Fluxheim 1.6.3

[eldryoth]

Fluxheim 1.6.3 Release Notes

Fluxheim 1.6.3 continues the Pingora-exit line by moving TCP stream proxy
runtime logic into a dedicated fluxheim-stream crate. Operator-visible stream
route behavior is intended to remain unchanged; this release narrows the root
Pingora-adjacent adapter to service lifecycle, socket accept/connect, and TLS
connector wiring.

Changed

• Added the internal fluxheim-stream crate for TCP stream proxy runtime
  policy and protocol helpers.
• Moved stream upstream selection, weighted primary selection, backup/drain
  ordering, and selected-upstream labels into fluxheim-stream.
• Moved stream source allow/deny matching and route-local trusted PROXY source
  parsing into fluxheim-stream.
• Moved stream DNS-rebinding guard decisions, copied-byte accounting, idle
  copy-loop timeouts, and max-connection-byte enforcement into
  fluxheim-stream.
• Moved downstream PROXY protocol v1/v2 parsing and upstream PROXY protocol
  header writing into fluxheim-stream, reusing the existing
  fluxheim-protocol header builders so HTTP and stream PROXY behavior stays
  byte-compatible.
• Kept the current root stream adapter as the Pingora service-registration
  boundary until the 1.6.4 background-runtime and later server-bootstrap
  cutovers.
• Updated workspace crate versions, RPM metadata, README image examples, build
  documentation, changelog, and release notes to 1.6.3.

Tests

• Added direct fluxheim-stream unit coverage for stream source matching,
  upstream selection, DNS-rebinding guards, byte-limit accounting, and PROXY
  protocol parsing.
• Preserved root stream-proxy runtime tests for bidirectional copy behavior,
  connection byte limits, idle/lifetime timeouts, upstream PROXY protocol
  forwarding, and explicit IP-literal upstream resolution.

Checksums And Signatures

• Commit: 153f64bdbe8057501b0741f311d7cc69472b3e72
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • b08c3581da78d21b1a08f5468d949cf0d022bb6aaed7c1201a386e110819e1af fluxheim-1.6.3.tar.gz
  • f8763aa476ed8587e055552738620c5a013336a4683e91641b2e571b8ff1fa5b fluxheim-1.6.3.zip
• Binary checksums:
  • x86_64:
    • 2c27c0a3fa5a22a82ed9286a3f51920a7ced323902c07aa2979e5ab517c616ab fluxheim-1.6.3-full-x86_64-linux.tar.gz
    • 38a3d84bc4d0f011e225c5c5c9837ece8f11fcc71206f8b8d623a76087256c0d fluxheim-1.6.3-cache-x86_64-linux.tar.gz
    • fc8448359031fa6589ea6eb84c110399b547c66febec1222f06fc565d4f5c091 fluxheim-1.6.3-proxy-x86_64-linux.tar.gz
    • 89163d482d168f1817b4159d12ab5b8459f6778709bb3ca8aa885b14b7b5d9f1 fluxheim-1.6.3-php-x86_64-linux.tar.gz
    • c4782c891f8172e8e27ab38bd710b05ce65a08969e1cf29a77d1ba6a818fe2de fluxheim-1.6.3-load-balancer-x86_64-linux.tar.gz
    • 01823915425c9afc69f68ae51f6842f4d93ef1e45416652affa69f550eb7f21d fluxheim-1.6.3-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • 25e6179dad32b7c21e426c6adbc76dc8b4404981f525f083983ca2290bb05356 fluxheim-1.6.3-full-aarch64-linux.tar.gz
    • e59ceeb9871823c28cb16f31310e44f1a374a81abec988de50800be2160cf507 fluxheim-1.6.3-cache-aarch64-linux.tar.gz
    • ada9b83318f3b3ef9082f4470baac41eb8d444a5c29c13799268846974821740 fluxheim-1.6.3-proxy-aarch64-linux.tar.gz
    • 8d1cdac8aea950f03343a5c6900eba05a983c569da0c34d1c6683dcd706a3c4e fluxheim-1.6.3-php-aarch64-linux.tar.gz
    • 6b03d111965c3ff36b1af1fe3cafd5071d02729625173cd3a52be10e47d10b52 fluxheim-1.6.3-load-balancer-aarch64-linux.tar.gz
    • 0eef27405f7c669a921d906fc61a7aa6fc58b57eb64797a7ed65245a910b75a6 fluxheim-1.6.3-config-tester-aarch64-linux.tar.gz
  • macos:
    • 6f13d688d70e80b17b303abaf25ac520d0986d455c44cc151fec40837f2c8837 fluxheim-1.6.3-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • cd521b71387816473cb76a955bd1afc9d972a6a862a331254c0f850b594a27c5 fluxheim.spdx.json
  • 64a5dc9dcc24da327551621d1b4c3eb37a4081ef9ccfb87ee1ef3a67f3dbeaf5 fluxheim.cyclonedx.json
• Reproducible build:
  • 55eee811d784c34d56281f5dbd882317a44ada9adfe9960a703de0a25fd16839 x86_64
  • cbee7106fff9dd481289bc6f9e5b6dc85c929a1a688715b44b301539e5fe7572 aarch64
  • 6e5681c19ef9b95719b2822af5283aa1700fca7ea1d4bd167770f68860cbe99c macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:283ee87210a7a30d2ec3f5169494a2199b52c0ad55ec3038c1b4988d47f282a4
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:8766e7789a6c8178f0cbeab4ada3f0f5e4328b83e1d5b30664b141ca73f6fabd
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:7ee491bd4282056c44e5902e4b164f54166e6bfb08432c0c000865af53aefe8a
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:4aea3be0fef326263bdbe998f25693999aeb4b0d65bd3ac721840dba95a299ae
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:303c9498b46018512b6bc4640c6381ed67cb3850087065edd42e643b856b6dda
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:9989680a07f005ff8cab860769dd83f92c5eee6a679de3d748a5b49d6432dcdd
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:006ee3c073f78da54889910b9d9037ed5e810e093af1112cc52593b7dc90c4c5
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:2cfef27f6b9dfb8e4abb3700bba2b62bc16907e226703eebc6c4bbe5b2722d13
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:52bc641dd43a7809ab45a2206c3daa89ee5629773105c6443953ce1accf44469
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:c24b65d2116a20c0d8e0bde4c08538eeb4b6e3b81f99c1e4510546b1c1ddad95
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:4383ec1cbccc09fbe6aba0af66ce576d12f6a30d94f7b6563027b5cc3694152c
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:2f837b014285f046defcf92e35c04e4538feae182c6ede65d1a31242231d4261
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:167afd9d04e046ebead23450fb4317d0972aeb38b220183afe2a53c08bdb6529
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:404adcdfd02824249b2b03a0afbe1a7ee6167d1339b36767dc5a6e817ade9064
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:1cfa13949b3f0b1bfe75f8c505fd5db7e0e5fa7a65ab2cc3bd0dc99a2a442ef7
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:92b2c7995b2c637e67e129060889bd0dca28d3a2d399862dd589dfa0d97f43ea
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:2673e94f2787dfd36302e8264f67157792d4a0bbda80ff3956416c4a9ee1fa2d
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:c924ebf38e6206cbcf8168dac4acfe0f996f28f33752411cea18bf5e6a35dfa1
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:3ef68890cd437e5ec247504a1269f574a95df4941b78c5b651999319d2f15393
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:b0f80a1cdbaaa43ca4685ac2c32205a482f10a251661286ff967aa4281b39999
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

---

This discussion was created from the release Fluxheim 1.6.3.