Skip to content

Fluxheim 1.7.3

Choose a tag to compare

View all tags
@eldryoth eldryoth released this 06 Jul 11:10
· 159 commits to main since this release
Immutable release. Only release title and notes can be modified.
v1.7.3
This tag was signed with the committer’s verified signature.
eldryoth
SSH Key Fingerprint: EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Verified
Learn about vigilant mode.
d406056
This commit was signed with the committer’s verified signature.
eldryoth
SSH Key Fingerprint: EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Verified
Learn about vigilant mode.

Fluxheim 1.7.3 Release Notes

Fluxheim 1.7.3 starts the HAProxy-Lua/SPOE-style routing-policy part of the
optional WebAssembly extensibility line. The first live route-decision hook is
intentionally constrained: plugins can continue, deny, or select a symbolic
configured route branch, but they cannot invent upstream addresses, bypass
route matching, or override built-in Fluxheim access policy.

Highlights

  • Add live native HTTP/1 route-decision Wasm hook execution for vhost and
    route attachments.
  • Add a bounded fluxheim_route_decision() -> i32 preview ABI under the
    existing fluxheim_policy_v1 host-call namespace.
  • Add symbolic request context for route decisions, including the existing path
    class plus bounded x-canary: 1 and x-mirror: 1 signals for the first
    configured-branch routing examples.
  • Add configured-route branch selection for the canary and mirror branches.
    Fluxheim accepts the decision only when a configured route with that name also
    matches the current request method and path.
  • Add live listener tests with two local origins proving a Wasm route decision
    can move a request from the standard route to the configured canary route.
  • Add live native load-balancer route coverage proving a Wasm-selected route
    still delegates backend choice to the configured Fluxheim load-balancer
    policy.
  • Add live managed-cookie persistence coverage proving a Wasm-selected
    load-balanced route still pins the backend through Fluxheim's configured
    persistence policy.
  • Add live traffic-mirror listener coverage proving a Wasm route decision can
    select an already configured mirror route without giving plugins dynamic
    shadow-target access.
  • Add fail-closed coverage for a plugin that selects an unavailable branch.

Security Notes

  • route-decision hooks cannot create destinations or bypass route matchers.
    A selected branch must map to an existing configured route with a matching
    method and path.
  • Built-in vhost ACLs, vhost rate limits, and vhost concurrency limits run
    before route-decision execution, so denied or shaped clients cannot spend
    the process-wide Wasm admission budget first.
  • Built-in preselected/decoded route ACLs run before route-decision
    execution, while selected-route ACLs and route-specific rate/concurrency
    limits run after the final route decision. A plugin-selected route cannot
    bypass its own configured route policy.
  • Selected-route body limits, redirect policy, and request/response header
    policy still apply after the Wasm decision selects a route.
  • If a plugin selects an unavailable branch, Fluxheim returns 503 rather than
    falling back silently.
  • Wasm module compilation now waits for a bounded compile slot with a condition
    variable inside the configured compile timeout instead of polling in 1 ms
    sleeps under startup/reload contention.
  • The wasm feature remains optional and is still rejected with
    privacy-mode.

Operator Notes

  • Plugins that use route-decision export
    fluxheim_route_decision() -> i32.
  • The initial preview return values are:
    • 0: continue with normal route selection;
    • 1: select the configured matching route named canary;
    • 2: deny with 403;
    • 3: select the configured matching route named mirror.
  • Direct backend pool/member choice, plugin-provided persistence-key choice,
    and dynamic mirror/shadow target decisions remain staged for later 1.7.x
    slices.
  • Refresh dependency pins for aws-lc-rs, bytes, maxminddb, zeroize,
    getrandom, arc-swap, and env_logger; base64-ng, sanitization,
    cargo security tools, smoke images, and GitHub Actions pins were checked and
    already current.

Checksums And Signatures

  • Commit: d40605659539632f184a01ea536e2f79e7c5fa31
  • Local gate: GitHub CI green before tag; local release metadata checks passed
  • CodeQL/code scanning: no open release-blocking alerts before tag
  • Source archive checksums:
    • 472f7ed39708f020cde7ccde01d109d9cde08090ffb8396190cf148a22806a50 fluxheim-1.7.3.tar.gz
    • bd82e4e10c242ba86663a0ef2b31b03a4bd796f641cc535ac07df831c7ad84ff fluxheim-1.7.3.zip
  • Binary checksums:
    • x86_64:
      • ac76cf1e38c9f6d110ab9e1a82651a41ff0600bf6cc8362e3b6e7e676d640ad3 fluxheim-1.7.3-full-x86_64-linux.tar.gz
      • 87e7e509f35e654b24d80f03829287d7f623ec58f41e1215b0bf3a3398ecfe5e fluxheim-1.7.3-cache-x86_64-linux.tar.gz
      • 06112b0e91bb985d470659b8315cc807f9fddae2fdfe140d3c586c050aab080b fluxheim-1.7.3-proxy-x86_64-linux.tar.gz
      • d2dd5bb649ca32a3e6437519a4d3bfa94a317323250909a5dc78f1e2546df592 fluxheim-1.7.3-php-x86_64-linux.tar.gz
      • e067b34f4aabc7b941e81b58e962043681f9f177d8c7cd6c284e96b163037ee7 fluxheim-1.7.3-load-balancer-x86_64-linux.tar.gz
      • cbe01af881f9cf0dafdcd4541ebe385132ccc940d6d18d5ee23a883b905a2bdd fluxheim-1.7.3-config-tester-x86_64-linux.tar.gz
    • aarch64:
      • 83d7bdf4cd3a48267faf1cc4aeaec085325a3db632ac419a9c6338847f306054 fluxheim-1.7.3-full-aarch64-linux.tar.gz
      • 07bc1317b5d9dc18e52cf6e242e120952c2b91ad82f231c63e120cf10660cc1d fluxheim-1.7.3-cache-aarch64-linux.tar.gz
      • b3ef93bd0452f1a6d1d4edc976e05dd3fb20b31a942280e1d632954afa718e2d fluxheim-1.7.3-proxy-aarch64-linux.tar.gz
      • 2aad1a1d455c4b270605a3be7b40b5ddc9b012a8c63910ebe0ed6183085de654 fluxheim-1.7.3-php-aarch64-linux.tar.gz
      • 5507d0bd781b458946371a23e9f2c15c8c44dea1cf76eb665d71bd0e9445b32a fluxheim-1.7.3-load-balancer-aarch64-linux.tar.gz
      • ed066af4cbfdce353021e53e5be355ca3968626ed13d232315dc22c48837fdad fluxheim-1.7.3-config-tester-aarch64-linux.tar.gz
    • macos:
      • 535cb3e9ceb46e45336c6d890bfddf61baa9b94a42e71928e1c5c83eec0ae7aa fluxheim-1.7.3-dev-aarch64-macos.tar.gz
  • SBOM checksums:
    • e2bf218c025acd5f691e76062f2223ad7f6167d60e10acddcc927b7823ba233e fluxheim.spdx.json
    • 6a469063e11fca5af15b909de7193750ed0d97af7a816e703ad173c6bf863f4f fluxheim.cyclonedx.json
  • Reproducible build:
    • 54b2c6baa21061bf55685a8d2b3f4983ec93188d7db4f1f5fd9dc691ce32440b x86_64
    • 61ab7b28bb374ba31ddbc1fec3fa949bd5fcd7b6a1e33421634488ca5fb9f254 aarch64
    • cf09cd6db45a5b4ac8c173b80762ae5f126c24103b5474039082589051bfbc60 macos
  • Full Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:30049a8decddc2cbba0b28af61c22c6567095acbe4f42209235b7f790442bf22
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:707a38b54b46b1a7333b62a1943cdf04c8e03c4fbafc964e3a22684c9fa11d3e
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:8d9475cc2efc77845978dff3b2911d0a71ca1a58085b4cc75a0bde4eb60174a4
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:0909da492f90b6c110f8bee83f2f0ffc10ec94513b8f100a5e93200cc94badaa
  • Cache Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:f1329ca0db6f2421048667cdf3b8812afc09e6773b84bd7fe24bb8d3fb972b3b
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:2478849264307489ae484c9441323bbec136703434b6e18e2104b20e3cc0f7ec
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:1b88e1036f09447008f2fc0d1ebe0a02e80e1a87bdfa76fce04f17e7bfb77bbf
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:0208ea8b86d409390b698706c6a3834024f6b76958a362b5941b74c453711dae
  • Proxy Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:2e39f5126f6840ebfb9f9c8c59d661df57385edb270daa85e01cb7d242617f3c
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:25380d5a9a5c156cb2af21cfeae968bdc9d03d267046053101a15d9d4bfb309b
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:5b0cbe914807346e90a68e7df720426b485c9e826b527dbb15670827d4289a0d
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:118ce74ecf4b3a08760baa2918471061c4b5f29c1abd2405274f86a555e0dc5b
  • PHP Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:09b23f9d2acdfb0efd48cdc70fd9da131b73690276db9c91bbe8fb9a1b080e94
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:6474f973a8b0c228e510f8133fd1729aeb5692e544e83a10d9cd623dab89b1f4
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:09eb9fd2d399250529283d85c84d07956f45ce9e4b936e4a745dfadf6d817ebf
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:486d6a5c6e1321e77b8be3ba79750d58f246acf1b6f985f9e6a31d3d69d7614a
  • Load Balancer Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:1afa3c43f841365fcb8922252699f9f7140d2ac0c36d94688936391c98296df1
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:2f67c0c911846347423d2652a30e386fc0235e768ea90f5bf0f076474e2f33d4
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:276591dd49fa339d613edc348fe97cb2f86477c37897a4c4034aa4f3161c84aa
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:4db34538477dde07a5fe8d4234f71cee6d10d59abeff116db93655b299674cb6
  • Tag signature:
    • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Assets 16
Loading
0 Join discussion