Fluxheim 1.6.35

[eldryoth]

Fluxheim 1.6.35 Release Notes

Fluxheim 1.6.35 is the first stabilization checkpoint after the Pingora-free
runtime proof release.

This release is intentionally scoped to security cleanup, soak-test evidence,
performance/regression checks, dependency hygiene, and documentation clarity
before the 1.6.36 structural cleanup removes the temporary native proxy shim.

Highlights

• Keep the normal runtime on the Fluxheim-owned listener, TLS, HTTP/1, HTTP/2,
  WebSocket, cache, load-balancer, admin, metrics, stream, and background
  service paths introduced by the 1.6.34 Pingora-free proof release.
• Start the first-party secret-memory migration pass from direct zeroize
  calls toward Fluxheim's sanitization crate where the replacement is
  practical and testable.
• Move the legacy root auth subrequest forwarded-header secret container from
  direct zeroize wrappers to sanitization::SecretString.
• Move native auth-request forwarded and allowed response-header secret
  containers to sanitization::SecretString.
• Move native metrics bearer-token storage and transient Authorization header
  candidate buffers to sanitization secret containers.
• Move managed load-balancer cookie HMAC key-ring clearing from direct
  zeroize calls to sanitization::SecureSanitize.
• Move HTTP discovery bearer-token storage and Fluxheim-owned Authorization
  header assembly to sanitization::SecretString.
• Move native OpenBao disk-cache encryption token storage to
  sanitization::SecretString while preserving the existing OpenBao request
  behavior.
• Align the legacy cache OpenBao token holder with the native cache token
  migration so both cache code paths use sanitization::SecretString.
• Move admin bearer-token digest clearing from the zeroize derive path to an
  explicit sanitization::SecureSanitize drop implementation.
• Update the release checklist to prefer sanitization::ct for future
  constant-time secret comparisons, and drop an unused zeroize derive feature
  from the load-balancer crate.
• Move native upstream TLS client private-key PEM buffers for both rustls and
  OpenSSL backends to sanitization::SecretVec.
• Move stream-proxy upstream TLS client private-key PEM buffers for both rustls
  and OpenSSL backends to sanitization::SecretVec.
• Abort if native auth_request response-header application cannot access its
  secret container, matching other poisoned security-control locks and avoiding
  a repeated inconsistent 502 path.
• Clear both the admin token digest and stored token length through
  sanitization::SecureSanitize during drop.
• Align runtime performance baseline capture with its load-balancer fixture by
  building the profile-load-balancer release profile by default.
• Tighten native vhost-level PHP-FPM/static fallback routing so executable PHP,
  PHP directory redirects, denied PHP paths, and fail-closed resolution errors
  stay on the PHP-FPM path, while non-PHP static files can still be served by
  [vhosts.web].
• Carry the native PHP-FPM fallback script-resolution result into the handler
  so vhost PHP/static routing does not resolve the same path twice across a
  deployment race window.
• Make validate_runtime_config() run the central structural
  Config::validate() checks itself, so standalone runtime validation catches
  cross-field invariants such as peer-fill policy shape before startup.
• Snapshot native disk-cache purge targets before running purge callbacks, so
  stale and indexed maintenance batches no longer hold the global purge
  registry mutex while deleting cache objects.
• Serialize native disk-cache same-key mutations with bounded lock stripes so
  store, purge, and eviction cannot interleave state updates with filesystem
  object removal for the same combined cache key.
• Preserve the client request Host as the HTTP/2 upstream :authority,
  matching the documented upstream virtual-hosting behavior already used by the
  native HTTP/1 and WebSocket paths.
• Narrow native PHP-FPM fallback fail-closed routing so resolver errors for
  explicit or protected PHP targets still avoid static source exposure, while
  ordinary non-PHP front-controller probe errors defer to static fallback first.
• Harden the WordPress PHP-FPM smoke fixture with explicit private TCP upstream
  opt-in and MariaDB readiness waiting, and verify full native WordPress
  PHP-FPM plus proxy/TLS smoke coverage.
• Fix the release version-bump helper so package versions such as 1.6.35 are
  not interpreted as regex backreferences during automated metadata updates.
• Add scripts/test_starter.py, a human-facing selector for the maintained
  live smoke scripts and release gates.
• Add scripts/check_smoke_images.sh so maintainers can pull and record the
  configured WordPress, OpenBao, MariaDB, PostgreSQL, and Valkey smoke images.
• Add a privacy-mode live smoke that builds profile-privacy, verifies
  client-IP headers are stripped before the upstream, and checks Fluxheim logs
  do not retain the test IP, path, cookie, user-agent, or request ID.
• Extend local and container load-balancer smokes with native
  nginx-compatible Ketama coverage, and extend the container smoke with
  backend failover, recovery, and all-down 503 checks.
• Wire optional deep-gate flags for OpenBao cache encryption, database health
  checks, WordPress, PHP Wolfi, RPM build, privacy mode, and smoke dependency
  image freshness.
• Make the observability smoke self-contained by starting disposable
  Prometheus and Jaeger containers when external URLs are not configured,
  requiring Prometheus scrape plus OTLP metrics ingestion and keeping Jaeger
  trace ingestion opt-in until native span export is implemented.
• Require cache.peer_fill.shared_secret_file for non-loopback http://
  peer-fill URLs, closing the remaining unauthenticated cross-host plaintext
  peer-fill cache-poisoning configuration.
• Add cache.peer_fill.shared_secret_file so peer-fill clusters can require
  response-bound HMAC verification: outbound peer-fill requests include a
  nonce/request signature, peers sign the status, canonical response headers,
  and body digest, and unsigned or tampered peer responses are discarded before
  cache storage.
• Add scripts/smoke_ports.py and wire the newer privacy, observability, and
  load-balancer container smokes through the shared randomized localhost port
  allocator instead of repeating ad-hoc allocation snippets.
• Keep dependency, metadata, container, RPM, and smoke-test gates as blocking
  evidence for the stabilization line.

Compatibility Notes

• No new protocol or extensibility surface is planned for this checkpoint.
• Third-party transitive zeroize use inside dependencies such as rustls,
  AWS-LC, and other cryptographic crates remains untouched.
• The 1.6.36 follow-up remains reserved for structural cleanup: deleting the
  temporary native proxy shim, moving remaining DTOs/helpers into owning crates,
  and removing inert Pingora-era root code.

Verification

• scripts/validate-release-metadata.sh
• scripts/validate-pingora-dependency-policy.sh
• scripts/validate-native-runtime-cutover.sh
• scripts/capture-runtime-baseline.sh release
• scripts/stable_release_gate.sh check
• scripts/smoke_privacy_mode.sh
• scripts/check_smoke_images.sh
• scripts/smoke_load_balancer.sh
• scripts/smoke_load_balancer_container.sh
• scripts/smoke_openbao_cache_encryption.sh
• scripts/smoke_redis_health_check.sh
• scripts/smoke_mysql_health_check.sh
• scripts/smoke_postgres_health_check.sh
• scripts/smoke_observability_local.sh
• scripts/smoke_wordpress_php_fpm.sh both
• scripts/smoke_wordpress_proxy_tls.sh

Checksums And Signatures

• Commit: ff52c18a83376e44eda25ab4c9fdbebecb70e2ae
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • [MANUAL_SHA256] fluxheim-1.6.35.tar.gz
  • [MANUAL_SHA256] fluxheim-1.6.35.zip
• Binary checksums:
  • x86_64:
    • 0d4e05623fc8533ca0e497e872dce741783dfdb131ef557756bf70a8e5d0b8ed fluxheim-1.6.35-full-x86_64-linux.tar.gz
    • c52ba34cbeee85b8f553f45f5a7de0fc12fcf1e976a8e078b3cabecca49a48e2 fluxheim-1.6.35-cache-x86_64-linux.tar.gz
    • cb8b46c18b29468407b10c5ace693e092fe88f2a55666569d87c125e673affb0 fluxheim-1.6.35-proxy-x86_64-linux.tar.gz
    • 39da8968439ec10a8a9cb579a268338e25c2d3f92d5be6359fd9f02d3a80285b fluxheim-1.6.35-php-x86_64-linux.tar.gz
    • 9541d9a78c8c3abc9402483dec9970fb2293a285cdab2364517f4f83c1e0c480 fluxheim-1.6.35-load-balancer-x86_64-linux.tar.gz
    • ea76e0ed84929d392967d3e88a2540504a6f67e5366bcd6d779430c3741cc00e fluxheim-1.6.35-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • 84276a98a971a0b4bb546d295a5acf70b314706fa08f75a40327d1e4e40bfeb4 fluxheim-1.6.35-full-aarch64-linux.tar.gz
    • 9504df2b2e6ee8a7dcf15db827ec7b0c4ca7d0c8f52c0d6948fa0391a931733a fluxheim-1.6.35-cache-aarch64-linux.tar.gz
    • 1a39f518765579436795fa24bac6844d437c9ee56f367e04a35504b9fe4f1052 fluxheim-1.6.35-proxy-aarch64-linux.tar.gz
    • a5a71567a0099ae79c1d993017f02f9b6506e79b3fb01d47fb9f201e2481e37e fluxheim-1.6.35-php-aarch64-linux.tar.gz
    • 9049820f0f43bb8241c3de2d8967e4370da5a0da92769ed9d617a7c8b7fcaa73 fluxheim-1.6.35-load-balancer-aarch64-linux.tar.gz
    • dff3684fa6433705319bad9f8b33622ab05eb03c368b5f0861f5acccb46a73d4 fluxheim-1.6.35-config-tester-aarch64-linux.tar.gz
  • macos:
    • dfa84545737fc151d8350c6508a60d35a17aa5eebd8e764ebe0fb59a868ec572 fluxheim-1.6.35-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • 04e812f1f00318cf52b10d547a7527f93483a1d7d50e5c795efc6ab7b753c097 fluxheim.spdx.json
  • d4a9d74193fd2d5b9fbb8c81cf3b8f201abca3cb50a0a8a61070946c8160576e fluxheim.cyclonedx.json
• Reproducible build:
  • 5325d2a4022b2414aeaa4c7db4f9c15e4188d4642c5b8b318316d4834ba4147d x86_64
  • 9dc8efb9ef09076f21e71c1f54cf2ebfd89525f0184912f609de11bcd61de98f aarch64
  • c028258f99a1ab95e78269b28f40027b6fd71b3a1f9678d622006dd602e6b7dc macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:8dbbeec3dcf1a651d183b105ddcd79406e190528acc9d5a38fc9bcb69902fe54
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:6eaae5520e18b85e740c2dcbdb097875cc03765238dd7f7a819ae36dd4bbf3d4
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:79dba6f376a054e8125444e0367514adf51cd7d4ac6778e3a14ae2175f7c769e
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:6439f2ba2d4ceb770d0b7040916977204e4a9ca6d2b08daadb034fe657b0ecff
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:dd2291e8aa0d28221b50f254c2ce8ae3d68bfeb8ababf517584bb75534e5bbe1
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:a036b46063968f958816c53737ddac3c312b004a30fe9119c16ee8c2dbc36c85
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:cd4765c78ee8354c70574838fab7cb306866132051c384ae34e8494b18b60b91
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:2549e3d8da159bbb5f07f080c7470771c56c15b22a59d42979fa4c1c9246c77e
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:04794d8dec53c8ca83b26aae46b51b2d3c55d75935f0a52738942d530dea01e0
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:468a7f659d8ba827fbf9023d264631c14c1f18202b1495caee7b9c409b51ab70
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:3b1c872df58a273ac815e47ba810278d9c28ac907053e222f65b3df7539b3fe7
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:735d08a9f47f30993d056c68587a1d5be62a439030f17e97a9d2fe7f3a70ea9a
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:bf685a76b71b94ca032def9168be0d566883a74d5c1a28d2e33d7b138200f43f
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:3833b70d1b061d6986f46c0512484e036b05024bd7f3dce3082b16d9002557fa
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:4bd080455de5eea25e9ac09a365481d20ce0511574d2acc9c88605d419090bdc
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:14f387191aff862869886640c5daab599fa93fefe546954560c1c8ad2ca837e8
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:0a6de1c407467a2ab57b8073bd49f0facb1de0c09894aee6f37ee400ab140726
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:915d2e8103c99e92bc4810e2bd931fb6271c1e391c38f88f834dc7485bba841b
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:40e7f24f21ce5b3da9229e19708daf59860151d4424c36147dfd6b156c7a56be
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:38371dba542beadda826aa11cb90bd2444278b951f73980b34932e56bdf544d6
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

---

This discussion was created from the release Fluxheim 1.6.35.