Fluxheim 1.7.2

[eldryoth]

Fluxheim 1.7.2 Release Notes

Fluxheim 1.7.2 continues the optional WebAssembly extensibility line with the
first live native HTTP/1 request-header and response-header hook family. The
new hooks use a constrained fluxheim_policy_v1 host-call surface so plugins
can perform approved synthetic policy mutations without receiving raw headers,
bodies, filesystem access, network access, or admin APIs.

Highlights

• Add live native HTTP/1 request-headers and response-headers Wasm hook
  execution for vhost and route attachments.
• Extend fluxheim-wasm with bounded integer host functions while preserving
  the existing fuel, memory, table, instance, compile-timeout, wall-time, and
  admission controls.
• Add symbolic fluxheim_policy_v1 host calls for coarse request context,
  approved request header setting, approved response header setting, and
  approved response header removal.
• Support the first nginx-Lua/OpenResty-style header-policy example: add an
  x-policy-tier request header before upstream forwarding, remove origin
  x-powered-by, and add x-fluxheim-policy-branch before the response is
  sent to the client.
• Add live listener tests proving the upstream observes the plugin-added
  request header and the client observes the plugin-added response header.
• Add fail-closed coverage for forbidden header mutations. Invalid host-call
  IDs trap the plugin invocation and return 503 unless the plugin is
  explicitly configured for fail-open behavior on a non-security phase.
• Apply vhost-level Wasm header hooks to PHP-FPM fallback responses as well as
  route, static, and generic proxy paths.
• Apply the shared fallback response header policy to PHP-FPM fallback
  responses, including the default x-powered-by removal.
• Compute Wasm header-hook path context from the matched pre-rewrite request
  path so path-class policy stays stable when a route strips or rewrites the
  upstream target.

Security Notes

• The header hook ABI is intentionally not a raw header API. Plugins receive
  only bounded symbolic inputs, such as a path class, and can request only
  allow-listed synthetic mutations.
• Authorization, Cookie, Set-Cookie, request bodies, private keys,
  admin credentials, filesystem, network, and process APIs are not exposed to
  the current Wasm host-call surface.
• Built-in Fluxheim ACLs and the access-decision chain still run before
  header hooks. Wasm header hooks cannot override built-in access policy.
• PHP-FPM fallback traffic now goes through the same vhost-level header-hook
  and fallback response-header post-processing as other fallback response
  paths.
• The wasm feature remains optional and is still rejected with
  privacy-mode.

Operator Notes

• Plugins that use request-headers export
  fluxheim_request_headers() -> i32.
• Plugins that use response-headers export
  fluxheim_response_headers() -> i32.
• The current preview host calls live under the fluxheim_policy_v1 namespace
  and use integer IDs rather than strings. This keeps the surface auditable
  while the broader 1.7.x ABI settles.
• General raw header read/write, body access, filesystem access, outbound
  network access, and Proxy-Wasm compatibility remain staged for later
  reviewed releases.

Checksums And Signatures

• Commit: fde1c7b3ce8414632f2e15cde0eb812fdb9df8c0
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • [MANUAL_SHA256] fluxheim-1.7.2.tar.gz
  • [MANUAL_SHA256] fluxheim-1.7.2.zip
• Binary checksums:
  • x86_64:
    • b4b83d66b7f733936506dc9e957d5bf3da16dc0e1eaf3af50e041f9dcba24f7c fluxheim-1.7.2-full-x86_64-linux.tar.gz
    • 00cbf1330e50b75696f569e7dca1149fdf6f78a80981637dd7d4ad92a96d240e fluxheim-1.7.2-cache-x86_64-linux.tar.gz
    • 5559ee5e86f2098e701da091cfb66066faf343b58826542d3f6f6670e59fb660 fluxheim-1.7.2-proxy-x86_64-linux.tar.gz
    • b4690b0ad67199753e17192b6c19bee49bd3feeed82f3c1a878d099db0b55f81 fluxheim-1.7.2-php-x86_64-linux.tar.gz
    • 58fddf50b2a6e902862f18e21be7c2989c075f2782fa9795fab0243e36bde7de fluxheim-1.7.2-load-balancer-x86_64-linux.tar.gz
    • 5e3fb0763cfb78b259a3d06121f5b0eaf9536770e8353e42b07a3ed61d2c8abc fluxheim-1.7.2-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • cd97f8caf4cdb773e5197b82bb1f8e372f85318908e1ae3a28f4ea94be7b5f84 fluxheim-1.7.2-full-aarch64-linux.tar.gz
    • fd6633706645655ed015a3f4fac2db20fb8c025a27b9491abd5ab8c325de8789 fluxheim-1.7.2-cache-aarch64-linux.tar.gz
    • f85685f8030d93863bfd45d8e6fab066dccd27a4015cb84f9425a407ff3487a7 fluxheim-1.7.2-proxy-aarch64-linux.tar.gz
    • 110e6ed5a33d89fbe384c569dd63fe92fc1ea5cde46c2509f08b203d0e57edd0 fluxheim-1.7.2-php-aarch64-linux.tar.gz
    • a4905717ba36c35ba2299a20ba5fd8d8134993404d1cfb4b396f701ab6b4fd88 fluxheim-1.7.2-load-balancer-aarch64-linux.tar.gz
    • 37b510687ca72e2a3c307ef382108f3aa8593a0f08d61ccab5e5907bf3d13e16 fluxheim-1.7.2-config-tester-aarch64-linux.tar.gz
  • macos:
    • a880a24d033fa5831cc85a180b9ecd58b7472ad9a6942682b64fa63e1c6a56d4 fluxheim-1.7.2-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • 9aca723f7ef19a82aaf691c0632ade3f64f01f6df2d132323bb3adfcbe6641ad fluxheim.spdx.json
  • ef68eb4f2ac94281342ec5a5f917630238ea66b68a76da02bbe5b41684c1353e fluxheim.cyclonedx.json
• Reproducible build:
  • e2a17c4665f86743d6a7eb7ee40b977e16afd9e6d3b097e171eb04966e91b282 x86_64
  • 34b1f9cca8c81cceb11cf86aefc14370d0a77bef20e2d7f93991a0fbbdd9ca8f aarch64
  • 399544ecc371b59bc566e61790a237b7a787b4c908b94f02834cf256e328d82a macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:a3cb85b8401750f0183a6a63af4b46deb740040b1dedb66349ec55d97c7e3355
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:5649a4436cdc003f16b52e06ca3a96de1ac13a4f01e43a084d34d1f0d0d65332
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:0d44f8b54697f1402066a8de239337e3d3265dea819a0f6417d38b96a38327cc
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:1b2deff826c8ebfe119eb229f0fec2cb25babd6027bfff8c1370da13eca36737
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:2064368e5248a1e27825f06e6e48596a85d43ec12a06a111218b8d6b59981c0c
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:06bf0d96c3b0a5c087d2ddce679612cf4fb965aead869f7101af9188a2362805
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:c677b279fe4f84842f4fe15ac3125289f436eb27f11d9905d256fd8e3bf5404f
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:f6bdf5812eaddbb404ef78b641a9ee8218b477efc82910bba81a99e4b7e5031e
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:128c1519351d0095b93385d27a3428f0d1757dbf3019ac097e96a7fddc44cec8
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:5c03e80522160f8acfd80c5a7464b2522d53885494e3619ed02236492d10fa81
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:c84af332879a8891bdeb6b98968144701ba84f95cca61727a0fe0b2659e74181
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:34442017d995693e7c6bd369a580896780ec0b0bab2eee04e73171b0bb328e5e
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:2c09eb70ff905832a1b2494e3dec34300e11aa06b3e90f15f8ffac568d307744
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:56f5acc9e9e457afcddfdd94e0dd951abb2292e64514818b83175c183fefa099
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:dd392e96412c95190dbce9091ff42b5443f5b9e9fe68ca182b5286bffc7bf823
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:0916aca64a6e334f3f628bab10b55fed555ea15c6732eb15677cf03ccd5af59f
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:dc9f960f5aba7e14ac0061e9994996d181aefd904bb2f944efdfcfba5c0a0ab3
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:0b135998cbd4c6c2c1dc307950160560aa29fe48779247174185e3a557d28428
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:03006c175fe9cce9389445c3bd794e75327416d9cca76429bcbf2309d740fc2c
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:ea4ebda63c577308951ce58fbd3958313e7102506f851fbdd815b8f4312b2b86
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

---

This discussion was created from the release Fluxheim 1.7.2.