Skip to content

Fluxheim 1.7.10

Choose a tag to compare

View all tags
@eldryoth eldryoth released this 13 Jul 10:32
Immutable release. Only release title and notes can be modified.
v1.7.10
This tag was signed with the committer’s verified signature.
eldryoth
SSH Key Fingerprint: EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Verified
Learn about vigilant mode.
e86a4ec
This commit was signed with the committer’s verified signature.
eldryoth
SSH Key Fingerprint: EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Verified
Learn about vigilant mode.

Fluxheim 1.7.10 Release Notes

Fluxheim 1.7.10 is the stabilization and release-gate hardening release for
the 1.7 WebAssembly policy line. It turns the documented migration examples
into explicit operator-selectable and release-gated acceptance evidence while
keeping the typed policy ABI constrained.

Added

  • Expose focused scripts/test_starter.py entries for F5 iRules-style,
    nginx Lua/OpenResty-style, HAProxy Lua/SPOE-style, and VCL-like Wasm policy
    examples.
  • Keep focused and aggregate Wasm policy checks on one implementation path,
    and validate that the deep release gate requires the complete Wasm smoke.
  • Audit every guest-controlled symbolic ID decoder for total, panic-free
    behavior over arbitrary integer inputs.
  • Make the in-process native host-callback contract explicit: finite symbolic
    operations only, with blocking I/O and third-party callback code requiring a
    future killable subprocess boundary.
  • Add opt-in response-hardening profiles and typed modern browser policy fields
    without changing the default response behavior.
  • Add validated request-aware CORS, local preflight handling, correct dynamic
    Vary, and live listener evidence that preflights do not reach the origin.
  • Add bounded Retry-After guidance to generated capacity-limit responses.

Compatibility Boundary

  • Fluxheim provides bounded capability mappings, not source-syntax or runtime
    compatibility with iRules, Lua/OpenResty, SPOE, or VCL.
  • New host capabilities that require blocking I/O or third-party native
    callback code remain out of process until a killable, bounded IPC runner is
    designed and proven.

Fixed

  • Strip the historical Proxy-Connection hop-by-hop header on native HTTP/1
    and HTTP/2 upstream paths through one shared header policy.
  • Strip Envoy, original-forwarding, Azure, Fly, proxy-user, and forwarded client
    certificate identity headers before trusted replacements are generated.
  • Treat the first Set-Cookie segment only as the cookie name/value pair, so
    cookies named Domain or Path are not mistaken for attributes.
  • Preserve closing quotes and trailing syntax while rewriting quoted exact-
    origin Refresh URLs.
  • Enforce CORS method allowlists on actual responses and serialize bounded
    Reporting-Endpoints dictionaries with strict keys and HTTPS collectors.

Security

  • Strip the distinct spoofable Client-IP identity header, including in
    privacy-mode request sanitization.
  • Reject repeated, embedded, and unbalanced quotes plus bracketed IPv4 in
    trusted X-Forwarded-For chains instead of normalizing malformed hops.
  • Make Forwarded construction fallible, use a typed HTTP/HTTPS protocol, and
    reject invalid host values before producing an upstream header.
  • Add a compile-gated fuzz target for trusted forwarding parsing, Forwarded
    construction, hop-by-hop policy, Refresh, and Set-Cookie rewrites.

Checksums And Signatures

  • Commit: e86a4ecc1c6dd7c2bf62f3920a643b5a44bfe06a
  • Local gate: GitHub CI green before tag; local release metadata checks passed
  • CodeQL/code scanning: no open release-blocking alerts before tag
  • Source archive checksums:
    • bd1e69759083bd082591821ee57934299f0878fff94686f2e2d8eff7862d3918 fluxheim-1.7.10.tar.gz
    • 7b32171a101fc105a6a1b2bcf05092177d28f66071df35e314ceefa2c5bf05f7 fluxheim-1.7.10.zip
  • Binary checksums:
    • x86_64:
      • d0da284b57d77d5699de4e25505e92db2ef9025e665fbd764b48d56fcbcc21cf fluxheim-1.7.10-full-x86_64-linux.tar.gz
      • 48186cc930922680fdc58d47aaf08e1a026d947181f50387bc15f4f72198cf86 fluxheim-1.7.10-cache-x86_64-linux.tar.gz
      • 337698ab3d79665ff4175daf0f223862a327ceaa95e02178a522ea80ca813e1f fluxheim-1.7.10-proxy-x86_64-linux.tar.gz
      • 52e330a6572e42178c642cf17908e68736924e141dd03565fe94c0f5dfe2661b fluxheim-1.7.10-php-x86_64-linux.tar.gz
      • eb35faa2a586f0a859f1e2a963b39ccbc44918df5f674778916b3151933cfa4d fluxheim-1.7.10-load-balancer-x86_64-linux.tar.gz
      • 52eed70769d9c488d1f9829bc1d9ffb6b166a0019eecafc5f0bfc23a12e5466e fluxheim-1.7.10-config-tester-x86_64-linux.tar.gz
    • aarch64:
      • 06ee8c79689245c5ad07a383c34c4287332d20ae8141ed39641951bc45166b21 fluxheim-1.7.10-full-aarch64-linux.tar.gz
      • c6f94884f34e978a426fb6be2efc5f2955188b636bf3e9e47df7ffefc6d8880b fluxheim-1.7.10-cache-aarch64-linux.tar.gz
      • ca6d9121ff08c02812aef7a6bd21548136f92720820592c3527a9c8024789532 fluxheim-1.7.10-proxy-aarch64-linux.tar.gz
      • 99862e52782702013cb9fee2932cda053b74e3b6cc913b540d26f87274f2f8de fluxheim-1.7.10-php-aarch64-linux.tar.gz
      • a1623f4dea00de896b618c55e2573c209a36595df21848db174521e05dd6d8f8 fluxheim-1.7.10-load-balancer-aarch64-linux.tar.gz
      • 87b9490f8c86e1252d8653fac3c14c9f754b27154346f0b49dabd133417c1a54 fluxheim-1.7.10-config-tester-aarch64-linux.tar.gz
    • macos:
      • b4ee10f598e76cf4ac8676aa3e8fcc0069bfb2924b4b42dcd270202c3c0afa34 fluxheim-1.7.10-dev-aarch64-macos.tar.gz
  • SBOM checksums:
    • 0d01222bde0b5964cfab329e8be3e142c15678a1071d04e59a9b52e2795ac256 fluxheim.spdx.json
    • d8c81f48767bf2c1180bb388f88fdd1676f3931212d138d081dc0428348782e7 fluxheim.cyclonedx.json
  • Reproducible build:
    • 373492627f919df004bb21708edcfec192a156fbb056a45375c1d1b640d7889e x86_64
    • 8520afc5b115ca34c56580b77700110a0b517c35946aeb929996091b5c1587a8 aarch64
    • ec027dec96121d999bb838c336abf953e8d21c3cbee5a129cec2b87d9c910826 macos
  • Full Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:38d2ca30f3a9dd2fa3a2a684807303f3890d6f7972e995841b0a59409185a820
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:bf07f44ff76f2ec694a10cc076fa67ece4d1ccd134c9fb2db63871495c6d08ad
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:35a6df827d93638e09110b61f15cdc7aa277bc65db513fbffefce94625b5f993
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:136d8df87a78a080aba7bc801e9b933ef330bebf9a0856dcdcf3dfd9e890d75c
  • Cache Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:20a8c0ebe8cb728b45a8282bf9008849b463d26620d92bb8b25ab167acdcf927
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:1aeb39c1199095c122673331bb1e8386eca541d628cde2396722695fcdbb88b8
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:60ac6b9771453199ccb0812b652b2fa5b35e18beebf8e814dc41dddac3991ea5
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:64f896f74790f6e57a2e9767ac144fa9a4f7d7e4a88489d6ae10fa162c7a44a3
  • Proxy Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:4122f60b2218ee317187cf7806d2555c297453d0f6ea793d11f8d6049fd03ae5
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:8a99ab8fe7e6e5050ae1564b544f338fadae0d6e48308beb764654781db197b6
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:50b58a2f4ab9a5d6d7191721fe9c5cb1a1941187f9f020ba80219758381723c8
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:34dce0b19c44edf46ef8479dcf7b4271ddf69f6c320b092a1e5581e31e2c0b02
  • PHP Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:415abd0c52cffa04ec5d54cb782868446659cc2002ca82384edb487c19352e3d
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:20b807219c4c1216046e24aacf45bf8fc919feb39cb3c60fa8e4f987ef7f79ac
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:93a96b5750c8e766146df11079011e51e12733c9994cd77e4ecf37d1801ee255
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:21404682e73d54a2d43e0884816ba638bdef0d40a01495be4ef6a43a64cb41fd
  • Load Balancer Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:634c2b5d8864f175c953be96eca213ed5e2ed633c7949958f8648428814c3ec6
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:480ee28b1fa4366826f38ef8047a5cea7199a89fdcb262e43e6b157a9a2a4cd9
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:0c11ff2d5299db0eed231cd7306e0090872b42bf2e5d4f02cb00ff89fb3241be
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:7b13d51089f533acff532e1e25f16f25e8262fcb8c40c8251634a9e246fc0207
  • Tag signature:
    • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Assets 16
Loading
0 Join discussion