Fluxheim 1.7.0

[eldryoth]

Fluxheim 1.7.0 Release Notes

Fluxheim 1.7.0 starts the WebAssembly extensibility line after the Pingora-free
runtime and crate-boundary cleanup work in 1.6.x.

This release does not yet expose production request/response policy hooks. It
adds the first sandbox foundation: safe plugin file loading, bounded Wasmtime
execution, compile-time feature gates, and real smoke evidence for executing
and trapping Wasm modules.

Highlights

• Add the optional fluxheim-wasm workspace crate.
• Add wasm, wasm-proxy-abi, and wasm-wasi feature switches. The Wasm
  feature family remains off by default and incompatible with privacy-mode.
• Load Wasm plugin files only from approved absolute roots, rejecting relative
  paths, ./.. components, symlinked files or parents, non-regular files,
  and files over the configured module-size limit.
• Record the SHA-256 hash of loaded plugin bytes for future admin/status and
  audit surfaces.
• Add a typed Wasm plugin manifest boundary with plugin name, path, ABI, phase,
  fail-mode, and sandbox-limit validation. Preview ABIs require explicit
  allowance, duplicate phases are rejected, and fail_open is rejected for
  security decision phases.
• Add a manifest-backed plugin loader API so future config wiring validates a
  manifest and loads the exact approved plugin path with the validated limits.
• Add a Wasmtime runtime foundation with bounded fuel, memory, table elements,
  instance/table limits, compile timeout, and a per-call wall-time watchdog.
• Bound concurrent Wasm module compilation workers so a timed-out adversarial
  compile keeps occupying one capped slot until it actually exits instead of
  allowing unbounded compile-thread growth.
• Avoid cross-request timeout interference by using a per-store epoch-deadline
  callback: a shared engine epoch tick only interrupts the invocation whose own
  deadline has elapsed.
• Open plugin files with Unix O_NOFOLLOW where available and verify the
  opened file handle still matches the pre-open metadata before reading plugin
  bytes.
• Carry the canonical approved plugin path from validation into the final
  metadata/open sequence so filesystem access uses the same path boundary that
  was checked.
• Add unit tests for plugin path safety, oversized modules, real Wasm
  execution, fuel exhaustion, memory-limit rejection, and table-element limit
  rejection.
• Add scripts/smoke_wasm_sandbox.sh as a real Wasm smoke test that runs a
  successful module, verifies an infinite-loop module traps under limits, and
  proves table growth beyond the configured table-element cap is denied. The
  smoke also validates an accepted plugin manifest and rejects an unsafe
  fail_open access-decision manifest.
• Add regression tests for symlinked approved-root rejection, zero
  compile-timeout validation, and unrelated engine epoch ticks before an
  invocation's own deadline.
• Add the Wasm smoke to scripts/test_starter.py; the deep release gate now
  enables it by default through FLUXHEIM_GATE_WASM=1.
• Add docs/wasm-policy-example-parity.md and
  scripts/validate-wasm-example-plan.sh so the 1.7 line has explicit
  end-of-line example/test requirements for F5 iRules-style policy, nginx
  Lua/OpenResty-style header policy, HAProxy Lua/SPOE-style routing and
  load-balancer policy, and VCL-like cache policy.

Operator Notes

• Wasm is not compiled into default builds.
• privacy-mode rejects Wasm feature combinations because Wasm policy hooks
  are an extension and observability surface.
• The first 1.7.0 runtime only supports a small internal i32 no-argument
  execution proof. Request/response header hooks, access decisions, cache
  policy hooks, proxy-ABI compatibility, and WASI capabilities remain staged for
  later 1.7.x releases.
• Wasm compilation is bounded by a compile timeout and a global compile-worker
  concurrency cap. Fuel and epoch checks apply after compilation, so future
  request-facing hooks must still pair this with configured per-plugin and
  per-vhost execution concurrency limits before request-path use.

Checksums And Signatures

• Commit: e61bc5b61c94e72396578dcec1d922663cda17a3
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • 636eb8a011b76f402ef406f59e0a2571e8ec7986cf11e5123c37d8f53ed174e0 fluxheim-1.7.0.tar.gz
  • 2ee065cab3cde3f12b4d09c2f81475fbfb44df05a03132031e0b398277367b16 fluxheim-1.7.0.zip
• Binary checksums:
  • x86_64:
    • d272b244cb005f9c094f103e2e3d6af2527169499a2e97ed7418b397987c9bb6 fluxheim-1.7.0-full-x86_64-linux.tar.gz
    • 31098e08b4534224c3b6fb3b82ce95201e83fb4db2003bf5033307b35f72ed16 fluxheim-1.7.0-cache-x86_64-linux.tar.gz
    • a923b161591b20d3ffe3e49b09c79a082ff308dd6e6852097b1ccaf57d087da6 fluxheim-1.7.0-proxy-x86_64-linux.tar.gz
    • c819b18c043cb5b641c9cfd840b013409cb0f1c0a577556a44d41c89873bceaf fluxheim-1.7.0-php-x86_64-linux.tar.gz
    • 4a54dd3f6bd299d1d586d1543d793cc89dd06bb008b5f2613c5a2319d7bf4bb2 fluxheim-1.7.0-load-balancer-x86_64-linux.tar.gz
    • d4ff6be16995534d7682ea8ba724bbf2ef77a8f1bdabf67dcecce2fab6415f3b fluxheim-1.7.0-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • 04a32b92992ec94457be5da10becac62ce969d3d33fa56467a6b8075d40022e2 fluxheim-1.7.0-full-aarch64-linux.tar.gz
    • a98e7aed042fff3ad9484d8598667a66154a966df591493b5314d4cfb860844f fluxheim-1.7.0-cache-aarch64-linux.tar.gz
    • 5babc748e0adb57cff54118ecd44ee3f692b294b10e3700c1abdc24c6ab00836 fluxheim-1.7.0-proxy-aarch64-linux.tar.gz
    • 8000d621db1e53deb76e2b00dcfc449a48e2e0403ea55e31945b8a9cb62b35fb fluxheim-1.7.0-php-aarch64-linux.tar.gz
    • 396c2ec223c8d4403241f5c01288623ded4fa1045cdbaae2b59bd752679e6698 fluxheim-1.7.0-load-balancer-aarch64-linux.tar.gz
    • 9d68cc1c58b015a10dacf7310a8926e60d80f0d7707ad1a16aa6213e1d3c30d0 fluxheim-1.7.0-config-tester-aarch64-linux.tar.gz
  • macos:
    • ece7cd6dc9158fe5a7ac096194f476f06b72cf1580841e67bfb36e8396f5e616 fluxheim-1.7.0-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • 407316ca2db31ea03ec23f02d2de3eb14374c3f485fe2adb3bb1f06d4865fcb0 fluxheim.spdx.json
  • 036a3354720c34309c5ed7d929486049e282407b42858bc41fb04e117b7a0eb8 fluxheim.cyclonedx.json
• Reproducible build:
  • 496532007867cf4c0136460695635f606363fb5673a149d307fa9fa936ea79bb x86_64
  • 55de8348869500cd1968f294fce0b54e66d513d14323aa56a6ecabf743de26e4 aarch64
  • af9f5a5644be975612ba2194c92e6aa6d0748c310e48da24787097978a6e07ff macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:188fbf4daff26a08869dde9cde2b9a1e249c8999604ecdd6aadee8b3fd3bc45c
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:aa447f3cc8d242a961a9b61878f1acff9dd2a12cb5fa0967b9341e545537e9ad
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:12563345efb93c2a80831dc0c447228137cf16eb32e09da8e80909ddcd6823f3
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:51d7f12c696613d402d76e91b0b4df8968aa4b4219eab3e34509ebdcf9dd1a20
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:512e83018e85184ff43f8faf85108986f434feb306a8e70ed073d262b59b3403
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:c4b3b20511f5a129ffa67091e197361141ecc17893b5de0bf453e0f7173bd51d
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:857afb49d96adcda710bcc832217c1b628b3f9d6529799e6f052234e9a0b74df
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:5713f1568ac1b7a37d1b7efddbe6896bdf48e4b82a60d53a57a58de348158df7
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:20ebd408b7a763659fe9b0194be31881306b347b43d41431b6698da2370126b4
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:85ddd15f6f40229ab2c362b49995ff946919fcfb3522067ba76d2d3bd57c08ec
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:65ba165b316233516db43b906ddb2e496859a972803ac852382f2d8fd747ac50
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:8f785aa3a0a10136b9e46f9bedd71cfa9db7f6a3d4e7e30f387b464d87ed728a
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:82c1ad98230d78fcd4d5e3a94486a79aa1240264512757ad2ad13044b16f562a
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:711179d5b7ce3096cf816aef62442471a281fa2ec08a66c8dacac49c2400f6a0
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:412c2ad1e6014e08b7d92a45915f5df8ebb74f8e3b00e48a399388afe9c3f339
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:42ee8e8dbf0b50bb869a0ceb91975a7b2f03fc002b83d5dec9af785c766150d7
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:a9430417436f387e99c506a32e3aa5f2d4b39047525ce018bec6a0543bcb0650
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:14918531bb8d0bbd9f5fe18f80c17d3e1ac139f622b6b676ab849f534aa0ce55
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:3b1699511975744d5e68be15aa346927acd0dd2166cefc84396b72a835f2018a
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:213b4f6a0d4572cd4ae24f18b1bd92cfc5808308850ae0cce411c68063694851
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

---

This discussion was created from the release Fluxheim 1.7.0.