Fluxheim 1.8.0

[eldryoth]

Fluxheim 1.8.0 Release Notes

Fluxheim 1.8.0 packages the completed Wasm extensibility line as an explicit
distribution profile and begins a shared portable archive contract for Linux,
macOS, and Windows.

Wasm Distribution Profile

• Add profile-wasm as profile-full plus the reviewed proxy-ABI and WASI
  capability surfaces.
• Keep profile-full and the unsuffixed full container image Wasm-free.
• Add dedicated wasm container-image and binary-archive profiles with ACME,
  metrics, and OpenTelemetry support matching the full production package.
• Require an explicit read-only plugin mount such as
  /srv/infra/fluxheim/plugins:/etc/fluxheim/plugins:ro,Z; no operator plugin
  is embedded in the image.
• Document that container read-only mounts do not protect their host source,
  require hash pinning for every production module, and recommend
  digest-pinned derivative images containing reviewed modules for
  high-assurance deployments.

Portable Archives

• Generate .tar.gz and .zip from the same staged release directory.
• Add per-profile archive selection so the Wasm artifact can be built and
  tested independently.
• Preserve a common archive naming and content contract as the basis for
  unsigned macOS and Windows portable releases.
• Validate the same seven public profile names, Cargo feature sets, and binary
  layout across Linux, macOS, and Windows, including .exe naming on Windows.
• Generate and validate the archive matrix through one native Python planner
  consumed by the POSIX asset builder, avoiding WSL-versus-Git-Bash command
  resolution on Windows, and use portable package-version extraction in both
  native archive jobs.
• Build representative full and wasm archives on native macOS CI while
  keeping Windows at archive-plan and fail-closed config-boundary validation
  until native runtime and archive work begins in 1.8.2.
• Compile Windows configuration and admin-socket planning without relying on
  Unix-only symbols, while keeping configuration-file loading fail-closed
  until Windows owner and ACL trust checks are implemented in 1.8.2.
• Fix the release helper's --profile all state handling so one completed
  profile cannot suppress the remaining six archives.
• Keep signed/notarized macOS packages and Authenticode/MSI/MSIX delivery
  deferred until company-backed publisher credentials exist.

Verification

• Validate that profile-full cannot accidentally enable Wasm.
• Validate that the image and archive matrices retain the dedicated Wasm
  profile.
• Extract the Wasm release tarball and run the real F5 iRules-style,
  nginx/OpenResty-style, HAProxy Lua/SPOE-style, and VCL-like cache-policy
  examples through the packaged binary.
• Build the dedicated Wasm Wolfi image, mount a hash-pinned policy module
  read-only at /etc/fluxheim/plugins, prove writes fail inside the container,
  and exercise live allow/deny decisions.
• Prove configured request-header variance partitions fixed-slice cache objects
  and reject response-only slice variance that cannot be known at lookup time.
• Prove a concurrent 32-request burst for one missing range slice produces one
  origin fetch when cache locking is enabled.
• Prove ordinary and fixed-slice cache-fill waiters cannot miss a fast writer
  notification and receive a bounded retryable 503 after one total wait
  deadline without creating another origin request.
• Bound runtime and inspection Vary keys to one SHA-256 component regardless of
  permitted request-header value length.
• Prove non-cache Wasm admission is partitioned per vhost beneath the native and
  preview process-wide ceilings, matching the existing cache-hook isolation.
• Run a native Windows regression proving unsupported filesystem ownership and
  ACL trust checks return an error rather than silently accepting a config
  path.
• Keep Unix descriptor-relative cache storage out of Windows profile builds
  until the native Windows filesystem implementation is reviewed in 1.8.2.
• Compile and test the full workspace against sanitization 2.0, including
  request-body clearing, TLS and ACME secret input handling, snapshot
  integrity, administrative authentication, and persistence-cookie checks.
• Build RPM evidence from the exact release-candidate tree instead of remote
  main, and tag both FIPS backend evidence images with the candidate package
  version.

Security Notes

• Record the ACME provider's opaque active signing-key representation as an
  accepted upstream residual. Fluxheim clears its transient PKCS#8 copies but
  does not claim provider-owned key-state zeroization.
• Apply the existing per-key cache-fill gate to fixed range slices, preventing
  same-slice origin stampedes.
• Register cache-fill notifications before releasing shared state, and enforce
  one total waiter deadline across ordinary and fixed-slice fills.
• Tune cache-lock waits above normal upper-tail origin latency but below
  surrounding request deadlines, with age_timeout_secs no shorter than the
  intended waiter budget.
• Replace variable-width encoded Vary material in cache keys with a fixed-width
  SHA-256 digest. Persisted variants using the prior key format become cold and
  age out or can be purged.

Checksums And Signatures

• Commit: c742f04806881baaf2ace05a29f0b37274c4893f
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • 0a8a3cbcfa50a59106915d2e8c9b3515b50d7fbc18a2af1aecbd94e609fd151f fluxheim-1.8.0.tar.gz
  • 3f85ac8cbe705d6837c129d63aad4bd546dde856f1718a17e5333aafa0d7d984 fluxheim-1.8.0.zip
• Binary checksums:
  • x86_64:
    • 28adc45a0bb0ef927553ccff642a0c90fb33413f0284f0394f802fa6b8dfaed3 fluxheim-1.8.0-full-x86_64-linux.tar.gz
    • c2d05bd1773cf3a91fc181751031727d6139a0397dc73ac96e9925e1035b0cbf fluxheim-1.8.0-wasm-x86_64-linux.tar.gz
    • 7ce9cddf7f928e7cc0964f7042da588a0bc72a8a5df9471913ddea17633c4125 fluxheim-1.8.0-cache-x86_64-linux.tar.gz
    • 43751d81060cc64fe74c7c00bce60bfa07fe03bed974eb042e5ccc46ed2698b3 fluxheim-1.8.0-proxy-x86_64-linux.tar.gz
    • f5ff81d82dfa18b202a802ef9690f3ceab73f74c11dd10b0226cb8e8c065294f fluxheim-1.8.0-php-x86_64-linux.tar.gz
    • d2760f90ee88b8694d0cbf77b0672ca1e8168eb3f413479e295f6317a843d514 fluxheim-1.8.0-load-balancer-x86_64-linux.tar.gz
    • 1017ac8aa1d60d3292911be14a03dd64dba41c54677733c77bc46a1e1021e048 fluxheim-1.8.0-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • 4187ff089c8eae80e8d69d0c6192d3cccb8d942a1be840120b668dbbdeaf5873 fluxheim-1.8.0-full-aarch64-linux.tar.gz
    • af42bb7b65b8539832834d013c5f004decd42351efbb3f2501afb1df42e7938f fluxheim-1.8.0-wasm-aarch64-linux.tar.gz
    • d876729ea999f43aa97d55707242f1c801123245159339e626cd82bbe93d3674 fluxheim-1.8.0-cache-aarch64-linux.tar.gz
    • 57da93d2aed30e97c7fef9b6709ce85f104b611fce5c173afcbb6531986bd8dd fluxheim-1.8.0-proxy-aarch64-linux.tar.gz
    • 304e32569e9865135deea72531e91a7b69124971ad054e2804fb0d318a9f067c fluxheim-1.8.0-php-aarch64-linux.tar.gz
    • 284d4c6aeeed79d730bf2e5c240bda4cb573940a415f885692ec4ed3116bed14 fluxheim-1.8.0-load-balancer-aarch64-linux.tar.gz
    • 16572c27ef0c4f0f66b10efa9022472cbd9445a489a2e49a617b889623cf6962 fluxheim-1.8.0-config-tester-aarch64-linux.tar.gz
  • macos:
    • 4d79f18ad545f809d6298c3695dc404b9a6ef405627ed5d10b28915698bcd34c fluxheim-1.8.0-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • 491d4938bb89f0f6e49ce71a4f3cb0be64b3125ab0f4f9b1177fb988e1654d4c fluxheim.spdx.json
  • 64e2fa96894d861c1f66c35f081a37229ae3a9d25f1ce68bacd510684ae2d6ff fluxheim.cyclonedx.json
• Reproducible build:
  • 2d5008e33460f650fc94bd76b1049d8e75c2be83a02dfe11ca7f0acc0e7a2a55 x86_64
  • ffe2aa0ab406a3144d4bc5a10cd19db1de195de8660012b634ddcdf3edb3a1a8 aarch64
  • 06e93ec6d8824823a30173e5161bb580f0210d5ea17f199e45593cb7748c1ef5 macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:a682e09cbbd1b740b7347189e0d2b99e2706d8c654fa265e5929948e349cca05
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:2693e0a0224ddc907eb9bdad60b426a6a1451e9dfdfe53c0a11fd48087c160f9
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:3d6ebafbad12766cab4429317c9826804c60622a23f89aafeb234068ac32b03f
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:a975e3fa0d5feefb3e711bcf4f9aa4048cba19aa62a09a5864603dbf7cee9adb
• Wasm Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:c42e29dc265c98cd8709968892ded0a00ddf9e45fe9db999d8d1bfd3726a4d1f
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:72fcb5c907b8febe8ac75e04a21ffe709e3c884560f77c86bb4283d1de678a67
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:36ba40df614c7ce15e073556691d07d27622281b02fff1731b1541fe0b1536f7
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:03f77de74c7547453877caff5d39c9727e7421048837e544808bbba22b0b6b63
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:08854c36ef96a79751cf1837c7d74610669bc97152e856fbc7e0d2032e312928
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:18166639730ac7f1862ad3a85ed29281809cbed6af7757aa4dc3d7c537b12299
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:2be9539d6c6259764b610b6783e2d6b0a27b660fdfd2a573a3963df86e0d9809
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:b6c475405479707765b495127c7fe52ab8f508565c2528cff1fe434b0be80a9b
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:69d751d9102c34205c94443859014252a2af0df07b520e8836b59a5657cd1ac8
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:2292091dcd9153c38747d26c7a9f1b0d46d6584c954fd7da9b89efa8eae1cef8
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:76fd4c96bd2a881a08b01f131c31cbcc0662e0b7c3be73bd3ad150fd99ec5b14
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:09a6510fb1efae52e267288fe81701acdadfa08b0940aab0b60973a7f1bc05bb
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:0261b9c11d826ba44cb0b90b67af9838df06c31726b5fc7a55ed5cfd0e05c8dc
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:0d0083d2f01fc54d96d6004ff84bfca855e8d34912101f9e0e2a95b5d113496e
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:64d9ca2e706e066543b018abb73ab212c774e2ad53ee557f0d8bf60923b8037e
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:1f2683196479b972e599248cea7ea32e19ea3ac0459be1b4963ca1a4fc1f44e5
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:47c7085e04d622b292fd21c6479d7c5c50d87275b69a12623bd7c768f47c9a49
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:37f54a81fc3f22e8fb2553d425673f5d73f8fa6133a264542c7e9fe66152c653
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:485e1c65bb611aa7292ce363d6ba58d2281b8baa85e1eddde9f9864e9ad8ddf4
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:ec1b6ce58871f221a02851a2fb646ce3e66337251aa45a58e6091e2e6c5fae57
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

---

This discussion was created from the release Fluxheim 1.8.0.