Skip to content

Fluxheim 1.6.35

Choose a tag to compare

View all tags
@eldryoth eldryoth released this 30 Jun 12:49
· 567 commits to main since this release
Immutable release. Only release title and notes can be modified.
v1.6.35
This tag was signed with the committer’s verified signature.
eldryoth
SSH Key Fingerprint: EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Verified
Learn about vigilant mode.
ff52c18
This commit was signed with the committer’s verified signature.
eldryoth
SSH Key Fingerprint: EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Verified
Learn about vigilant mode.

Fluxheim 1.6.35 Release Notes

Fluxheim 1.6.35 is the first stabilization checkpoint after the Pingora-free
runtime proof release.

This release is intentionally scoped to security cleanup, soak-test evidence,
performance/regression checks, dependency hygiene, and documentation clarity
before the 1.6.36 structural cleanup removes the temporary native proxy shim.

Highlights

  • Keep the normal runtime on the Fluxheim-owned listener, TLS, HTTP/1, HTTP/2,
    WebSocket, cache, load-balancer, admin, metrics, stream, and background
    service paths introduced by the 1.6.34 Pingora-free proof release.
  • Start the first-party secret-memory migration pass from direct zeroize
    calls toward Fluxheim's sanitization crate where the replacement is
    practical and testable.
  • Move the legacy root auth subrequest forwarded-header secret container from
    direct zeroize wrappers to sanitization::SecretString.
  • Move native auth-request forwarded and allowed response-header secret
    containers to sanitization::SecretString.
  • Move native metrics bearer-token storage and transient Authorization header
    candidate buffers to sanitization secret containers.
  • Move managed load-balancer cookie HMAC key-ring clearing from direct
    zeroize calls to sanitization::SecureSanitize.
  • Move HTTP discovery bearer-token storage and Fluxheim-owned Authorization
    header assembly to sanitization::SecretString.
  • Move native OpenBao disk-cache encryption token storage to
    sanitization::SecretString while preserving the existing OpenBao request
    behavior.
  • Align the legacy cache OpenBao token holder with the native cache token
    migration so both cache code paths use sanitization::SecretString.
  • Move admin bearer-token digest clearing from the zeroize derive path to an
    explicit sanitization::SecureSanitize drop implementation.
  • Update the release checklist to prefer sanitization::ct for future
    constant-time secret comparisons, and drop an unused zeroize derive feature
    from the load-balancer crate.
  • Move native upstream TLS client private-key PEM buffers for both rustls and
    OpenSSL backends to sanitization::SecretVec.
  • Move stream-proxy upstream TLS client private-key PEM buffers for both rustls
    and OpenSSL backends to sanitization::SecretVec.
  • Abort if native auth_request response-header application cannot access its
    secret container, matching other poisoned security-control locks and avoiding
    a repeated inconsistent 502 path.
  • Clear both the admin token digest and stored token length through
    sanitization::SecureSanitize during drop.
  • Align runtime performance baseline capture with its load-balancer fixture by
    building the profile-load-balancer release profile by default.
  • Tighten native vhost-level PHP-FPM/static fallback routing so executable PHP,
    PHP directory redirects, denied PHP paths, and fail-closed resolution errors
    stay on the PHP-FPM path, while non-PHP static files can still be served by
    [vhosts.web].
  • Carry the native PHP-FPM fallback script-resolution result into the handler
    so vhost PHP/static routing does not resolve the same path twice across a
    deployment race window.
  • Make validate_runtime_config() run the central structural
    Config::validate() checks itself, so standalone runtime validation catches
    cross-field invariants such as peer-fill policy shape before startup.
  • Snapshot native disk-cache purge targets before running purge callbacks, so
    stale and indexed maintenance batches no longer hold the global purge
    registry mutex while deleting cache objects.
  • Serialize native disk-cache same-key mutations with bounded lock stripes so
    store, purge, and eviction cannot interleave state updates with filesystem
    object removal for the same combined cache key.
  • Preserve the client request Host as the HTTP/2 upstream :authority,
    matching the documented upstream virtual-hosting behavior already used by the
    native HTTP/1 and WebSocket paths.
  • Narrow native PHP-FPM fallback fail-closed routing so resolver errors for
    explicit or protected PHP targets still avoid static source exposure, while
    ordinary non-PHP front-controller probe errors defer to static fallback first.
  • Harden the WordPress PHP-FPM smoke fixture with explicit private TCP upstream
    opt-in and MariaDB readiness waiting, and verify full native WordPress
    PHP-FPM plus proxy/TLS smoke coverage.
  • Fix the release version-bump helper so package versions such as 1.6.35 are
    not interpreted as regex backreferences during automated metadata updates.
  • Add scripts/test_starter.py, a human-facing selector for the maintained
    live smoke scripts and release gates.
  • Add scripts/check_smoke_images.sh so maintainers can pull and record the
    configured WordPress, OpenBao, MariaDB, PostgreSQL, and Valkey smoke images.
  • Add a privacy-mode live smoke that builds profile-privacy, verifies
    client-IP headers are stripped before the upstream, and checks Fluxheim logs
    do not retain the test IP, path, cookie, user-agent, or request ID.
  • Extend local and container load-balancer smokes with native
    nginx-compatible Ketama coverage, and extend the container smoke with
    backend failover, recovery, and all-down 503 checks.
  • Wire optional deep-gate flags for OpenBao cache encryption, database health
    checks, WordPress, PHP Wolfi, RPM build, privacy mode, and smoke dependency
    image freshness.
  • Make the observability smoke self-contained by starting disposable
    Prometheus and Jaeger containers when external URLs are not configured,
    requiring Prometheus scrape plus OTLP metrics ingestion and keeping Jaeger
    trace ingestion opt-in until native span export is implemented.
  • Require cache.peer_fill.shared_secret_file for non-loopback http://
    peer-fill URLs, closing the remaining unauthenticated cross-host plaintext
    peer-fill cache-poisoning configuration.
  • Add cache.peer_fill.shared_secret_file so peer-fill clusters can require
    response-bound HMAC verification: outbound peer-fill requests include a
    nonce/request signature, peers sign the status, canonical response headers,
    and body digest, and unsigned or tampered peer responses are discarded before
    cache storage.
  • Add scripts/smoke_ports.py and wire the newer privacy, observability, and
    load-balancer container smokes through the shared randomized localhost port
    allocator instead of repeating ad-hoc allocation snippets.
  • Keep dependency, metadata, container, RPM, and smoke-test gates as blocking
    evidence for the stabilization line.

Compatibility Notes

  • No new protocol or extensibility surface is planned for this checkpoint.
  • Third-party transitive zeroize use inside dependencies such as rustls,
    AWS-LC, and other cryptographic crates remains untouched.
  • The 1.6.36 follow-up remains reserved for structural cleanup: deleting the
    temporary native proxy shim, moving remaining DTOs/helpers into owning crates,
    and removing inert Pingora-era root code.

Verification

  • scripts/validate-release-metadata.sh
  • scripts/validate-pingora-dependency-policy.sh
  • scripts/validate-native-runtime-cutover.sh
  • scripts/capture-runtime-baseline.sh release
  • scripts/stable_release_gate.sh check
  • scripts/smoke_privacy_mode.sh
  • scripts/check_smoke_images.sh
  • scripts/smoke_load_balancer.sh
  • scripts/smoke_load_balancer_container.sh
  • scripts/smoke_openbao_cache_encryption.sh
  • scripts/smoke_redis_health_check.sh
  • scripts/smoke_mysql_health_check.sh
  • scripts/smoke_postgres_health_check.sh
  • scripts/smoke_observability_local.sh
  • scripts/smoke_wordpress_php_fpm.sh both
  • scripts/smoke_wordpress_proxy_tls.sh

Checksums And Signatures

  • Commit: ff52c18a83376e44eda25ab4c9fdbebecb70e2ae
  • Local gate: GitHub CI green before tag; local release metadata checks passed
  • CodeQL/code scanning: no open release-blocking alerts before tag
  • Source archive checksums:
    • [MANUAL_SHA256] fluxheim-1.6.35.tar.gz
    • [MANUAL_SHA256] fluxheim-1.6.35.zip
  • Binary checksums:
    • x86_64:
      • 0d4e05623fc8533ca0e497e872dce741783dfdb131ef557756bf70a8e5d0b8ed fluxheim-1.6.35-full-x86_64-linux.tar.gz
      • c52ba34cbeee85b8f553f45f5a7de0fc12fcf1e976a8e078b3cabecca49a48e2 fluxheim-1.6.35-cache-x86_64-linux.tar.gz
      • cb8b46c18b29468407b10c5ace693e092fe88f2a55666569d87c125e673affb0 fluxheim-1.6.35-proxy-x86_64-linux.tar.gz
      • 39da8968439ec10a8a9cb579a268338e25c2d3f92d5be6359fd9f02d3a80285b fluxheim-1.6.35-php-x86_64-linux.tar.gz
      • 9541d9a78c8c3abc9402483dec9970fb2293a285cdab2364517f4f83c1e0c480 fluxheim-1.6.35-load-balancer-x86_64-linux.tar.gz
      • ea76e0ed84929d392967d3e88a2540504a6f67e5366bcd6d779430c3741cc00e fluxheim-1.6.35-config-tester-x86_64-linux.tar.gz
    • aarch64:
      • 84276a98a971a0b4bb546d295a5acf70b314706fa08f75a40327d1e4e40bfeb4 fluxheim-1.6.35-full-aarch64-linux.tar.gz
      • 9504df2b2e6ee8a7dcf15db827ec7b0c4ca7d0c8f52c0d6948fa0391a931733a fluxheim-1.6.35-cache-aarch64-linux.tar.gz
      • 1a39f518765579436795fa24bac6844d437c9ee56f367e04a35504b9fe4f1052 fluxheim-1.6.35-proxy-aarch64-linux.tar.gz
      • a5a71567a0099ae79c1d993017f02f9b6506e79b3fb01d47fb9f201e2481e37e fluxheim-1.6.35-php-aarch64-linux.tar.gz
      • 9049820f0f43bb8241c3de2d8967e4370da5a0da92769ed9d617a7c8b7fcaa73 fluxheim-1.6.35-load-balancer-aarch64-linux.tar.gz
      • dff3684fa6433705319bad9f8b33622ab05eb03c368b5f0861f5acccb46a73d4 fluxheim-1.6.35-config-tester-aarch64-linux.tar.gz
    • macos:
      • dfa84545737fc151d8350c6508a60d35a17aa5eebd8e764ebe0fb59a868ec572 fluxheim-1.6.35-dev-aarch64-macos.tar.gz
  • SBOM checksums:
    • 04e812f1f00318cf52b10d547a7527f93483a1d7d50e5c795efc6ab7b753c097 fluxheim.spdx.json
    • d4a9d74193fd2d5b9fbb8c81cf3b8f201abca3cb50a0a8a61070946c8160576e fluxheim.cyclonedx.json
  • Reproducible build:
    • 5325d2a4022b2414aeaa4c7db4f9c15e4188d4642c5b8b318316d4834ba4147d x86_64
    • 9dc8efb9ef09076f21e71c1f54cf2ebfd89525f0184912f609de11bcd61de98f aarch64
    • c028258f99a1ab95e78269b28f40027b6fd71b3a1f9678d622006dd602e6b7dc macos
  • Full Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:8dbbeec3dcf1a651d183b105ddcd79406e190528acc9d5a38fc9bcb69902fe54
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:6eaae5520e18b85e740c2dcbdb097875cc03765238dd7f7a819ae36dd4bbf3d4
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:79dba6f376a054e8125444e0367514adf51cd7d4ac6778e3a14ae2175f7c769e
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:6439f2ba2d4ceb770d0b7040916977204e4a9ca6d2b08daadb034fe657b0ecff
  • Cache Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:dd2291e8aa0d28221b50f254c2ce8ae3d68bfeb8ababf517584bb75534e5bbe1
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:a036b46063968f958816c53737ddac3c312b004a30fe9119c16ee8c2dbc36c85
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:cd4765c78ee8354c70574838fab7cb306866132051c384ae34e8494b18b60b91
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:2549e3d8da159bbb5f07f080c7470771c56c15b22a59d42979fa4c1c9246c77e
  • Proxy Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:04794d8dec53c8ca83b26aae46b51b2d3c55d75935f0a52738942d530dea01e0
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:468a7f659d8ba827fbf9023d264631c14c1f18202b1495caee7b9c409b51ab70
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:3b1c872df58a273ac815e47ba810278d9c28ac907053e222f65b3df7539b3fe7
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:735d08a9f47f30993d056c68587a1d5be62a439030f17e97a9d2fe7f3a70ea9a
  • PHP Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:bf685a76b71b94ca032def9168be0d566883a74d5c1a28d2e33d7b138200f43f
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:3833b70d1b061d6986f46c0512484e036b05024bd7f3dce3082b16d9002557fa
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:4bd080455de5eea25e9ac09a365481d20ce0511574d2acc9c88605d419090bdc
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:14f387191aff862869886640c5daab599fa93fefe546954560c1c8ad2ca837e8
  • Load Balancer Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:0a6de1c407467a2ab57b8073bd49f0facb1de0c09894aee6f37ee400ab140726
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:915d2e8103c99e92bc4810e2bd931fb6271c1e391c38f88f834dc7485bba841b
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:40e7f24f21ce5b3da9229e19708daf59860151d4424c36147dfd6b156c7a56be
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:38371dba542beadda826aa11cb90bd2444278b951f73980b34932e56bdf544d6
  • Tag signature:
    • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Assets 16
Loading
0 Join discussion