Fluxheim 1.7.1

[eldryoth]

Fluxheim 1.7.1 Release Notes

Fluxheim 1.7.1 continues the WebAssembly extensibility line with config-level
plugin registry integration, deterministic hook-chain contracts, and the first
live request-path hook family: native HTTP/1 access decisions. Request-header
mutation remains staged until the typed host-call ABI can safely pass and
mutate header state.

Highlights

• Add [wasm] config validation for plugin roots, default sandbox limits,
  default execution admission budgets, process-wide execution admission,
  plugin declarations, and plugin attachments.
• Add [[wasm.plugins]] declarations with plugin name, path, optional expected
  SHA-256 digest, ABI, host-call namespace, phases, fail mode, per-plugin
  sandbox limits, and per-plugin admission budgets.
• Add [[wasm.attachments]] declarations that attach a known plugin to a
  configured vhost and optional route, with optional phase narrowing,
  deterministic priority, and per-attachment admission budgets.
• Add a typed config-to-loader manifest bridge so validated [[wasm.plugins]]
  entries become fluxheim-wasm manifests with inherited sandbox limits and
  optional expected SHA-256 digests.
• Add accepted and rejected WASM config-registry fixtures and wire them into
  scripts/validate-wasm-config-registry.sh.
• Reject unknown plugin references, attachment phases not declared by the
  plugin, duplicate same-target attachments, preview ABIs without explicit
  allowance, unsafe fail_open security-decision plugins, invalid plugin
  names, invalid plugin paths, invalid SHA-256 digests, and invalid sandbox or
  admission budgets.
• Enforce the registry allowlist at config validation time: each plugin path
  must live under one of the configured wasm.plugin_roots, and roots must be
  scoped deployment directories rather than filesystem-root or top-level system
  directories.
• Require sha256 for plugins that declare security-decision phases
  (access-decision, route-decision, or cache-store).
• Add wasm.max_total_concurrent_executions, a process-wide ceiling for total
  concurrent Wasm plugin executions.
• Add a canonical ordered attachment view in config so all hook families use
  the same priority/declaration-order rules.
• Add reusable fluxheim-wasm access-decision and admission primitives,
  including process-wide, per-plugin, and per-attachment execution ceilings
  plus first-deny-wins composition.
• Wire live native HTTP/1 access-decision hooks for vhost and route
  attachments. Built-in ACLs remain non-overridable; Wasm access hooks can only
  add an allow/continue or deny decision after built-in access policy passes.
• Compile Wasm modules once when the native hook registry is built, then
  instantiate a fresh store/instance per request. This keeps request execution
  isolated without spending the global compile-slot budget on every request.
• Add live listener tests that load real Wasm modules and prove deny behavior,
  priority-ordered first-deny-wins, percent-decoded route policy selection,
  non-overridable built-in route ACLs,
  process-wide/plugin/attachment admission rejection, and fail-closed behavior
  for invalid output, traps, and execution timeouts.
• Classify any [wasm] runtime, plugin, attachment, limit, or admission change
  as wasm-runtime-changed and require a process upgrade until the atomic
  compiled-module reload path is implemented and tested.
• Expose the process-wide Wasm execution ceiling and attachment priorities in
  authenticated /_fluxheim/status.
• Add low-cardinality Wasm metrics for plugin executions, execution duration,
  and admission rejections. Native hook execution installs Prometheus recorders
  when metrics are enabled.
• Preserve explicit WASM default resets from later conf.d fragments by using
  fragment-aware merge semantics for default sandbox limits and admission
  budgets.
• Refresh release tooling pins: Docker GitHub Actions move to current v4/v7
  patch tags, Prometheus observability smoke coverage uses v3.13.0, and the
  non-Pingora crate freshness gate remains clean.
• Update base64-ng to 1.3.5 across the root, ACME, server, and
  load-balancer crates.

Operator Notes

• wasm.enabled = true is required before plugin roots, plugin declarations,
  or attachments are accepted.
• Binaries built without the wasm feature reject non-empty [wasm] config
  during validation instead of accepting a registry that cannot run.
• The default process-wide Wasm execution ceiling is 256.
• The default attachment priority is 1000.
• access-decision hooks use the exported
  fluxheim_access_decision() -> i32 preview ABI in this release: 0
  continues the chain, 1 allows/continues, and 2 denies with 403.
• Plugin paths and plugin roots must be absolute and must not contain . or
  .. components. Plugin paths must be under wasm.plugin_roots, and plugin
  roots must be scoped directories such as /srv/fluxheim/plugins, not broad
  roots such as / or /etc.
• Runtime loaded plugin hashes remain staged for a later 1.7.x status slice.
  Configured expected hashes remain visible in admin status.

Example attachment:

[[wasm.attachments]]
plugin = "security_headers"
vhost = "example"
route = "static"
priority = 100
phases = ["response-headers"]

Checksums And Signatures

• Commit: 53eaffbf844315d374a5881ca0c0e3081773a21d
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • [MANUAL_SHA256] fluxheim-1.7.1.tar.gz
  • [MANUAL_SHA256] fluxheim-1.7.1.zip
• Binary checksums:
  • x86_64:
    • 7bb74215e5c7f308ec193d2c713f04b1378246d3895a4a99155c5be2c3d28d80 fluxheim-1.7.1-full-x86_64-linux.tar.gz
    • b9ad6028d824ff6ed777943b34de41aa3bece11f1fe55bf5ee05882f0157f40a fluxheim-1.7.1-cache-x86_64-linux.tar.gz
    • 70bd6d742ced06366867cfab18a0338db48ade9b2b3648f8736f330fad0bb670 fluxheim-1.7.1-proxy-x86_64-linux.tar.gz
    • 0504ce568ffd196ff89d8f46054bfa2aaaca2e7322ac9ea209117f6a17c3d458 fluxheim-1.7.1-php-x86_64-linux.tar.gz
    • 2e51a2da0b17588a3e830f510fa11b3efac9006d84b95f22bd1778dc04990206 fluxheim-1.7.1-load-balancer-x86_64-linux.tar.gz
    • 0e420bae996462de8a3fa834b61c8eb0ddacdb84aee9dc383ed3868f5e81a9ea fluxheim-1.7.1-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • ffbbad37d37e4c290d7be016263f90910977c48d25be98e3c2217db880d8b051 fluxheim-1.7.1-full-aarch64-linux.tar.gz
    • 0c4983bc492e2be85b5fba619de93b8f11c4fe4a2fc86f2c7862f4c5e35f80ee fluxheim-1.7.1-cache-aarch64-linux.tar.gz
    • f14c5784cd504e00c1490884e932d0484f9c3b20f099dda4d921170c058e6862 fluxheim-1.7.1-proxy-aarch64-linux.tar.gz
    • 23c32a3564d3a00dbafaefea644ebda14b1da05a202f8e6147a9591632170ff1 fluxheim-1.7.1-php-aarch64-linux.tar.gz
    • ec6dd80a99733b1def87b07b98f6799bf2a059a6942318e7d2093e22a608f397 fluxheim-1.7.1-load-balancer-aarch64-linux.tar.gz
    • 08e71cb4a8273edffd58b28de2a0ad9edeb3209a6301462a8996a82708700dbc fluxheim-1.7.1-config-tester-aarch64-linux.tar.gz
  • macos:
    • ff44986608e5757caeb8c45f6d29b893a1927c92140438d34549fe3631463ae9 fluxheim-1.7.1-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • 746dad48b8d3e26fa63c871e7aca882111858dab4f25bdeefa9c036745ac2f4b fluxheim.spdx.json
  • 3eba1f637da51aa02cc009b7931f3490d7dfc4a3d8e61eb66d7ad11b9b360ce4 fluxheim.cyclonedx.json
• Reproducible build:
  • bf2225caa47e6c15433668364a923f99f3e140132a8f1f76a70bfbe000225d87 x86_64
  • 52fd070693eb0ff74b2a63d12382cf93ca5f37d9be4eae0372ae8877b5848f3e aarch64
  • 97d9ad43435c9832c9865e3a586e56ca022a66fb4f6560a6135665ef2bd723fe macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:97ac18d1a92cadd9a789ac1ffc4c191141efbe3da96b902051c9c1cf4f5475ba
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:227a5e45a7db15c2ff0e17c02dd02d8729b669e6a47068db0ca9238ed219d634
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:1df45725eec7991f0375f47d7aa1298f6d701426a9e3a51feb0f6fc5ea85a826
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:e4a49a70bb9a72700d68a5c330bb9eb2cd02d1cedaa6155a52c201758a0033d5
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:75df0c5e97e927d2d73f170a980f455f739edd4351e36758cc34db0738597ed7
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:553f971225048e18b3ed06af324df6c68bc009deb6f6250e23ca7d1464fe2f13
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:94e27328a525297546ca4a11e978795838b90e80ce27066b81ded5ef4891a46a
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:0292b8172f2cfcc0a5e47fdc2749c6f3cf43f9bd817930a8491896c7363c594d
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:42dde9267784b814bace15d33b7cac8c36d352e6403432fcf29fd41526c118c6
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:7e031b2dfb03870c6cb320101b4655bb7cd1c30033b79a0dabc50f04519dc3f4
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:5e53402fbea8de6a55d74095b7a1600bc81b906a2683e6697a8de8856e901208
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:60660e3d4bb124e869e618a170559bb6735b45f6e48dfe8dd9f2632e0cc00e0e
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:4ec8d057a8bab06e6bcdb7f8237502fdedd8908180cc727764af4b3cec3d8f05
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:08cf8d4b9d3eade237e30e39167558ac465f63ae0a9d150a9d099ead9f60a29f
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:bbed59aabddd72bed3438cd9eb8a17fd63ad476e205cb77f5f9021f32f175f28
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:c324e1a35f118c608f66cf94ccb2de253b5dac1b352da65e0e6a6aaaeeccefe3
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:0ad389a43a9e78a446f9b8951532e8fb4424a57dbc7cff4e8e15a3d6be6e7e1e
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:108994489dc5a32e59290d848f74e369a50d0e195b7b09fcba2f2ff712efc256
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:205acb70adc351f722289a201e6f92cbdf80367fd95db9106b9cce6be2237a6e
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:35612298c42b30ce7728b97b10b5566e6acc01358b591ad89b1ac9232ea8f0f8
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

---

This discussion was created from the release Fluxheim 1.7.1.