Fluxheim 1.7.7

[eldryoth]

Fluxheim 1.7.7 Release Notes

Fluxheim 1.7.7 adds the first opt-in wasm-proxy-abi compatibility preview
boundary. This release does not claim that existing arbitrary proxy-wasm
plugins run unchanged. It establishes the safe shape for that work: explicit
ABI and host-call namespace validation, feature-gated config acceptance, and
deterministic unsupported-call rejection.

Added

• Add wasm-proxy-abi feature propagation through the root, config, server,
  and fluxheim-wasm crates.
• Add host_call_namespace = "proxy-wasm-preview" support for
  [[wasm.plugins]] entries when paired with abi = "proxy-wasm-preview".
• Add manifest validation that rejects mismatched ABI and host-call namespace
  combinations.
• Add native HTTP/1 proxy-ABI preview host-call stubs that reject unsupported
  calls deterministically instead of silently binding to Fluxheim's native
  policy namespace.
• Reject module imports that are not explicitly bound for the selected
  host-call namespace before Wasm instantiation, with a stable import-specific
  error.
• Add a live native HTTP/1 compatibility fixture using the canonical
  proxy-wasm env.proxy_log(i32, i32, i32) -> i32 import and prove that the
  unsupported call fails closed with 503 before the upstream is reached.

Security

• proxy-wasm-preview host calls remain disabled unless the binary is compiled
  with wasm-proxy-abi and config explicitly sets allow_preview_abi = true.
• Compiled WebAssembly module identities now include the host-call namespace,
  so future compile-cache reuse cannot cross from fluxheim-policy-v1 to
  proxy-wasm-preview.
• Restrict proxy-ABI preview manifests to access-decision, and independently
  prevent native request-header, route, and cache host functions from being
  linked into the preview namespace.
• Enforce [server.host_routing].strict = true for native HTTP/1 Host and
  HTTP/2 authority routing. Missing or invalid identity returns 400; an
  unknown host returns 421 instead of reaching the default tenant.
• Acquire process, cache-vhost, plugin, and attachment Wasm admission before
  spawn_blocking; honor bounded queue_limit waiters and replace per-request
  watchdog threads with one process-wide shared epoch ticker.
• Use Tokio semaphore admission in narrow-to-global order, preventing a
  saturated plugin or attachment from reserving broader process capacity, and
  cap active/queued Wasm budgets at 256.
• Select an installed GCC 13/12/11 compiler pair automatically for release-mode
  rustls/AWS-LC FIPS validation when a rolling distribution's default compiler
  is outside the supported range; explicit compiler selections remain
  authoritative.
• Bound external-auth work before blocking-pool submission with
  max_in_flight = 64 by default and a 256 process-wide ceiling shared by
  all routes. Saturation fails closed with 503.
• Keep source-specific admin lockouts fail closed while allowing correctly
  authenticated operators through a global invalid-attempt lockout.
• Bound persistent storage-bin index files, entry/key counts, cache metadata,
  header counts, and fallible allocations. Decoded local AES cache keys now
  remain in sanitization::SecretBytes<32> through key construction.
• Pin third-party GitHub Actions to reviewed commit SHAs, pin cargo-deny and
  cargo-audit installs, and pin every container builder/runtime base image to
  a reviewed digest.
• Reject duplicate canonical storage-bin roots during native router
  construction and verify persisted object identity before serving, preventing
  cross-policy allocator corruption from becoming cache disclosure.
• Record strict Host/authority routing rejections through the native metrics
  bridge.
• Inspect storage-bin objects only through the registered live cache and hold a
  lifetime-exclusive lock file so separate Fluxheim processes cannot allocate
  the same root concurrently. Standalone CLI inspection retains a bounded
  filesystem-backend index rebuild because that backend has no shared allocator.
• Keep generated managed PHP-FPM Unix socket names compact and reject a final
  socket path that exceeds the platform address limit before spawning PHP-FPM.
• Return explicit 431, 414, or 400 responses for bounded request-head
  parser failures instead of closing the HTTP/1 connection without a response.
• Add one shared 256-slot request-driven blocking-work budget across Wasm,
  external auth, traffic mirrors, disk-cache operations, and ACME challenge
  reads. Explicitly cap Tokio's blocking pool at 384, leaving 128 slots
  outside request admission for operational work.
• Acquire storage-bin ownership before any manifest or data-layout mutation,
  preventing a losing process from modifying first-start metadata.
• Document that storage-bin ownership uses advisory filesystem locking: use a
  per-replica local/RWO volume by default, and require verified cross-node
  flock behavior plus orchestration-level single-writer enforcement before
  using shared RWX storage in high-assurance deployments.
• Partition blocking work by class under 224 non-critical and 256 total
  ceilings, reserve 32 critical slots, and return 503 rather than contacting
  origin when disk-cache lookup admission is saturated and no stale memory
  object is available.
• Harden the GeoIP runtime boundary: cap fallback databases at eight before
  allocation, admit aggregate descriptor sizes before reading/parsing, decode
  bounded borrowed country strings, require trusted ownership and non-writable
  modes for MMDB files and all parents, and reject files changed during loading.
• Make reload classification fail closed through an explicit snapshot-safe
  allowlist. Client-authentication, compliance, listener trust/limits, stream,
  UDP, ACME, cache-purger, tracing, and other startup-owned changes now require
  process replacement instead of being accepted as snapshot reloads.
• Extend reload ownership into nested vhosts and routes: managed ACME target
  identity/domain changes and managed PHP-FPM pool/process changes require
  process replacement, while ordinary routing and request-time PHP policy stay
  snapshot-safe. Exhaustive vhost, route, and PHP-FPM schema audits prevent new
  nested fields from silently bypassing review.
• Require config sources, split-config directories, and every existing ancestor
  to have trusted ownership and non-writable group/other modes. Verify path and
  descriptor identity and reject config files modified during bounded reads.
• Restore the all-feature config security suite, including tracing/privacy and
  dual-FIPS-backend feature combinations.
• Bound Brotli, gzip, and Zstandard logical output before accepting excess
  encoded bytes, transfer emitted codec buffers into response bytes without
  copying, and permanently discard a codec after an output or allocation
  failure.
• Fail response compression closed for malformed Accept-Encoding fields,
  honor explicit coding rejection over wildcard acceptance, and suppress
  compression for qualified Cache-Control: private="..." responses.
• Perform config ownership, permission, and symlink traversal checks through
  no-follow statat metadata inspection, and remove environment-derived
  filesystem writes from storage-lease subprocess coverage.

Changed

• Update base64-ng to 1.3.7, bytes to 1.12.1, regex to 1.13.0,
  sanitization to 1.2.4, and test-only wat to 1.253.0.
• Update the workspace MSRV, pinned toolchain, and container builders to Rust
  1.97.0.
• Exercise current MariaDB 12.3 LTS, PostgreSQL 18, and Valkey 9.1 container
  lines in the database and health-check smoke defaults.
• Restore the standalone cargo-fuzz workspace and remove its obsolete Pingora
  dependency patch so the checked-in fuzz targets build against their current
  owning crates again. The fuzz validation gate now compiles every target.
• Replace storage-bin request-path full-index sorting, rewriting, and syncing
  with one fallibly-created process-wide persistence worker. Maintain ordered
  eviction state so selecting the oldest object no longer scans the complete
  object map.
• Add fluxheim-base-images.txt to generated release evidence beside SPDX and
  CycloneDX output so reviewed image digests are recorded for each build input.
• Run filesystem-sensitive local release fixtures below private repository-owned
  smoke roots, using a compact root for Unix-socket tests, so the suite exercises
  the same full-ancestor trust policy enforced in production.

Operator Notes

• Existing wasm configs using fluxheim-policy-v1 continue unchanged.
• To test the preview namespace, build with --features wasm-proxy-abi, set
  allow_preview_abi = true, and declare both:

[wasm]
enabled = true
allow_preview_abi = true

[[wasm.plugins]]
name = "proxy_preview"
path = "/etc/fluxheim/plugins/proxy-preview.wasm"
abi = "proxy-wasm-preview"
host_call_namespace = "proxy-wasm-preview"
phases = ["access-decision"]

• The preview namespace is intentionally narrow in this release. Unsupported
  calls fail closed through the plugin fail mode.

Checksums And Signatures

• Commit: f1c2497bca3fcfd9112d08ad65b3bc2aafb2e421
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • 5dbc0fd24140f2a81b52b46d63f09f70c3056c09fc1ec82cfcbd3860a0083f81 fluxheim-1.7.7.tar.gz
  • 40b33aea8811b6091c0fbe3e8e8368bc09843b59758a3c1bd6de2fc2defccbac fluxheim-1.7.7.zip
• Binary checksums:
  • x86_64:
    • a03d30135990810b66cef61d3b401fe65063e5c8ed7d19304c15c9ec690eb35d fluxheim-1.7.7-full-x86_64-linux.tar.gz
    • 9775db4a60895845c436abb9104f9ed53d1d7e987eeaf68b0ba67d2ff2543959 fluxheim-1.7.7-cache-x86_64-linux.tar.gz
    • 99e3e18b4c893cb3adf68ccb5757ffe2425de70a7638f52ed22d3c7e61db747f fluxheim-1.7.7-proxy-x86_64-linux.tar.gz
    • 9e85a4223cdb22d883937563394f27aa3d862bb23ddde5f2ae5ce45cb5de1c86 fluxheim-1.7.7-php-x86_64-linux.tar.gz
    • cdd5d3f732565744fccdce772f9124db06273db70bd9a20729ba6eed9468d083 fluxheim-1.7.7-load-balancer-x86_64-linux.tar.gz
    • 2f167341116e3a08196c9d6bb47014439c8fbcacb36d90af32d15d292475bcc7 fluxheim-1.7.7-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • 871d3f155d71366fd2e3fefbc124ecee4e5af4d065e1fd13f96c616e694e2b89 fluxheim-1.7.7-full-aarch64-linux.tar.gz
    • c6d0144fc24a09c3a95ab4985d37e759d1928ac6940852636661d081c96909c3 fluxheim-1.7.7-cache-aarch64-linux.tar.gz
    • e0a88c9d7a0350f0752a8cd2226aa322e8e4937564acb4fe1aa0412f5ee87dac fluxheim-1.7.7-proxy-aarch64-linux.tar.gz
    • 7ba6a498023d620ee2325165d64df6b33fab78d50935fc049378df69cd6c3bec fluxheim-1.7.7-php-aarch64-linux.tar.gz
    • 860c4bcc84008a1c3d0032afbe5f126c5582a5ae57e55ab635f6e7b397beb954 fluxheim-1.7.7-load-balancer-aarch64-linux.tar.gz
    • 94ee9b0f7308f41b42a542c20f9f58a177588c8a2c7e958ff61e9c3548e2c316 fluxheim-1.7.7-config-tester-aarch64-linux.tar.gz
  • macos:
    • 3a20a9712b836ce34b4e944b997a3f4cd40896ed087587644cda3d1124e5f0ef fluxheim-1.7.7-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • 3e4cc3ee37193046c303a2d73607ce7dbb1883a777cec1cd92f2068905e75658 fluxheim.spdx.json
  • 81924680a6a3fef7149092ca8a4784f320a0ec2915133a9ace2dd8c4a77c0df2 fluxheim.cyclonedx.json
• Reproducible build:
  • ed33bac10f18841319f6a58c9e3be70cf762d304bd3d2361b3d9dd54f308d680 x86_64
  • 9bd52b28fd3006209db091e68119b0f591e211a1dca7471dadc4343d478bb1a2 aarch64
  • e9ecd72d77fba07de0107afb32aaf5234e15d85929619332a9ae8b211da7f10c macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:14c6bc7f77b988685818b6e63135d6187c244a33208888c24bf6fd557f7cb682
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:27dcb205b3d5ffd188ecd907708ca4c16f416c6429e22e529a741831043b65da
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:353e3903b2f456079035827417a3cb8500679d6440a6fa012003073d81d25ab7
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:f85092f1ebe7904c96c77a95d8755feddf5c228fb9ba1bf4f4ad4c969a16aeb0
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:282d1002f856101cfef8d8b9bd2326a5a47ea3b3ecc0d46b1cf8a3805ceceaa2
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:8961896aa1f0039c3b300ad0a5b3481abea669f482c0a3105222dfaed44e6d32
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:35bfbf10aa16eae80f419e14bb0424cbf4803b57db4421773dc50831322d4d12
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:6bba1414f498f6c93a009a443c12e231a0fc3d52cb80f176bfbcbe36c2946ff5
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:348aceaa93b612df860f27fb6fe88c687a5bc03f78c973a71ef84485854b26eb
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:0037f2e7a46c66326ae1e5e28f458c394e19ea76f2a2f3958f6cbd01c1446b47
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:6fadde927f83af80bd420a8b756c43d5c7a61a85d20a2363797fd08a74e288bd
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:79ab7bc774e868686f0aa4796b4793482cb4719a0cf8d2dc9ba87da85c42cb4e
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:c9055e3cfb2311ac19f14218815c06fa304a8a27e6ebcd50341ea6e8300bb9d9
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:16010cafdb92248012f032efd1a075c7f4d724f9411cd50c2c097abadfa6d348
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:05e0fc5e2700255809dc48567b65b60e759ef74cbc47ad24b4c32c5546cfb142
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:a411ecc767a518022252c53c2c47da7020624082bfd999d8ca188c1692e65235
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:1e73487f6d4d4d784174f2403c44783968e9bf8097a8b19b17a5da26e7f204be
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:217613ed61d96a42828604b02b8990c56fed9e06ac4479b7b2cba42f113e206d
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:754c1a520325a437de7124b714c42072701e5b8cf8ecc2f921ed5d14c8a280d0
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:44549f5abb9aec58cffdceab411c758db94cc495c2c0a398cce6707b9036ccf8
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

---

This discussion was created from the release Fluxheim 1.7.7.