Fluxheim 1.6.23

Fluxheim 1.6.23 Release Notes

Fluxheim 1.6.23 cuts the stream and UDP proxy startup boundary over to
Fluxheim-owned native task primitives. The data paths were already Tokio-based;
this release removes the Pingora-owned accept-loop lifecycle from those
services and keeps the old runtime only as a narrow registration adapter until
the final 1.6.x cutover.

Changed

• Move stream proxy listener startup into a native FluxBackgroundTask
  boundary.
• Move UDP proxy listener startup into a native FluxBackgroundTask boundary.
• Keep Pingora service registration as a thin compatibility wrapper that
  delegates to the same native stream/UDP tasks.
• Mark config-derived stream and UDP service plans native-ready in the native
  runtime cutover summary.
• Extend native runtime cutover evidence with a representative UDP route and
  update the expected blocker report so only HTTP/2 remains for that
  representative stream/UDP config.
• Update release metadata, RPM metadata, and container tag documentation for
  v1.6.23.

Security

• Add FluxShutdown::wait_for_shutdown() so native service loops can wait on
  shutdown without depending on Pingora's ShutdownWatch API.
• Make wait_for_shutdown() return immediately when shutdown was already
  requested before a task starts waiting, preventing stalled startup/shutdown
  handoff.
• Make native background-task joins abort-on-cancel, so cancelling a join()
  future cannot silently detach a task that should still be supervised.
• Make the shutdown waiter cancellation-safe for native stream/UDP
  tokio::select! loops.
• Preserve query strings on pathless absolute-form admin request targets such
  as http://admin.local?reload=true, mapping them to / plus query instead
  of dropping the query.
• Preserve live stream and UDP smoke coverage after the lifecycle change.
• Keep final HTTP proxy and HTTP/2 runtime parity as explicit blockers until
  the final Pingora-free proof release.

Compatibility Boundary

• Normal proxy profiles still retain the Pingora compatibility runtime in this
  release. Stream and UDP service startup now uses Fluxheim-native task
  boundaries, but final production runtime/listener removal remains scheduled
  for the last Pingora-exit proof release.

Checksums And Signatures

• Commit: 7bae1abe603fddb4cae63321f4260802cce86af7
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • f1f51e156407073d08371cef687bafd8fb5670c351398cf4cc47abd73d658da9 fluxheim-1.6.23.tar.gz
  • 6bcd6884570165d5189ca7892cacc1f5ad28246f33feb9d198f2be843d6cbb5b fluxheim-1.6.23.zip
• Binary checksums:
  • x86_64:
    • ce47b468571e90eed86e44d2ad228a3156753e16d7add843ecadfbbe4e5676e1 fluxheim-1.6.23-full-x86_64-linux.tar.gz
    • 59b01db1d204a0ac5c925d1d5915dd317e2a8e29b5c6b09543aec23204ca7458 fluxheim-1.6.23-cache-x86_64-linux.tar.gz
    • 950aaa49435411263d56b93935de3ea3d4548eeaf67fa00ce0185552084a69ce fluxheim-1.6.23-proxy-x86_64-linux.tar.gz
    • f6001ab164f3ec2fdd904b5c170c96d2a79ded0a5b6d1d901b409fb408fb5846 fluxheim-1.6.23-php-x86_64-linux.tar.gz
    • 437619b260ccdf2cb9460edb8bed89a3ad4bee7d32fc8224a2d08d64a96c7d16 fluxheim-1.6.23-load-balancer-x86_64-linux.tar.gz
    • cb4f008d9af302b33d5bc4eee796934e0d00d94dcf87692d9bb1088e53f298bf fluxheim-1.6.23-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • 7e9c954584c8eccd8a3925c4a3722e99e822385046b2d965fbe1b31676fba33a fluxheim-1.6.23-full-aarch64-linux.tar.gz
    • 4d33bdfcf3709dc6eb9044c062509b639d80dcbdbf32216b21dfe8f6a7d495d9 fluxheim-1.6.23-cache-aarch64-linux.tar.gz
    • 5b5be03eac1e82c41b80b16666cf8f0e6afa76e458f36cc7dc3eb81ff3027e1c fluxheim-1.6.23-proxy-aarch64-linux.tar.gz
    • 2543316f71f99cca995121797a21ecbf12b93b8d3f2122b65d1b1e0407a6ea29 fluxheim-1.6.23-php-aarch64-linux.tar.gz
    • 76887478f76e0c1b76ff0b6b7098d53a40789ebd260a037ef10e94c3f53f735d fluxheim-1.6.23-load-balancer-aarch64-linux.tar.gz
    • ea7e033063762400313f4612a74d89ec545ca7933b05e610d632a914dfa1b076 fluxheim-1.6.23-config-tester-aarch64-linux.tar.gz
  • macos:
    • 8ee47edfaf3b3f7abd85bf9e0ee3c1b1ab2c4f0fc4a3b1e43db3a690454dabd9 fluxheim-1.6.23-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • 385fb371fd598ececb10a5bb08453d1266adf65ab2adf85cf11871db8e6ad1fb fluxheim.spdx.json
  • 8430aa1e9be9f29565598626a7e53f53ac38f272b6369a4f5df3027b6a8854fa fluxheim.cyclonedx.json
• Reproducible build:
  • 56247a7b926b1aa8379402c02bb003835b909e93ae1808af7db974fc4f6cc681 x86_64
  • 76e9e4d366474587af77bb6a2f2cd60df1bf4a08a7cea8d22a74369046cd9943 aarch64
  • 332208267961551a8ae8fff881ce9a2578fdf543301405ad27a2ef2c71458e13 macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:5a092346e9bf7d22f46971df0e28e4343090b34f93355b80f802d128e19917c6
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:74d67780d097fc0d8dff88a4039ca7b614449ae6b3dad402e5c088c2c444838c
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:ac7298352703f57c274d6427d92b0460762c72ba556673bedba8affe7b36e47a
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:0c6f086c327b72bb39fcda85ca99fcc9554ccefbf108b72fc74802d8892a1e1c
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:8e72241f0387e032c93de8cf4ab9a1091bad22ea51c03ba20a9aa8d7d727268a
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:5ccbbd67734b55b61fcbbc08904b678436f5f7c4f8fd1c29489b32ce0e5102d0
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:2b6caf64871198cefc98896c457d7777461af2822ca8f5d6f857e4b779ea1a77
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:0111331495aa9a8c64066a513fb83ddb1919a95595df5ec12166e7e6e7eaf8d4
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:196a09f2fd2b3d523c73d0d6d7013fd07314d944dd0c42a5812c4b1a5851c707
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:2b73e8737480c0ca2bb698f8747ae8ec736bcad11c6e6b8166ecf15a3ec3f2ff
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:6d0c4f6a01d65a8fa1a95a8de1d5d36a4bf30f26e6db937fb0bd16645e176b30
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:78f7c62a56efbed4588183da438566dc63c7a950a78644976ea91f6d006f5ad1
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:378d173434da8275d8f5855cff52f068b38176868c47a5145bbdee3df294ef86
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:218f39c98b6335617d22bc46a2901856bdcb57c9545b42a1ab60524e27bc585e
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:5834c4773b58ca05529ebae8158fc778169a6fe6fb85237aecbb60678fe37e17
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:435f8788b10401ef6862f390f79d5a8c9192cf5cd5d64ea0129f294855ab75cc
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:0ad435a18d8ffb53cba8e786d367ae237fc76bd6516aca083ee585bc6fe87e76
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:a7dcb6cd83f3f43cc06f9da47ca8a896df8f358b5a0d37770d7f7d8aacabe5e8
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:0d8a406f1e2032f1c9362b714d3c10bd505643d88f579b25b8d22d7f3a0c79a1
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:11f1357b521e788d8d6de791904fa61527326c7ff5e602e649afb66d6d9f06ed
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4