Fluxheim 1.7.3

[eldryoth]

Fluxheim 1.7.3 Release Notes

Fluxheim 1.7.3 starts the HAProxy-Lua/SPOE-style routing-policy part of the
optional WebAssembly extensibility line. The first live route-decision hook is
intentionally constrained: plugins can continue, deny, or select a symbolic
configured route branch, but they cannot invent upstream addresses, bypass
route matching, or override built-in Fluxheim access policy.

Highlights

• Add live native HTTP/1 route-decision Wasm hook execution for vhost and
  route attachments.
• Add a bounded fluxheim_route_decision() -> i32 preview ABI under the
  existing fluxheim_policy_v1 host-call namespace.
• Add symbolic request context for route decisions, including the existing path
  class plus bounded x-canary: 1 and x-mirror: 1 signals for the first
  configured-branch routing examples.
• Add configured-route branch selection for the canary and mirror branches.
  Fluxheim accepts the decision only when a configured route with that name also
  matches the current request method and path.
• Add live listener tests with two local origins proving a Wasm route decision
  can move a request from the standard route to the configured canary route.
• Add live native load-balancer route coverage proving a Wasm-selected route
  still delegates backend choice to the configured Fluxheim load-balancer
  policy.
• Add live managed-cookie persistence coverage proving a Wasm-selected
  load-balanced route still pins the backend through Fluxheim's configured
  persistence policy.
• Add live traffic-mirror listener coverage proving a Wasm route decision can
  select an already configured mirror route without giving plugins dynamic
  shadow-target access.
• Add fail-closed coverage for a plugin that selects an unavailable branch.

Security Notes

• route-decision hooks cannot create destinations or bypass route matchers.
  A selected branch must map to an existing configured route with a matching
  method and path.
• Built-in vhost ACLs, vhost rate limits, and vhost concurrency limits run
  before route-decision execution, so denied or shaped clients cannot spend
  the process-wide Wasm admission budget first.
• Built-in preselected/decoded route ACLs run before route-decision
  execution, while selected-route ACLs and route-specific rate/concurrency
  limits run after the final route decision. A plugin-selected route cannot
  bypass its own configured route policy.
• Selected-route body limits, redirect policy, and request/response header
  policy still apply after the Wasm decision selects a route.
• If a plugin selects an unavailable branch, Fluxheim returns 503 rather than
  falling back silently.
• Wasm module compilation now waits for a bounded compile slot with a condition
  variable inside the configured compile timeout instead of polling in 1 ms
  sleeps under startup/reload contention.
• The wasm feature remains optional and is still rejected with
  privacy-mode.

Operator Notes

• Plugins that use route-decision export
  fluxheim_route_decision() -> i32.
• The initial preview return values are:
  • 0: continue with normal route selection;
  • 1: select the configured matching route named canary;
  • 2: deny with 403;
  • 3: select the configured matching route named mirror.
• Direct backend pool/member choice, plugin-provided persistence-key choice,
  and dynamic mirror/shadow target decisions remain staged for later 1.7.x
  slices.
• Refresh dependency pins for aws-lc-rs, bytes, maxminddb, zeroize,
  getrandom, arc-swap, and env_logger; base64-ng, sanitization,
  cargo security tools, smoke images, and GitHub Actions pins were checked and
  already current.

Checksums And Signatures

• Commit: d40605659539632f184a01ea536e2f79e7c5fa31
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • 472f7ed39708f020cde7ccde01d109d9cde08090ffb8396190cf148a22806a50 fluxheim-1.7.3.tar.gz
  • bd82e4e10c242ba86663a0ef2b31b03a4bd796f641cc535ac07df831c7ad84ff fluxheim-1.7.3.zip
• Binary checksums:
  • x86_64:
    • ac76cf1e38c9f6d110ab9e1a82651a41ff0600bf6cc8362e3b6e7e676d640ad3 fluxheim-1.7.3-full-x86_64-linux.tar.gz
    • 87e7e509f35e654b24d80f03829287d7f623ec58f41e1215b0bf3a3398ecfe5e fluxheim-1.7.3-cache-x86_64-linux.tar.gz
    • 06112b0e91bb985d470659b8315cc807f9fddae2fdfe140d3c586c050aab080b fluxheim-1.7.3-proxy-x86_64-linux.tar.gz
    • d2dd5bb649ca32a3e6437519a4d3bfa94a317323250909a5dc78f1e2546df592 fluxheim-1.7.3-php-x86_64-linux.tar.gz
    • e067b34f4aabc7b941e81b58e962043681f9f177d8c7cd6c284e96b163037ee7 fluxheim-1.7.3-load-balancer-x86_64-linux.tar.gz
    • cbe01af881f9cf0dafdcd4541ebe385132ccc940d6d18d5ee23a883b905a2bdd fluxheim-1.7.3-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • 83d7bdf4cd3a48267faf1cc4aeaec085325a3db632ac419a9c6338847f306054 fluxheim-1.7.3-full-aarch64-linux.tar.gz
    • 07bc1317b5d9dc18e52cf6e242e120952c2b91ad82f231c63e120cf10660cc1d fluxheim-1.7.3-cache-aarch64-linux.tar.gz
    • b3ef93bd0452f1a6d1d4edc976e05dd3fb20b31a942280e1d632954afa718e2d fluxheim-1.7.3-proxy-aarch64-linux.tar.gz
    • 2aad1a1d455c4b270605a3be7b40b5ddc9b012a8c63910ebe0ed6183085de654 fluxheim-1.7.3-php-aarch64-linux.tar.gz
    • 5507d0bd781b458946371a23e9f2c15c8c44dea1cf76eb665d71bd0e9445b32a fluxheim-1.7.3-load-balancer-aarch64-linux.tar.gz
    • ed066af4cbfdce353021e53e5be355ca3968626ed13d232315dc22c48837fdad fluxheim-1.7.3-config-tester-aarch64-linux.tar.gz
  • macos:
    • 535cb3e9ceb46e45336c6d890bfddf61baa9b94a42e71928e1c5c83eec0ae7aa fluxheim-1.7.3-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • e2bf218c025acd5f691e76062f2223ad7f6167d60e10acddcc927b7823ba233e fluxheim.spdx.json
  • 6a469063e11fca5af15b909de7193750ed0d97af7a816e703ad173c6bf863f4f fluxheim.cyclonedx.json
• Reproducible build:
  • 54b2c6baa21061bf55685a8d2b3f4983ec93188d7db4f1f5fd9dc691ce32440b x86_64
  • 61ab7b28bb374ba31ddbc1fec3fa949bd5fcd7b6a1e33421634488ca5fb9f254 aarch64
  • cf09cd6db45a5b4ac8c173b80762ae5f126c24103b5474039082589051bfbc60 macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:30049a8decddc2cbba0b28af61c22c6567095acbe4f42209235b7f790442bf22
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:707a38b54b46b1a7333b62a1943cdf04c8e03c4fbafc964e3a22684c9fa11d3e
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:8d9475cc2efc77845978dff3b2911d0a71ca1a58085b4cc75a0bde4eb60174a4
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:0909da492f90b6c110f8bee83f2f0ffc10ec94513b8f100a5e93200cc94badaa
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:f1329ca0db6f2421048667cdf3b8812afc09e6773b84bd7fe24bb8d3fb972b3b
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:2478849264307489ae484c9441323bbec136703434b6e18e2104b20e3cc0f7ec
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:1b88e1036f09447008f2fc0d1ebe0a02e80e1a87bdfa76fce04f17e7bfb77bbf
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:0208ea8b86d409390b698706c6a3834024f6b76958a362b5941b74c453711dae
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:2e39f5126f6840ebfb9f9c8c59d661df57385edb270daa85e01cb7d242617f3c
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:25380d5a9a5c156cb2af21cfeae968bdc9d03d267046053101a15d9d4bfb309b
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:5b0cbe914807346e90a68e7df720426b485c9e826b527dbb15670827d4289a0d
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:118ce74ecf4b3a08760baa2918471061c4b5f29c1abd2405274f86a555e0dc5b
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:09b23f9d2acdfb0efd48cdc70fd9da131b73690276db9c91bbe8fb9a1b080e94
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:6474f973a8b0c228e510f8133fd1729aeb5692e544e83a10d9cd623dab89b1f4
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:09eb9fd2d399250529283d85c84d07956f45ce9e4b936e4a745dfadf6d817ebf
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:486d6a5c6e1321e77b8be3ba79750d58f246acf1b6f985f9e6a31d3d69d7614a
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:1afa3c43f841365fcb8922252699f9f7140d2ac0c36d94688936391c98296df1
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:2f67c0c911846347423d2652a30e386fc0235e768ea90f5bf0f076474e2f33d4
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:276591dd49fa339d613edc348fe97cb2f86477c37897a4c4034aa4f3161c84aa
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:4db34538477dde07a5fe8d4234f71cee6d10d59abeff116db93655b299674cb6
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

---

This discussion was created from the release Fluxheim 1.7.3.