Skip to content

Fluxheim 1.7.1

Choose a tag to compare

View all tags
@eldryoth eldryoth released this 04 Jul 18:10
· 173 commits to main since this release
Immutable release. Only release title and notes can be modified.
v1.7.1
This tag was signed with the committer’s verified signature.
eldryoth
SSH Key Fingerprint: EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Verified
Learn about vigilant mode.
53eaffb
This commit was signed with the committer’s verified signature.
eldryoth
SSH Key Fingerprint: EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Verified
Learn about vigilant mode.

Fluxheim 1.7.1 Release Notes

Fluxheim 1.7.1 continues the WebAssembly extensibility line with config-level
plugin registry integration, deterministic hook-chain contracts, and the first
live request-path hook family: native HTTP/1 access decisions. Request-header
mutation remains staged until the typed host-call ABI can safely pass and
mutate header state.

Highlights

  • Add [wasm] config validation for plugin roots, default sandbox limits,
    default execution admission budgets, process-wide execution admission,
    plugin declarations, and plugin attachments.
  • Add [[wasm.plugins]] declarations with plugin name, path, optional expected
    SHA-256 digest, ABI, host-call namespace, phases, fail mode, per-plugin
    sandbox limits, and per-plugin admission budgets.
  • Add [[wasm.attachments]] declarations that attach a known plugin to a
    configured vhost and optional route, with optional phase narrowing,
    deterministic priority, and per-attachment admission budgets.
  • Add a typed config-to-loader manifest bridge so validated [[wasm.plugins]]
    entries become fluxheim-wasm manifests with inherited sandbox limits and
    optional expected SHA-256 digests.
  • Add accepted and rejected WASM config-registry fixtures and wire them into
    scripts/validate-wasm-config-registry.sh.
  • Reject unknown plugin references, attachment phases not declared by the
    plugin, duplicate same-target attachments, preview ABIs without explicit
    allowance, unsafe fail_open security-decision plugins, invalid plugin
    names, invalid plugin paths, invalid SHA-256 digests, and invalid sandbox or
    admission budgets.
  • Enforce the registry allowlist at config validation time: each plugin path
    must live under one of the configured wasm.plugin_roots, and roots must be
    scoped deployment directories rather than filesystem-root or top-level system
    directories.
  • Require sha256 for plugins that declare security-decision phases
    (access-decision, route-decision, or cache-store).
  • Add wasm.max_total_concurrent_executions, a process-wide ceiling for total
    concurrent Wasm plugin executions.
  • Add a canonical ordered attachment view in config so all hook families use
    the same priority/declaration-order rules.
  • Add reusable fluxheim-wasm access-decision and admission primitives,
    including process-wide, per-plugin, and per-attachment execution ceilings
    plus first-deny-wins composition.
  • Wire live native HTTP/1 access-decision hooks for vhost and route
    attachments. Built-in ACLs remain non-overridable; Wasm access hooks can only
    add an allow/continue or deny decision after built-in access policy passes.
  • Compile Wasm modules once when the native hook registry is built, then
    instantiate a fresh store/instance per request. This keeps request execution
    isolated without spending the global compile-slot budget on every request.
  • Add live listener tests that load real Wasm modules and prove deny behavior,
    priority-ordered first-deny-wins, percent-decoded route policy selection,
    non-overridable built-in route ACLs,
    process-wide/plugin/attachment admission rejection, and fail-closed behavior
    for invalid output, traps, and execution timeouts.
  • Classify any [wasm] runtime, plugin, attachment, limit, or admission change
    as wasm-runtime-changed and require a process upgrade until the atomic
    compiled-module reload path is implemented and tested.
  • Expose the process-wide Wasm execution ceiling and attachment priorities in
    authenticated /_fluxheim/status.
  • Add low-cardinality Wasm metrics for plugin executions, execution duration,
    and admission rejections. Native hook execution installs Prometheus recorders
    when metrics are enabled.
  • Preserve explicit WASM default resets from later conf.d fragments by using
    fragment-aware merge semantics for default sandbox limits and admission
    budgets.
  • Refresh release tooling pins: Docker GitHub Actions move to current v4/v7
    patch tags, Prometheus observability smoke coverage uses v3.13.0, and the
    non-Pingora crate freshness gate remains clean.
  • Update base64-ng to 1.3.5 across the root, ACME, server, and
    load-balancer crates.

Operator Notes

  • wasm.enabled = true is required before plugin roots, plugin declarations,
    or attachments are accepted.
  • Binaries built without the wasm feature reject non-empty [wasm] config
    during validation instead of accepting a registry that cannot run.
  • The default process-wide Wasm execution ceiling is 256.
  • The default attachment priority is 1000.
  • access-decision hooks use the exported
    fluxheim_access_decision() -> i32 preview ABI in this release: 0
    continues the chain, 1 allows/continues, and 2 denies with 403.
  • Plugin paths and plugin roots must be absolute and must not contain . or
    .. components. Plugin paths must be under wasm.plugin_roots, and plugin
    roots must be scoped directories such as /srv/fluxheim/plugins, not broad
    roots such as / or /etc.
  • Runtime loaded plugin hashes remain staged for a later 1.7.x status slice.
    Configured expected hashes remain visible in admin status.

Example attachment:

[[wasm.attachments]]
plugin = "security_headers"
vhost = "example"
route = "static"
priority = 100
phases = ["response-headers"]

Checksums And Signatures

  • Commit: 53eaffbf844315d374a5881ca0c0e3081773a21d
  • Local gate: GitHub CI green before tag; local release metadata checks passed
  • CodeQL/code scanning: no open release-blocking alerts before tag
  • Source archive checksums:
    • 42fabac0df1ee5f794762a69ce5284671ae9af04992cef3fbf02ff15a81abf8b fluxheim-1.7.1.tar.gz
    • 790bf61b395b8f68be99f0852020f18091a694ac5680261f426d3a73086758a3 fluxheim-1.7.1.zip
  • Binary checksums:
    • x86_64:
      • 7bb74215e5c7f308ec193d2c713f04b1378246d3895a4a99155c5be2c3d28d80 fluxheim-1.7.1-full-x86_64-linux.tar.gz
      • b9ad6028d824ff6ed777943b34de41aa3bece11f1fe55bf5ee05882f0157f40a fluxheim-1.7.1-cache-x86_64-linux.tar.gz
      • 70bd6d742ced06366867cfab18a0338db48ade9b2b3648f8736f330fad0bb670 fluxheim-1.7.1-proxy-x86_64-linux.tar.gz
      • 0504ce568ffd196ff89d8f46054bfa2aaaca2e7322ac9ea209117f6a17c3d458 fluxheim-1.7.1-php-x86_64-linux.tar.gz
      • 2e51a2da0b17588a3e830f510fa11b3efac9006d84b95f22bd1778dc04990206 fluxheim-1.7.1-load-balancer-x86_64-linux.tar.gz
      • 0e420bae996462de8a3fa834b61c8eb0ddacdb84aee9dc383ed3868f5e81a9ea fluxheim-1.7.1-config-tester-x86_64-linux.tar.gz
    • aarch64:
      • ffbbad37d37e4c290d7be016263f90910977c48d25be98e3c2217db880d8b051 fluxheim-1.7.1-full-aarch64-linux.tar.gz
      • 0c4983bc492e2be85b5fba619de93b8f11c4fe4a2fc86f2c7862f4c5e35f80ee fluxheim-1.7.1-cache-aarch64-linux.tar.gz
      • f14c5784cd504e00c1490884e932d0484f9c3b20f099dda4d921170c058e6862 fluxheim-1.7.1-proxy-aarch64-linux.tar.gz
      • 23c32a3564d3a00dbafaefea644ebda14b1da05a202f8e6147a9591632170ff1 fluxheim-1.7.1-php-aarch64-linux.tar.gz
      • ec6dd80a99733b1def87b07b98f6799bf2a059a6942318e7d2093e22a608f397 fluxheim-1.7.1-load-balancer-aarch64-linux.tar.gz
      • 08e71cb4a8273edffd58b28de2a0ad9edeb3209a6301462a8996a82708700dbc fluxheim-1.7.1-config-tester-aarch64-linux.tar.gz
    • macos:
      • ff44986608e5757caeb8c45f6d29b893a1927c92140438d34549fe3631463ae9 fluxheim-1.7.1-dev-aarch64-macos.tar.gz
  • SBOM checksums:
    • 746dad48b8d3e26fa63c871e7aca882111858dab4f25bdeefa9c036745ac2f4b fluxheim.spdx.json
    • 3eba1f637da51aa02cc009b7931f3490d7dfc4a3d8e61eb66d7ad11b9b360ce4 fluxheim.cyclonedx.json
  • Reproducible build:
    • bf2225caa47e6c15433668364a923f99f3e140132a8f1f76a70bfbe000225d87 x86_64
    • 52fd070693eb0ff74b2a63d12382cf93ca5f37d9be4eae0372ae8877b5848f3e aarch64
    • 97d9ad43435c9832c9865e3a586e56ca022a66fb4f6560a6135665ef2bd723fe macos
  • Full Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:97ac18d1a92cadd9a789ac1ffc4c191141efbe3da96b902051c9c1cf4f5475ba
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:227a5e45a7db15c2ff0e17c02dd02d8729b669e6a47068db0ca9238ed219d634
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:1df45725eec7991f0375f47d7aa1298f6d701426a9e3a51feb0f6fc5ea85a826
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:e4a49a70bb9a72700d68a5c330bb9eb2cd02d1cedaa6155a52c201758a0033d5
  • Cache Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:75df0c5e97e927d2d73f170a980f455f739edd4351e36758cc34db0738597ed7
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:553f971225048e18b3ed06af324df6c68bc009deb6f6250e23ca7d1464fe2f13
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:94e27328a525297546ca4a11e978795838b90e80ce27066b81ded5ef4891a46a
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:0292b8172f2cfcc0a5e47fdc2749c6f3cf43f9bd817930a8491896c7363c594d
  • Proxy Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:42dde9267784b814bace15d33b7cac8c36d352e6403432fcf29fd41526c118c6
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:7e031b2dfb03870c6cb320101b4655bb7cd1c30033b79a0dabc50f04519dc3f4
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:5e53402fbea8de6a55d74095b7a1600bc81b906a2683e6697a8de8856e901208
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:60660e3d4bb124e869e618a170559bb6735b45f6e48dfe8dd9f2632e0cc00e0e
  • PHP Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:4ec8d057a8bab06e6bcdb7f8237502fdedd8908180cc727764af4b3cec3d8f05
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:08cf8d4b9d3eade237e30e39167558ac465f63ae0a9d150a9d099ead9f60a29f
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:bbed59aabddd72bed3438cd9eb8a17fd63ad476e205cb77f5f9021f32f175f28
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:c324e1a35f118c608f66cf94ccb2de253b5dac1b352da65e0e6a6aaaeeccefe3
  • Load Balancer Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:0ad389a43a9e78a446f9b8951532e8fb4424a57dbc7cff4e8e15a3d6be6e7e1e
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:108994489dc5a32e59290d848f74e369a50d0e195b7b09fcba2f2ff712efc256
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:205acb70adc351f722289a201e6f92cbdf80367fd95db9106b9cce6be2237a6e
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:35612298c42b30ce7728b97b10b5566e6acc01358b591ad89b1ac9232ea8f0f8
  • Tag signature:
    • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Assets 16
Loading
0 Join discussion