Fluxheim 1.7.6

[eldryoth]

Fluxheim 1.7.6 Release Notes

Fluxheim 1.7.6 starts the mature WebAssembly runtime hardening pass after the
initial live hook families landed in 1.7.1 through 1.7.5.

Wasm Runtime Hardening

• Compiled WebAssembly modules now carry an explicit cache identity made from
  the plugin SHA-256 digest, manifest ABI version, native hook feature surface,
  and Fluxheim crate version.
• The native HTTP/1 hook registry compiles plugins through manifest-derived
  identities, so future module reuse cannot silently cross ABI, feature, or
  release boundaries.
• The runtime compile API now has regression coverage proving a supplied
  compiled-module identity from one plugin cannot be accepted for another
  plugin's bytes.
• Cache-lookup and cache-store Wasm hooks now acquire a derived per-vhost
  admission budget under the process-wide cache-hook budget, so one vhost
  cannot starve cache hook execution for another vhost.
• Prometheus Wasm plugin metrics now preserve bounded labels for every current
  hook family, including route selection, cache lookup pass/bypass, cache-store
  skip/deny, and the cache-specific global and per-vhost admission scopes.
• Authenticated admin status now reports both the general Wasm process-wide
  admission budget and the separate cache-policy process-wide admission budget.

Test Coverage

• Add runtime tests proving ABI and feature-surface changes produce distinct
  compiled-module identities for the same plugin bytes.
• Add runtime coverage for digest-mismatch rejection before module compilation
  can be accepted under the wrong identity.
• Add live native HTTP/1 coverage proving a saturated cache hook on one vhost
  does not block cache hook execution on another vhost.
• Extend metrics and admin-status tests for the mature hook-family visibility
  fields added in this release.
• Add a live native HTTP/1 cross-family chain regression test that exercises
  access-decision, request-header mutation, route-decision branch selection,
  cache-key mutation, cache-store metadata, cached HIT behavior, and
  response-header mutation in one request flow.
• Add reload classification regressions for Wasm plugin digest changes and
  attachment phase changes so module/hash and hook-chain updates remain
  process-upgrade events.

Checksums And Signatures

• Commit: c231d0ba594069e8344cf874c477aecc53c31c8d
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • c94b429c07259e8cde0657603dc408e94090509ff7c7d0ed7536095e69a82c49 fluxheim-1.7.6.tar.gz
  • 03d363b71af3454af89149425afe17950196f6843c833e4197e2a0b6f6f9cdbd fluxheim-1.7.6.zip
• Binary checksums:
  • x86_64:
    • ba4034ad0465467c47e5fc1dfb5268ab52790401550aa1ba3b1feb5d229e7fb5 fluxheim-1.7.6-full-x86_64-linux.tar.gz
    • eaff8b4edd4722a35be7f331387caa131bdc1c019ddeeb5eb71260ca7c263dcf fluxheim-1.7.6-cache-x86_64-linux.tar.gz
    • aadb9a9395c6c520bdf5a3cac3d7c7aa40adb8de15fa05592fb20c6468a93209 fluxheim-1.7.6-proxy-x86_64-linux.tar.gz
    • a7e37c42511a04ebd4dac10740d8cc259bd9b2f712675abe911c0d78e7e88181 fluxheim-1.7.6-php-x86_64-linux.tar.gz
    • 4aa9be2ce7210746bcfe329291d68dd0001b0e7e3d342845949405a7b5a6d4db fluxheim-1.7.6-load-balancer-x86_64-linux.tar.gz
    • 6beceee3d220867007ee95ec2f7f40e6bae413283aa0eccefa938de96e712505 fluxheim-1.7.6-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • 0465cf84d6cb458c71c4feeffc5817e18906618bfeeb41e890220e4342729bde fluxheim-1.7.6-full-aarch64-linux.tar.gz
    • cda18da6022f865a43a28513b7b85bb4649f71d6bf7cdfc2874e06e03f9f9d3d fluxheim-1.7.6-cache-aarch64-linux.tar.gz
    • b5f7277af6c5d91291d2a83a1246d99182a84988bd3d858b0988f94c46b03ef7 fluxheim-1.7.6-proxy-aarch64-linux.tar.gz
    • c659872adffce902dc509a60bbccf1cbca9283a825a08f5652887cd62b4bac91 fluxheim-1.7.6-php-aarch64-linux.tar.gz
    • 825e9e70b9e7e4f9f4ebd8706768f195eed301b4eadca2d6045b8700f5b1765b fluxheim-1.7.6-load-balancer-aarch64-linux.tar.gz
    • 790ec7e1e8a9e0c364d2fec5d42ea399f4e06a6dbbc4a4b5df3716a64ddbc3f8 fluxheim-1.7.6-config-tester-aarch64-linux.tar.gz
  • macos:
    • f0ccf2aaab50775c0f190f80972524bc045037523cb443ebda2c67b16535b908 fluxheim-1.7.6-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • ac35ec4409927685e4cae635bcca524c9736d9a52b276f72787a9ab71dd6ea80 fluxheim.spdx.json
  • d456b9b6f5b844ed4eee13245544b4915ec4923a95643629b4dc189be8803cd3 fluxheim.cyclonedx.json
• Reproducible build:
  • 854523f27160e547093f5730eff3c15975fc2777a2f0410d6904cea3d501c2a8 x86_64
  • 877526f4c8aabe5f302658790de493710e60da34a3175281115db79aaa75937c aarch64
  • 3d1a69e5c99354e04e4f9dde5bd5fad0f3f79a89c026da8fa5a95f645bc82ded macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:462b98287a0eb0e405cd302b818c5bab0507e18845191eb0abe3732bfd953477
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:73fa2fac2aeafb9b6c526947feadbc593f64cad8d7e8cda151e251e7ddb1d264
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:1b9f669cc292bc603f469bcf5f2bb1151e998f7c1e16cb8efbd8a65eaed95e4f
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:42c6bb83a9221d5a9197ae7650c6c9746b9f042ebb1d153b8a6b8d4a965e73f8
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:516e1b6a845fad44abd7adcb0e55ea4e4aff84fe5ba1f4f9f414274b8fae5b81
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:15499cba800245ee55f3539cbe8a284c46b111209d7fb977b4878eb3c78765ae
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:7b83328c5b2bcb904a185ef52ecaf33e3a54ab5c0b7a2b9902fa01e756c26252
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:0dac5e12c5f77ef2e90e0cb9ebfe40d6e7d21b88226eb50761ebefee0de7668a
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:b4c53ff4fa77edd3ceb205794bceda9555c87c6d317e5ef3f12b48de5e13bcac
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:06b16018d2136d40fb38ae2d2fbdded43b806b8a11672dd1816a398bd8657a4b
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:83f47565b19863884df0842d32f0564f32f917ed8ad2be684414e5d410ebf411
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:96b321626f2356326daefb3d9394c0dbc382be8f66379b175201ea9d0bed21aa
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:65a3f46bcd7981319c8e38a1cf53e5b4fdd4ea745ca994682532d805e52f2d9d
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:617c59eeb6252d39bd7af50a701d78e5242c8bcf17755469887e954675c33288
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:380c4dd0cf9477265fca8e5cd63f96230b79dd4da9be065d45b8f02f55b3161d
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:888798aec2a6dd514c42821e149b4f279108164206c46f3c67d7400e12aed167
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:5f9140cf1dcff8a6f74d7bbad2fe16cf854bfb88c1fc7b73beabdcb643923a9d
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:132c7659712399a2bd435e8b70560e7cbd43856202ecfca9e5abb293220797aa
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:4a6dafe13049dc769504981026df8a733445349c7fb93e9d0e43784c49f2bd0a
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:243d9ae5e71d603d62c22dc6682afb287c6bc9ad7574626a503cb57c5c718184
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

---

This discussion was created from the release Fluxheim 1.7.6.