Skip to content

Fluxheim 1.7.0

Choose a tag to compare

View all tags
@eldryoth eldryoth released this 03 Jul 10:03
· 196 commits to main since this release
Immutable release. Only release title and notes can be modified.
v1.7.0
This tag was signed with the committer’s verified signature.
eldryoth
SSH Key Fingerprint: EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Verified
Learn about vigilant mode.
e61bc5b
This commit was signed with the committer’s verified signature.
eldryoth
SSH Key Fingerprint: EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Verified
Learn about vigilant mode.

Fluxheim 1.7.0 Release Notes

Fluxheim 1.7.0 starts the WebAssembly extensibility line after the Pingora-free
runtime and crate-boundary cleanup work in 1.6.x.

This release does not yet expose production request/response policy hooks. It
adds the first sandbox foundation: safe plugin file loading, bounded Wasmtime
execution, compile-time feature gates, and real smoke evidence for executing
and trapping Wasm modules.

Highlights

  • Add the optional fluxheim-wasm workspace crate.
  • Add wasm, wasm-proxy-abi, and wasm-wasi feature switches. The Wasm
    feature family remains off by default and incompatible with privacy-mode.
  • Load Wasm plugin files only from approved absolute roots, rejecting relative
    paths, ./.. components, symlinked files or parents, non-regular files,
    and files over the configured module-size limit.
  • Record the SHA-256 hash of loaded plugin bytes for future admin/status and
    audit surfaces.
  • Add a typed Wasm plugin manifest boundary with plugin name, path, ABI, phase,
    fail-mode, and sandbox-limit validation. Preview ABIs require explicit
    allowance, duplicate phases are rejected, and fail_open is rejected for
    security decision phases.
  • Add a manifest-backed plugin loader API so future config wiring validates a
    manifest and loads the exact approved plugin path with the validated limits.
  • Add a Wasmtime runtime foundation with bounded fuel, memory, table elements,
    instance/table limits, compile timeout, and a per-call wall-time watchdog.
  • Bound concurrent Wasm module compilation workers so a timed-out adversarial
    compile keeps occupying one capped slot until it actually exits instead of
    allowing unbounded compile-thread growth.
  • Avoid cross-request timeout interference by using a per-store epoch-deadline
    callback: a shared engine epoch tick only interrupts the invocation whose own
    deadline has elapsed.
  • Open plugin files with Unix O_NOFOLLOW where available and verify the
    opened file handle still matches the pre-open metadata before reading plugin
    bytes.
  • Carry the canonical approved plugin path from validation into the final
    metadata/open sequence so filesystem access uses the same path boundary that
    was checked.
  • Add unit tests for plugin path safety, oversized modules, real Wasm
    execution, fuel exhaustion, memory-limit rejection, and table-element limit
    rejection.
  • Add scripts/smoke_wasm_sandbox.sh as a real Wasm smoke test that runs a
    successful module, verifies an infinite-loop module traps under limits, and
    proves table growth beyond the configured table-element cap is denied. The
    smoke also validates an accepted plugin manifest and rejects an unsafe
    fail_open access-decision manifest.
  • Add regression tests for symlinked approved-root rejection, zero
    compile-timeout validation, and unrelated engine epoch ticks before an
    invocation's own deadline.
  • Add the Wasm smoke to scripts/test_starter.py; the deep release gate now
    enables it by default through FLUXHEIM_GATE_WASM=1.
  • Add docs/wasm-policy-example-parity.md and
    scripts/validate-wasm-example-plan.sh so the 1.7 line has explicit
    end-of-line example/test requirements for F5 iRules-style policy, nginx
    Lua/OpenResty-style header policy, HAProxy Lua/SPOE-style routing and
    load-balancer policy, and VCL-like cache policy.

Operator Notes

  • Wasm is not compiled into default builds.
  • privacy-mode rejects Wasm feature combinations because Wasm policy hooks
    are an extension and observability surface.
  • The first 1.7.0 runtime only supports a small internal i32 no-argument
    execution proof. Request/response header hooks, access decisions, cache
    policy hooks, proxy-ABI compatibility, and WASI capabilities remain staged for
    later 1.7.x releases.
  • Wasm compilation is bounded by a compile timeout and a global compile-worker
    concurrency cap. Fuel and epoch checks apply after compilation, so future
    request-facing hooks must still pair this with configured per-plugin and
    per-vhost execution concurrency limits before request-path use.

Checksums And Signatures

  • Commit: e61bc5b61c94e72396578dcec1d922663cda17a3
  • Local gate: GitHub CI green before tag; local release metadata checks passed
  • CodeQL/code scanning: no open release-blocking alerts before tag
  • Source archive checksums:
    • 636eb8a011b76f402ef406f59e0a2571e8ec7986cf11e5123c37d8f53ed174e0 fluxheim-1.7.0.tar.gz
    • 2ee065cab3cde3f12b4d09c2f81475fbfb44df05a03132031e0b398277367b16 fluxheim-1.7.0.zip
  • Binary checksums:
    • x86_64:
      • d272b244cb005f9c094f103e2e3d6af2527169499a2e97ed7418b397987c9bb6 fluxheim-1.7.0-full-x86_64-linux.tar.gz
      • 31098e08b4534224c3b6fb3b82ce95201e83fb4db2003bf5033307b35f72ed16 fluxheim-1.7.0-cache-x86_64-linux.tar.gz
      • a923b161591b20d3ffe3e49b09c79a082ff308dd6e6852097b1ccaf57d087da6 fluxheim-1.7.0-proxy-x86_64-linux.tar.gz
      • c819b18c043cb5b641c9cfd840b013409cb0f1c0a577556a44d41c89873bceaf fluxheim-1.7.0-php-x86_64-linux.tar.gz
      • 4a54dd3f6bd299d1d586d1543d793cc89dd06bb008b5f2613c5a2319d7bf4bb2 fluxheim-1.7.0-load-balancer-x86_64-linux.tar.gz
      • d4ff6be16995534d7682ea8ba724bbf2ef77a8f1bdabf67dcecce2fab6415f3b fluxheim-1.7.0-config-tester-x86_64-linux.tar.gz
    • aarch64:
      • 04a32b92992ec94457be5da10becac62ce969d3d33fa56467a6b8075d40022e2 fluxheim-1.7.0-full-aarch64-linux.tar.gz
      • a98e7aed042fff3ad9484d8598667a66154a966df591493b5314d4cfb860844f fluxheim-1.7.0-cache-aarch64-linux.tar.gz
      • 5babc748e0adb57cff54118ecd44ee3f692b294b10e3700c1abdc24c6ab00836 fluxheim-1.7.0-proxy-aarch64-linux.tar.gz
      • 8000d621db1e53deb76e2b00dcfc449a48e2e0403ea55e31945b8a9cb62b35fb fluxheim-1.7.0-php-aarch64-linux.tar.gz
      • 396c2ec223c8d4403241f5c01288623ded4fa1045cdbaae2b59bd752679e6698 fluxheim-1.7.0-load-balancer-aarch64-linux.tar.gz
      • 9d68cc1c58b015a10dacf7310a8926e60d80f0d7707ad1a16aa6213e1d3c30d0 fluxheim-1.7.0-config-tester-aarch64-linux.tar.gz
    • macos:
      • ece7cd6dc9158fe5a7ac096194f476f06b72cf1580841e67bfb36e8396f5e616 fluxheim-1.7.0-dev-aarch64-macos.tar.gz
  • SBOM checksums:
    • 407316ca2db31ea03ec23f02d2de3eb14374c3f485fe2adb3bb1f06d4865fcb0 fluxheim.spdx.json
    • 036a3354720c34309c5ed7d929486049e282407b42858bc41fb04e117b7a0eb8 fluxheim.cyclonedx.json
  • Reproducible build:
    • 496532007867cf4c0136460695635f606363fb5673a149d307fa9fa936ea79bb x86_64
    • 55de8348869500cd1968f294fce0b54e66d513d14323aa56a6ecabf743de26e4 aarch64
    • af9f5a5644be975612ba2194c92e6aa6d0748c310e48da24787097978a6e07ff macos
  • Full Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:188fbf4daff26a08869dde9cde2b9a1e249c8999604ecdd6aadee8b3fd3bc45c
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:aa447f3cc8d242a961a9b61878f1acff9dd2a12cb5fa0967b9341e545537e9ad
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:12563345efb93c2a80831dc0c447228137cf16eb32e09da8e80909ddcd6823f3
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:51d7f12c696613d402d76e91b0b4df8968aa4b4219eab3e34509ebdcf9dd1a20
  • Cache Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:512e83018e85184ff43f8faf85108986f434feb306a8e70ed073d262b59b3403
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:c4b3b20511f5a129ffa67091e197361141ecc17893b5de0bf453e0f7173bd51d
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:857afb49d96adcda710bcc832217c1b628b3f9d6529799e6f052234e9a0b74df
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:5713f1568ac1b7a37d1b7efddbe6896bdf48e4b82a60d53a57a58de348158df7
  • Proxy Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:20ebd408b7a763659fe9b0194be31881306b347b43d41431b6698da2370126b4
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:85ddd15f6f40229ab2c362b49995ff946919fcfb3522067ba76d2d3bd57c08ec
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:65ba165b316233516db43b906ddb2e496859a972803ac852382f2d8fd747ac50
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:8f785aa3a0a10136b9e46f9bedd71cfa9db7f6a3d4e7e30f387b464d87ed728a
  • PHP Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:82c1ad98230d78fcd4d5e3a94486a79aa1240264512757ad2ad13044b16f562a
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:711179d5b7ce3096cf816aef62442471a281fa2ec08a66c8dacac49c2400f6a0
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:412c2ad1e6014e08b7d92a45915f5df8ebb74f8e3b00e48a399388afe9c3f339
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:42ee8e8dbf0b50bb869a0ceb91975a7b2f03fc002b83d5dec9af785c766150d7
  • Load Balancer Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:a9430417436f387e99c506a32e3aa5f2d4b39047525ce018bec6a0543bcb0650
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:14918531bb8d0bbd9f5fe18f80c17d3e1ac139f622b6b676ab849f534aa0ce55
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:3b1699511975744d5e68be15aa346927acd0dd2166cefc84396b72a835f2018a
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:213b4f6a0d4572cd4ae24f18b1bd92cfc5808308850ae0cce411c68063694851
  • Tag signature:
    • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Assets 16
Loading
0 Join discussion