Skip to content

Fluxheim 1.7.2

Choose a tag to compare

View all tags
@eldryoth eldryoth released this 05 Jul 07:16
· 171 commits to main since this release
Immutable release. Only release title and notes can be modified.
v1.7.2
This tag was signed with the committer’s verified signature.
eldryoth
SSH Key Fingerprint: EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Verified
Learn about vigilant mode.
fde1c7b
This commit was signed with the committer’s verified signature.
eldryoth
SSH Key Fingerprint: EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Verified
Learn about vigilant mode.

Fluxheim 1.7.2 Release Notes

Fluxheim 1.7.2 continues the optional WebAssembly extensibility line with the
first live native HTTP/1 request-header and response-header hook family. The
new hooks use a constrained fluxheim_policy_v1 host-call surface so plugins
can perform approved synthetic policy mutations without receiving raw headers,
bodies, filesystem access, network access, or admin APIs.

Highlights

  • Add live native HTTP/1 request-headers and response-headers Wasm hook
    execution for vhost and route attachments.
  • Extend fluxheim-wasm with bounded integer host functions while preserving
    the existing fuel, memory, table, instance, compile-timeout, wall-time, and
    admission controls.
  • Add symbolic fluxheim_policy_v1 host calls for coarse request context,
    approved request header setting, approved response header setting, and
    approved response header removal.
  • Support the first nginx-Lua/OpenResty-style header-policy example: add an
    x-policy-tier request header before upstream forwarding, remove origin
    x-powered-by, and add x-fluxheim-policy-branch before the response is
    sent to the client.
  • Add live listener tests proving the upstream observes the plugin-added
    request header and the client observes the plugin-added response header.
  • Add fail-closed coverage for forbidden header mutations. Invalid host-call
    IDs trap the plugin invocation and return 503 unless the plugin is
    explicitly configured for fail-open behavior on a non-security phase.
  • Apply vhost-level Wasm header hooks to PHP-FPM fallback responses as well as
    route, static, and generic proxy paths.
  • Apply the shared fallback response header policy to PHP-FPM fallback
    responses, including the default x-powered-by removal.
  • Compute Wasm header-hook path context from the matched pre-rewrite request
    path so path-class policy stays stable when a route strips or rewrites the
    upstream target.

Security Notes

  • The header hook ABI is intentionally not a raw header API. Plugins receive
    only bounded symbolic inputs, such as a path class, and can request only
    allow-listed synthetic mutations.
  • Authorization, Cookie, Set-Cookie, request bodies, private keys,
    admin credentials, filesystem, network, and process APIs are not exposed to
    the current Wasm host-call surface.
  • Built-in Fluxheim ACLs and the access-decision chain still run before
    header hooks. Wasm header hooks cannot override built-in access policy.
  • PHP-FPM fallback traffic now goes through the same vhost-level header-hook
    and fallback response-header post-processing as other fallback response
    paths.
  • The wasm feature remains optional and is still rejected with
    privacy-mode.

Operator Notes

  • Plugins that use request-headers export
    fluxheim_request_headers() -> i32.
  • Plugins that use response-headers export
    fluxheim_response_headers() -> i32.
  • The current preview host calls live under the fluxheim_policy_v1 namespace
    and use integer IDs rather than strings. This keeps the surface auditable
    while the broader 1.7.x ABI settles.
  • General raw header read/write, body access, filesystem access, outbound
    network access, and Proxy-Wasm compatibility remain staged for later
    reviewed releases.

Checksums And Signatures

  • Commit: fde1c7b3ce8414632f2e15cde0eb812fdb9df8c0
  • Local gate: GitHub CI green before tag; local release metadata checks passed
  • CodeQL/code scanning: no open release-blocking alerts before tag
  • Source archive checksums:
    • c65a1a19e0ecf8edd9ced7416b5839d1a7804944bf127684a7a6b0db86742a1b fluxheim-1.7.2.tar.gz
    • f17fbd922e470d94262e79df0d517426b1feaf729857eae09410d02b3139bc03 fluxheim-1.7.2.zip
  • Binary checksums:
    • x86_64:
      • b4b83d66b7f733936506dc9e957d5bf3da16dc0e1eaf3af50e041f9dcba24f7c fluxheim-1.7.2-full-x86_64-linux.tar.gz
      • 00cbf1330e50b75696f569e7dca1149fdf6f78a80981637dd7d4ad92a96d240e fluxheim-1.7.2-cache-x86_64-linux.tar.gz
      • 5559ee5e86f2098e701da091cfb66066faf343b58826542d3f6f6670e59fb660 fluxheim-1.7.2-proxy-x86_64-linux.tar.gz
      • b4690b0ad67199753e17192b6c19bee49bd3feeed82f3c1a878d099db0b55f81 fluxheim-1.7.2-php-x86_64-linux.tar.gz
      • 58fddf50b2a6e902862f18e21be7c2989c075f2782fa9795fab0243e36bde7de fluxheim-1.7.2-load-balancer-x86_64-linux.tar.gz
      • 5e3fb0763cfb78b259a3d06121f5b0eaf9536770e8353e42b07a3ed61d2c8abc fluxheim-1.7.2-config-tester-x86_64-linux.tar.gz
    • aarch64:
      • cd97f8caf4cdb773e5197b82bb1f8e372f85318908e1ae3a28f4ea94be7b5f84 fluxheim-1.7.2-full-aarch64-linux.tar.gz
      • fd6633706645655ed015a3f4fac2db20fb8c025a27b9491abd5ab8c325de8789 fluxheim-1.7.2-cache-aarch64-linux.tar.gz
      • f85685f8030d93863bfd45d8e6fab066dccd27a4015cb84f9425a407ff3487a7 fluxheim-1.7.2-proxy-aarch64-linux.tar.gz
      • 110e6ed5a33d89fbe384c569dd63fe92fc1ea5cde46c2509f08b203d0e57edd0 fluxheim-1.7.2-php-aarch64-linux.tar.gz
      • a4905717ba36c35ba2299a20ba5fd8d8134993404d1cfb4b396f701ab6b4fd88 fluxheim-1.7.2-load-balancer-aarch64-linux.tar.gz
      • 37b510687ca72e2a3c307ef382108f3aa8593a0f08d61ccab5e5907bf3d13e16 fluxheim-1.7.2-config-tester-aarch64-linux.tar.gz
    • macos:
      • a880a24d033fa5831cc85a180b9ecd58b7472ad9a6942682b64fa63e1c6a56d4 fluxheim-1.7.2-dev-aarch64-macos.tar.gz
  • SBOM checksums:
    • 9aca723f7ef19a82aaf691c0632ade3f64f01f6df2d132323bb3adfcbe6641ad fluxheim.spdx.json
    • ef68eb4f2ac94281342ec5a5f917630238ea66b68a76da02bbe5b41684c1353e fluxheim.cyclonedx.json
  • Reproducible build:
    • e2a17c4665f86743d6a7eb7ee40b977e16afd9e6d3b097e171eb04966e91b282 x86_64
    • 34b1f9cca8c81cceb11cf86aefc14370d0a77bef20e2d7f93991a0fbbdd9ca8f aarch64
    • 399544ecc371b59bc566e61790a237b7a787b4c908b94f02834cf256e328d82a macos
  • Full Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:a3cb85b8401750f0183a6a63af4b46deb740040b1dedb66349ec55d97c7e3355
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:5649a4436cdc003f16b52e06ca3a96de1ac13a4f01e43a084d34d1f0d0d65332
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:0d44f8b54697f1402066a8de239337e3d3265dea819a0f6417d38b96a38327cc
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:1b2deff826c8ebfe119eb229f0fec2cb25babd6027bfff8c1370da13eca36737
  • Cache Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:2064368e5248a1e27825f06e6e48596a85d43ec12a06a111218b8d6b59981c0c
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:06bf0d96c3b0a5c087d2ddce679612cf4fb965aead869f7101af9188a2362805
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:c677b279fe4f84842f4fe15ac3125289f436eb27f11d9905d256fd8e3bf5404f
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:f6bdf5812eaddbb404ef78b641a9ee8218b477efc82910bba81a99e4b7e5031e
  • Proxy Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:128c1519351d0095b93385d27a3428f0d1757dbf3019ac097e96a7fddc44cec8
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:5c03e80522160f8acfd80c5a7464b2522d53885494e3619ed02236492d10fa81
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:c84af332879a8891bdeb6b98968144701ba84f95cca61727a0fe0b2659e74181
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:34442017d995693e7c6bd369a580896780ec0b0bab2eee04e73171b0bb328e5e
  • PHP Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:2c09eb70ff905832a1b2494e3dec34300e11aa06b3e90f15f8ffac568d307744
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:56f5acc9e9e457afcddfdd94e0dd951abb2292e64514818b83175c183fefa099
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:dd392e96412c95190dbce9091ff42b5443f5b9e9fe68ca182b5286bffc7bf823
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:0916aca64a6e334f3f628bab10b55fed555ea15c6732eb15677cf03ccd5af59f
  • Load Balancer Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:dc9f960f5aba7e14ac0061e9994996d181aefd904bb2f944efdfcfba5c0a0ab3
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:0b135998cbd4c6c2c1dc307950160560aa29fe48779247174185e3a557d28428
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:03006c175fe9cce9389445c3bd794e75327416d9cca76429bcbf2309d740fc2c
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:ea4ebda63c577308951ce58fbd3958313e7102506f851fbdd815b8f4312b2b86
  • Tag signature:
    • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Assets 16
Loading
0 Join discussion