Fluxheim 1.7.9

[eldryoth]

Fluxheim 1.7.9 Release Notes

Fluxheim 1.7.9 is the documentation and runnable-example parity release for
operators translating common F5 iRules, nginx Lua/OpenResty, HAProxy Lua/SPOE,
and VCL-style policy jobs into Fluxheim's typed WebAssembly policy ABI. It
provides capability mappings, not syntax or runtime compatibility with those
products.

Added

• Add a checked-in F5 iRules-style route access policy and complete config
  fixture using Fluxheim's typed access-decision ABI.
• Add real listener coverage proving public requests reach origin, attached
  admin requests are denied before origin dispatch, and plugin traps fail
  closed.
• Add scripts/smoke_wasm_policy_examples.sh to scripts/test_starter.py and
  the opt-in Wasm release gate.
• Add a checked-in nginx Lua/OpenResty-style header policy and complete config
  fixture. Live coverage proves the allow-listed origin request mutation,
  client response mutation, upstream-header removal, and fail-closed rejection
  of unknown mutation IDs.
• Add a checked-in HAProxy Lua/SPOE-style route policy and complete config
  fixture. Live coverage proves symbolic canary/mirror selection, unavailable
  branch rejection, selected-route policy enforcement, native load balancing,
  and managed-cookie persistence without exposing backend addresses.
• Promote the existing cache lookup/store WAT pair to the validated VCL-like
  parity example. The live smoke now proves pass, MISS/HIT, bounded variants,
  image-only TTL/tag/header metadata, expiry, tag purge, non-image isolation,
  and fail-closed invalid mutations.
• Add a deterministic policy builder that emits deployable .wasm files and
  SHA256SUMS under target/wasm-policy-examples/.
• Add one complete Wasm smoke shared by scripts/test_starter.py and the
  opt-in stable/deep release gate, fixing the launcher's previous multi-script
  command wiring.
• Add a standalone binary smoke using generated modules, exact digest pins, a
  private plugin root, file-based configuration, two local origins, and real
  HTTP traffic through every migration family.

Fixed

• Stop attempting to initialize the native disk-cache backend for memory-only
  cache policies, avoiding an incorrect missing-path error at startup.

Security

• ACME certificate installation now retains the exact trusted storage-boundary
  descriptor and reconciles every managed descendant to the selected UID/GID
  through descriptor-relative, no-symlink traversal. Restart repairs
  intermediate 0700 root:root directories left by an interrupted root-run
  handoff, while outside-boundary targets fail before mutation. Linux also
  enforces openat2(RESOLVE_NO_XDEV) and other Unix platforms reject device-ID
  changes before ownership mutation, preventing reconciliation through nested
  mount points. The bind-mount regression is explicitly ignored in
  ordinary Rust runs and executed by CI and the deep release gate through a
  dedicated smoke using root-mapped user and private mount namespaces, without
  a privileged container. Hosts that disable user namespaces use a
  digest-pinned, network-isolated, read-only container with every capability
  dropped except the mount operation's required SYS_ADMIN capability. The
  regression requires the precise EXDEV result from Linux RESOLVE_NO_XDEV
  using the namespace's mapped identity, so a later ownership error cannot
  produce a false pass.

• Managed ACME account generation now creates P-256 material in zeroizing
  RustCrypto secret/document types before importing it into Ring and retaining
  the durable copy in sanitization::SecretVec, removing the transient
  non-zeroizing Ring PKCS#8 document.

• Open private snapshot files with platform no-follow semantics before
  validating type and permissions from the opened descriptor. This removes a
  check-then-open race while retaining fail-closed symlink handling.

• Use the snapshot store's atomic writer and descriptor-based permission
  changes for corruption fixtures, keeping negative security tests realistic
  without normalizing raw path mutation patterns.

• Use one no-follow parent-directory descriptor for Unix snapshot publication,
  with descriptor-relative temporary creation, create-new linking, replacement,
  cleanup, metadata checks, and directory synchronization. This prevents
  parent replacement from redirecting an in-progress atomic write.

Compatibility Boundary

• The migration examples use Fluxheim's typed, bounded policy ABI; they do not
  execute iRules, Lua, SPOE, or VCL source directly.
• Every example remains bounded by configured symbolic IDs and denies arbitrary
  filesystem, network, secret, request-body, and cache-object access.

Checksums And Signatures

• Commit: e519f61f7bf0df139933cc2831f6917be040d8d5
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • 1dfdbb19535b18aecc50e37afe7fd33509a2b4734b1d5468b0368afb08254eef fluxheim-1.7.9.tar.gz
  • 16339d6794bf0a5d3832e2e509e2f61558c81fed36d34d20f64150b6af421354 fluxheim-1.7.9.zip
• Binary checksums:
  • x86_64:
    • bfc1553d98cb019a5391f6d3f5234134c9e2040c76698acf73d1e430350a64bc fluxheim-1.7.9-full-x86_64-linux.tar.gz
    • 0940e0bb095182d56b1258e9ce55487dc07d2a94aae6c7ba89570c34cd270662 fluxheim-1.7.9-cache-x86_64-linux.tar.gz
    • 10ea8f355c3126c4bb0b9a660fd7677b449d14eb096e72114ee82c27b76ac5b5 fluxheim-1.7.9-proxy-x86_64-linux.tar.gz
    • 5369cde5b9077e42fcd0c676ff69b25167080e3735bce37e673790898a0c47f0 fluxheim-1.7.9-php-x86_64-linux.tar.gz
    • cccf9f6106044546daa915f10af4f82abca579c9a3671826ae870afd05c1c018 fluxheim-1.7.9-load-balancer-x86_64-linux.tar.gz
    • e8cb7e5dcc1a8f07dd58e6b8eeb3b00ca56605aaf978eab892ebb2c4602d8716 fluxheim-1.7.9-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • 8bf812c771ba17652830b51e52c45f7bee56471f83e2993a9f055d555bb0c997 fluxheim-1.7.9-full-aarch64-linux.tar.gz
    • ef4be1c37e1d3ac302666724fe4121d25ad1d41907571da17a1dfbae75e3f47f fluxheim-1.7.9-cache-aarch64-linux.tar.gz
    • 03c51decace5fbb84378505bf2683cb1b373a8bb3d1696ebcc0a33941f184751 fluxheim-1.7.9-proxy-aarch64-linux.tar.gz
    • b0af61c8b40253a0c7b32f3bae5bcee179bda022e6852b95c5a331329bda9b5a fluxheim-1.7.9-php-aarch64-linux.tar.gz
    • 52bc13f5974fdd5019cf4fb34c04dbfe74725ec97a40351dfd45c5a5418e42a0 fluxheim-1.7.9-load-balancer-aarch64-linux.tar.gz
    • 33a4db9b8ceffc80e37636814886729c2ff3d6d28e6e30ec3013cba7bb211ad0 fluxheim-1.7.9-config-tester-aarch64-linux.tar.gz
  • macos:
    • f04427e1ea8c72a8fcc6c86610e68c547c5d195f14e395ed052d5cc2155cecba fluxheim-1.7.9-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • e828a1b78d9e88504c63bdabd424d7d59662addf9c26f26fea38f63de46fdb06 fluxheim.spdx.json
  • ca9b4f5434af58bd1bbf26ae431ca890cdb0945207c579d77c04d1c963c9f37f fluxheim.cyclonedx.json
• Reproducible build:
  • 5f162d370d7e838111e28e2521daa5d2172eb2ddd0adb73e354420f3a473a2fc x86_64
  • 4ab04d472433f057f131451fe0e25c67e86795f69ab40b30dfeb1f71e11f7615 aarch64
  • 4fde8e05dd1d6afa822864e94de7d5b79a6deb14ee108c3edb7f752672bb66f1 macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:04367b7d87273dd5cdbf55ad25b00733cbb1f8f044fe3c25a0159aa13c18a1f6
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:2df48353f7abc17f95595e27f12c585e51d4b46b65cc952a72da740e9025b9fb
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:a27c44c696061d9a663f0188c090b68c93369a375a0648d01788a454b2f1e9c0
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:64f8b7a68ca7a7e9a37f120ab6a4a03fc8aebc9e643340b8b949edc24b98433b
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:1abba7e7de90316daa6841e7e8227eb5938297b132dade100ac62eeb05f31376
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:af9b18de1435fffb0ba44b549d7ed11149d4abe3a097c0f53a56b7196ba3caaa
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:3404c189198cd886bc96f03b124abdc7c23e0a9d3cbd2685d2cd2bf4b6dc6bc5
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:33cf42f29b659ac85b1bf45164353aae5b6545eeed75d519b38349e4cbb7435b
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:073a6657ab2cf4565e42e53ac49535ad8d0b70a2866703f0604b7cd7427cd7e0
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:2b11fa9ada18406a3ebba7a92c06559a6186bf9404243bd5f5338faf59c0463e
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:6599273d86a47bbb31b2c44fc7120d1930ab10dc45fc6ee3b2c0312940401e99
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:a02062b5e8e7b8b2b99b61954ea96360e7e8ee7837f3b1e57011077d75c58f45
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:2f9c2c2987720a3e0b1f664f167db6ac8d159bb1bcf8cfdf738e491116ce8b94
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:49c3db68bf39714740cdd58fc82439c1afefdbe64906390c80a5355d2b528216
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:16b99092b64111631933f7399bf186483cd5fb303e097fc75b46e79dd28ca523
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:303514a229d2fe90019749fff52d01142a046205380168b03a4c1ccf4c86c7c2
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:5225aea52c588afedb2b941470956b93e42f6795c4e39d8b3aaeb1c1d6d92aaa
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:0f8d2cf891e1701017c675c6ecf1f1d1ee3d6c9733763e44b3a2240e8a04f7ed
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:70495df79b2d183fd3f2c3ab68ccec1f6dafdbe4a3023cd18ffa9fef0dfe2055
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:3b6531548e9ef5c6807ceaa3cda3fda3c81bf96fa9a0e42a4ba209ceaf949cc2
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

---

This discussion was created from the release Fluxheim 1.7.9.