching private key:

./build/hpt-server \
  --root /path/to/HIVE/build/repo \
  --bind 0.0.0.0 \
  --port 8443 \
  --cert /etc/hpt-server/fullchain.pem \
  --key /etc/hpt-server/privkey.pem

The Make target accepts the same configuration as make run CERT=fullchain.pem KEY=privkey.pem PORT=8443.

Bind to IPv6 and accept both IPv6 and IPv4 clients on Linux:

./build/hpt-server \
  --root /path/to/repo \
  --bind :: \
  --port 8443 \
  --cert /etc/hpt-server/fullchain.pem \
  --key /etc/hpt-server/privkey.pem

Use --bind ::1 for IPv6 loopback only. With --bind ::, HPT-server requests an IPv4-mapped dual-stack listener (IPV6_V6ONLY=0); the host kernel may still restrict this through its network policy.

--cert must contain the leaf server certificate followed by its intermediate CA certificates. Keep the root CA out of the served chain and install it in HPT/HBOS's trust store. make test creates a root CA, an intermediate CA, and a SAN certificate for localhost, then verifies the chain over IPv4 and IPv6 without disabling certificate checks.

The repository root must contain:

Packages
pool/
└── package_version_arch.hax

GET / maps to Packages. GET and HEAD are supported; traversal, backslashes, encoded paths, control characters, and unsupported HTTP methods are rejected.

HBOS compatibility boundary

The current executable entry point is src/main_linux.c. The reusable src/protocol.c core uses only ISO C interfaces and has no POSIX socket or filesystem dependency. A native HBOS port should provide its own entry point using HBOS socket, bind, listen, accept, recv, and send, then use the same parser and path policy before reading repository files.

See docs/HBOS_PORT.md for the adapter contract and porting checklist. The repository wire format is documented in docs/PROTOCOL.md.

Security scope

HPT-server is a small, single-process static repository server. It performs no package upload, client authentication, signing, or dynamic index generation. Its built-in OpenSSL TLS endpoint serves a complete configured certificate chain and requires TLS 1.2 or newer. A reverse proxy remains useful for automated certificate renewal, rate limiting, and larger deployments.

License

HPT-server is licensed under the GNU General Public License v3.0. See LICENSE.