Skip to content

Tengine-3.2.0-rc1

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 01 Aug 20:23
· 75 commits to master since this release
3.2.0-rc1
c226b58
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Superseded by 3.2.0-rc2 — it signs every package, splits out debug symbols, ships ngx_http_perl_module as its own subpackage, and adds SLES 16, openEuler 22.03, Anolis 23, Ubuntu 26.04 and Alpine 3.21–3.24. Please test that one instead.

Chinese changelog: CHANGES.cn

This is the first release candidate of Tengine 3.2.0, the first release since 3.1.0 (October 2023). It is feature complete: we are looking for field testing and bug reports before the final release. Please do not use it in production yet.

What to test

We are especially interested in reports about the new distribution packages and container images, HTTP/3 over xquic on lossy networks, and the load-balancing changes. Please open an issue with the output of tengine -V, the relevant configuration, and the platform.

Security

Highlights

  • core updated to nginx 1.31.3 @lianglli
  • HTTP/3 connection management and multiplexing, for lower latency and higher resilience to packet loss on unstable networks, with BBR as the default congestion control [xquic] @lianglli @lurker-Chen
  • distribution packages (rpm, deb and apk) and multi-arch container images, all built with the full feature set — Tongsuo, xquic and Lua @lianglli
  • new module ngx_zstd for Zstandard response compression and serving pre-compressed static files @lianglli
  • new module ngx_http_upstream_iwrr_module, a weighted round-robin with O(1) time and O(n) memory @jizhuozhi
  • request and upstream timing statistics variables, e.g. $request_recv_time, $response_send_time, $server_rt and $upstream_first_pkg_time @lianglli
  • dynamically configure failover to a backup upstream or a redirect by response status code [tengine-ingress] @lianglli
  • ngx_http_lua_module updated to 0.10.29, which adds PCRE2 support @lianglli
  • ngx_http_upstream_rbtree_lookup() is now a public API, so third-party modules can look up an upstream by name @lhanjian

47 changes in total: 18 features, 16 bugfixes, 8 security fixes and 5 changes — the complete list is in CHANGES.te.

Known limitations in RC1

  • ngx_http_tunnel_module is optional and off by default — it conflicts with ngx_http_proxy_connect_module on the CONNECT method.
  • least_time and sticky are disabled in the HTTP/2 rework and are being revisited.
  • The package file names carry no rc1 marker; artifacts here are named 3.2.0-<timestamp>.
  • Compared with the platforms nginx publishes packages for, Ubuntu 26.04 and SLES 16 are not covered yet, and Alpine ships only for 3.22 rather than 3.21 through 3.24. Everything is built for x86_64 and aarch64 only.

Every artifact here is built with the full feature set: Tongsuo (NTLS / TLCP, Chinese cryptography), xquic (QUIC and HTTP/3) and the LuaJIT scripting stack, all from the versions pinned in packages/build/deps.env. Tongsuo is linked statically, so these builds do not follow the system OpenSSL.

The server installs as /usr/sbin/tengine, configured through /etc/tengine/tengine.conf, and can coexist with a distro nginx.

Install

RPM (RHEL / Rocky / Alma / Anolis / openEuler / SLES) — replace el9 with your platform's tag (el7, el8, el10, an8, oe2403, sles15):

dnf install https://github.com/alibaba/tengine/releases/download/3.2.0-rc1/tengine-3.2.0-20260801200506.el9.x86_64.rpm

DEB (Debian / Ubuntu) — replace bookworm with your codename (bullseye, trixie, jammy, noble):

curl -fLO https://github.com/alibaba/tengine/releases/download/3.2.0-rc1/tengine_3.2.0-20260801200506.bookworm_amd64.deb
apt install ./tengine_3.2.0-20260801200506.bookworm_amd64.deb

Alpine:

curl -fLO https://github.com/alibaba/tengine/releases/download/3.2.0-rc1/tengine-3.2.0_p20260801200506-r0.x86_64.apk
apk add --allow-untrusted ./tengine-3.2.0_p20260801200506-r0.x86_64.apk

Debug symbols ship separately as tengine-debuginfo / tengine-debugsource (rpm) and tengine-dbgsym (deb); the tengine-doc and tengine-openrc apks are optional subpackages.

Container images

docker pull ghcr.io/alibaba/tengine:3.2.0-rc1
docker pull ghcr.io/alibaba/tengine:3.2.0-rc1-alpine

Both are multi-arch (amd64 + arm64).

Verify

curl -fLO https://github.com/alibaba/tengine/releases/download/3.2.0-rc1/SHA256SUMS
sha256sum --ignore-missing -c SHA256SUMS

covers every package here, so --ignore-missing restricts the check to the files you actually downloaded. On Alpine the busybox sha256sum has no such flag — use grep <filename> SHA256SUMS | sha256sum -c there, or install coreutils.

A deb needs one extra step. GitHub replaces ~ with . when it serves a release asset, while SHA256SUMS records the name the package was built with — so the deb you download is …-20260801200506.bookworm_amd64.deb while the checksum file lists …-20260801200506~bookworm_amd64.deb. Because --ignore-missing skips a name it cannot find, a run that also checked an rpm reports success while every deb went unverified. Rename it back first:

f=tengine_3.2.0-20260801200506.bookworm_amd64.deb
mv "$f" "${f/.bookworm/~bookworm}"
grep -F "${f/.bookworm/~bookworm}" SHA256SUMS | sha256sum -c

The contents are unaffected — only the file name differs. The final release will normalise the names so that this step is no longer needed.

What's Changed

New Contributors

Full Changelog: 3.1.0...3.2.0-rc1

Contributors

lhanjian, drawing, and 5 other contributors
Assets 68
Loading