Fluxheim 1.7.5

[eldryoth]

Fluxheim 1.7.5 Release Notes

Fluxheim 1.7.5 continues the VCL-like WebAssembly cache-policy milestone with
the first bounded cache-key and cache-store metadata hooks. The new host-call
surface is intentionally low-cardinality: plugins can add a symbolic
device-class cache variant, choose fixed TTL/tag metadata, and set one fixed
stored-object response header, but still cannot emit arbitrary key bytes or
mutate arbitrary cached response headers.

Highlights

• Add a bounded set_cache_key_component(label_id, value_id) host call for
  cache-lookup Wasm hooks.
• Add symbolic X-Device-Class context under context(5, 0) for cache-policy
  plugins.
• Allow only the fixed wasm-device-class=mobile and
  wasm-device-class=desktop cache-key components in this slice.
• Add bounded set_cache_ttl(ttl_id, 0) and add_cache_tag(tag_id, 0) host
  calls for cache-store Wasm hooks.
• Allow only fixed TTL classes and fixed cache tags in this slice.
• Add bounded set_cache_store_header(name_id, value_id) for cache-store
  hooks, limited to fixed x-fluxheim-cache-policy values.
• Add bounded cache-store response content-type inspection through a symbolic
  context(6, 0) class, without exposing raw response headers.
• Thread Wasm-selected key components through native static-upstream and
  load-balanced proxy cache lookup paths.
• Thread Wasm-selected key components through fixed-slice range-cache keys so
  ranged mobile and desktop variants cannot share slice objects.
• Thread Wasm-selected TTL/tag metadata through native cache storage without
  exposing arbitrary response-header mutation.
• Thread fixed stored response-header metadata into the cached object while
  leaving the immediate origin MISS response unchanged.
• Add live native HTTP/1 listener coverage proving one URL can cache separate
  mobile and desktop variants, then HIT the original variant.
• Add live native HTTP/1 listener coverage proving Wasm-selected key
  components also isolate fixed-slice range-cache objects.
• Add live native HTTP/1 listener coverage proving a plugin TTL override
  expires an otherwise max-age=60 object and refills from origin.
• Add live native HTTP/1 listener coverage proving a plugin can set the fixed
  stored response header on cache HIT and that forbidden header IDs fail
  closed.
• Add negative coverage proving duplicate stored-header mutations fail closed
  and stored-header mutation caps are enforced.
• Add negative coverage for aggregate cache-key component caps, cache-tag caps,
  and TTL singleton merge behavior.
• Add examples/wasm/cache-lookup-policy.wat,
  examples/wasm/cache-store-policy.wat, and a matching config template for
  the bounded cache-policy ABI.
• Add live native HTTP/1 listener tests that compile the checked-in example
  Wasm sources and prove image-only cache-store metadata, cache-key, TTL, and
  stored-header behavior.

Security Notes

• Unknown component IDs, unknown values, duplicate component labels, and
  component counts above the hard cap fail through the plugin fail mode.
• Duplicate cache-key component labels and aggregate component counts are
  enforced across the full cache-lookup hook chain, not only within a single
  plugin invocation.
• Unknown TTL IDs, duplicate TTL overrides, unknown tag IDs, and tag counts
  above the hard cap fail through the plugin fail mode.
• Unknown stored-header IDs, duplicate stored-header mutations, and stored
  header mutation counts above the hard cap fail through the plugin fail mode.
• Cache-store metadata caps are scoped independently to TTL, tag, and stored
  header metadata so one exhausted metadata family cannot silently drop a later
  family.
• Oversized cache-store candidates are rejected before cloning response bodies
  for stored-header metadata mutation.
• Store hooks receive only symbolic content-type classes for response-header
  inspection; raw response header names and values remain unavailable.
• The hook does not expose arbitrary request headers, raw cache-key bytes,
  request bodies, response bodies, filesystem access, network access, or cached
  object contents.
• Built-in access, route, rate-limit, concurrency, header, and cache admission
  controls keep their normal order.

Operator Notes

• This is a preview ABI for controlled cache-key variation. The only accepted
  cache-key label is currently wasm-device-class; the only accepted values
  are mobile and desktop.
• Store TTL, tag, and stored response-header choices are fixed IDs, not
  arbitrary strings. Richer store admission mutation and cache response policy
  hooks remain staged for later 1.7.x slices.

Checksums And Signatures

• Commit: c849e3311d9862e336ddeb1171a19a1c064b568a
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • d3316196c58aa0f01a99e4f9f8ec9fe6c45f5ea76d7b43fb63f2f2320bb0bcf8 fluxheim-1.7.5.tar.gz
  • a928f0c6dd9cfaa227871d487135dae167ab9ce23bbd9d1b0deabb7ef31788a8 fluxheim-1.7.5.zip
• Binary checksums:
  • x86_64:
    • 6275ae5d6542285e15fcf207be68372edd7c8123e3a9d608eae0232b67d52135 fluxheim-1.7.5-full-x86_64-linux.tar.gz
    • d703ce77cec7828eb758188fbbab703843dce91d3762593d9ab1d665fa4f46a5 fluxheim-1.7.5-cache-x86_64-linux.tar.gz
    • 329ca82c825a092c877f92670e65ba5bf2bca969a2c89e31f416fe6774e26b91 fluxheim-1.7.5-proxy-x86_64-linux.tar.gz
    • 87a982cba770134b0334b45beb1ed04ce0fe371c4169bbe380f643c2619c1d05 fluxheim-1.7.5-php-x86_64-linux.tar.gz
    • 99e06ae168e71c277616ebb31c9c1295a5e61cc6e6ee0ce47213476da60dc6b1 fluxheim-1.7.5-load-balancer-x86_64-linux.tar.gz
    • dba07e8f18b8537e667a18056f1ed4bb75681028ad1078a855001d1708e8f376 fluxheim-1.7.5-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • 014e86f4fb850cd69428fa1db73126f33448352d78af906d4cadfb71738b1d79 fluxheim-1.7.5-full-aarch64-linux.tar.gz
    • 1144eb8637e9770e4e8b8ba858ecf07719372e8a4fe9e8ba3f1b82c6f6c53688 fluxheim-1.7.5-cache-aarch64-linux.tar.gz
    • eb177989c3067cdb5e9abc4b0da5cc5f0217b98c4f50ab69787f792db225cb32 fluxheim-1.7.5-proxy-aarch64-linux.tar.gz
    • 02d6c7cbc52f53ba87b5134096739ea25fa3268dc8325106cbf3c4bf167c66e8 fluxheim-1.7.5-php-aarch64-linux.tar.gz
    • 0bceaab3d5897db69b879107d2bc55f1eba1898526d543839a61b56dcc64c606 fluxheim-1.7.5-load-balancer-aarch64-linux.tar.gz
    • 3960a6fde3ffa1f11ce02eb5c7dd081641f2524e61b7aa31be7fbe82a2de36f1 fluxheim-1.7.5-config-tester-aarch64-linux.tar.gz
  • macos:
    • ce34af1384e0936e083c8dc06fc51c962c811b314be94c2edbadadf7767a06ea fluxheim-1.7.5-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • 0c0fb4585b18442ab1df9f814142d8325aa1a3cbfcce6acfe013b97b077aa0d7 fluxheim.spdx.json
  • 788380fb58d94d8738eedb1b82a02da814172fc67a5fa9991ec1e3c4e8d3a258 fluxheim.cyclonedx.json
• Reproducible build:
  • 16056a59918c939fccfe1522b11cb1e8ce4a748ea73222bd4f03f146ca3ea072 x86_64
  • add39ef66006d018dfa76ba4d18f7114e1d7fafaf7c61b906ca6e5b2c8495a8e aarch64
  • ec83da96f971f05914d7bda079577be2f2434f31142412aafce21d3a6b1adbfd macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:39db6caa5b498a68f4455e2f08bba1c109d7f6c6c1c70a3e5ce792bdfcc887ac
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:495ef2913bdfd2c8b0db91101f54cd6e025c7f66f262cd91581d62544b414485
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:0ae64c168a1e5ac435f9922f9db626f4479e6ee1dc3794ab42f33bddcb546e08
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:adb9829ad3c63132ed06b560089ba0703064ab413b7f9aa987ed7f9b47f3bda6
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:22894fbae4dcfc3d0712226eb12a30a8d998792c945f52de8de48070946f5522
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:72c71aaeff9407ec1320de6098ec397fae396e1752649b7cab275d4ca1cf5c42
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:16121cd319cd58155acff3dff193019620c4cd9f14a07bd4a3668b237d8a5a5d
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:ab618b9b41bddcbfe51548d2fe0a91513c871c3ae357898d058c77e1d318a510
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:2f3c2116106612b831ffe85d335b1a3fbfbd7590cbff2361788a5b3dd8627769
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:05d923cac92dd7bf78874a75b6bcceb5e19e5cd34f44ecf74a42b9d89a956e10
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:ce7c41edb4a4dda642573146ac984a5ec5454af31bac94942becac709e34ec91
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:0248a039b063a5095600388abdf6a68af4d769bfef5390a0d492ff7db837f55f
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:a38e17bad99759a05cff5ad3a6aeade67cf912632c1035b4fb7ff12399f0e328
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:4f2dfcc04e2d53738f489590b1d1d61a98aa9409f92c1e024e1b95dd4e3ab851
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:12f2faeadc9c57d45619073bc4d0bbfa502a40b3e8a3c6704ae1871f50a9f28c
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:4487c4d9307b5d7c6cfa9a0965051c853cbb81f24871cc2a7d62a82e74512875
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:4247e06fe5562382e32589aa6e7da22fc3f73054e191b1cddda5ae2ebffcc57e
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:7c1d596a35346fe4cab29c6ac83468e7fe5db0f4149dd3a9a20488feb5c65bde
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:4b8fc026d8500e3fbec5b65dbf2210681d203e28452aef19a16ea5debd4ef97a
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:46f5527a86c369e08597a814da7887f1bedfb91415a0e446e21b486498f4d19a
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

---

This discussion was created from the release Fluxheim 1.7.5.