Skip to content

Fluxheim 1.7.4

Choose a tag to compare

View all tags
@eldryoth eldryoth released this 07 Jul 14:07
· 154 commits to main since this release
Immutable release. Only release title and notes can be modified.
v1.7.4
This tag was signed with the committer’s verified signature.
eldryoth
SSH Key Fingerprint: EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Verified
Learn about vigilant mode.
befc640
This commit was signed with the committer’s verified signature.
eldryoth
SSH Key Fingerprint: EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Verified
Learn about vigilant mode.

Fluxheim 1.7.4 Release Notes

Fluxheim 1.7.4 starts the VCL-like cache-policy part of optional WebAssembly
extensibility. The first live cache hook is intentionally constrained: plugins
can decide whether cache lookup proceeds, passes through origin, bypasses
cache, skips storage after an origin response, or denies, but cannot yet mutate
raw keys, TTLs, tags, response headers, or stored metadata.

Highlights

  • Add live native HTTP/1 cache-lookup Wasm hook execution for vhost and route
    attachments.
  • Add live native HTTP/1 cache-store Wasm hook execution after origin
    response and before memory/disk cache writes.
  • Add a bounded fluxheim_cache_lookup() -> i32 preview ABI under the existing
    fluxheim_policy_v1 host-call namespace.
  • Add cache lookup outcomes:
    • 0: continue normal cache lookup and storage;
    • 1: pass through origin without lookup or storage;
    • 2: bypass cache lookup and storage;
    • 3: deny with 403.
  • Add cache store outcomes:
    • 0: continue normal cache storage;
    • 1: serve the origin response but skip storage;
    • 2: deny with 403.
  • Apply cache-lookup hooks before native proxy-cache slice lookup, normal
    lookup, peer-fill, request collapsing, origin-fill protection, and store
    admission.
  • Thread selected route/vhost Wasm hooks into route-proxy cache paths so cache
    decisions use the same attachment model as access, header, and route hooks.
  • Add wasm.max_total_cache_concurrent_executions as a separate process-wide
    admission ceiling for cache-lookup and cache-store hooks.
  • Add live listener tests proving a plugin can pass /api/* without storing
    while normal cacheable paths still produce MISS then HIT.
  • Add live listener tests proving a plugin can skip storage after an origin
    response and deny before cache write/client delivery.
  • Add live listener coverage proving a later cache-store deny wins over an
    earlier skip.
  • Add fail-closed live coverage for cache-lookup deny behavior.

Security Notes

  • The cache-policy hooks are constrained to integer outcomes and coarse path or
    response-status context. They do not expose raw headers, bodies, filesystem,
    network, admin APIs, private keys, cache-key bytes, or cached object bodies.
  • Built-in access policy, rate limits, concurrency limits, route selection, and
    header policy keep their normal order; the cache hook cannot bypass them.
  • Cache hooks use their own process-wide cache admission ceiling so hot
    cache-policy routes cannot starve access-decision, route-decision, or header
    hooks on unrelated vhosts.
  • Cache-store hook chains are most-restrictive-wins: every hook runs unless a
    hook returns deny, and deny wins over an earlier skip.
  • Plugin execution failures still follow the configured fail mode:
    fail-closed denies with 503, while fail-open continues normal cache
    behavior.
  • The wasm feature remains optional and is still rejected with
    privacy-mode.
  • The release gate updates crossbeam-epoch to 0.9.20 to clear
    RUSTSEC-2026-0204.

Operator Notes

  • Plugins that use cache-lookup export fluxheim_cache_lookup() -> i32.
  • Plugins that use cache-store export fluxheim_cache_store() -> i32.
  • pass and bypass outcomes report x-cache-status: BYPASS with
    x-cache-reason: wasm-pass or wasm-bypass when cache status headers are
    enabled.
  • pass and bypass share the external BYPASS cache status but record
    distinct cache-policy activity as pass and bypass.
  • Richer cache-policy hooks for bounded cache-key components, TTL override,
    tag assignment, store-admission mutation, and safe response-header mutation
    remain staged for later 1.7.x slices.

Checksums And Signatures

  • Commit: befc640024b3718e490ba5b5744d1726371f6acf
  • Local gate: GitHub CI green before tag; local release metadata checks passed
  • CodeQL/code scanning: no open release-blocking alerts before tag
  • Source archive checksums:
    • 73c21bd501c6067477b7478a8d2147133646763dc743a07b81694bd0b8308763 fluxheim-1.7.4.tar.gz
    • 7dd086c160f49b1ca7b59149f916ece9d0c29fe4cd7a592e4669c12cbac23900 fluxheim-1.7.4.zip
  • Binary checksums:
    • x86_64:
      • c24bfda56df17a3b0fea6c5d7984d5234d2985f98d97836209bccb62876d033a fluxheim-1.7.4-full-x86_64-linux.tar.gz
      • ae310dcaae7873b337d12eafeeabb5445fe9ae1a37b5ab9230895e60188d4753 fluxheim-1.7.4-cache-x86_64-linux.tar.gz
      • cb2683a7e29a5ce4a990b5f0bce216a518ff687624c0575e3fc7739f7fbf95a4 fluxheim-1.7.4-proxy-x86_64-linux.tar.gz
      • c608addb563b38e729e31c7e6d8b3be0e68a2976a61e7b17137dbf0d406c06d7 fluxheim-1.7.4-php-x86_64-linux.tar.gz
      • 33feefe76ab7082c5b19581d2c3525dce4b6a48c22c87430fd12bb4a5eabcf91 fluxheim-1.7.4-load-balancer-x86_64-linux.tar.gz
      • b28007bbf0778a023141c5de7a2faaa865031890a5ea6d3e710c4493f2199da3 fluxheim-1.7.4-config-tester-x86_64-linux.tar.gz
    • aarch64:
      • a0c62b041b7f261dbcf4d23f507c36e87305439ba661894952c4afc97c9871cb fluxheim-1.7.4-full-aarch64-linux.tar.gz
      • 3ea635b2ff883a84dd453521a51445f1651151152b9e14082cad0192ce29d744 fluxheim-1.7.4-cache-aarch64-linux.tar.gz
      • 9ede717945867b9edabda103b81b701ff589484b9128ef00372adec5d9f98531 fluxheim-1.7.4-proxy-aarch64-linux.tar.gz
      • d4ccdf264d72b0811d56513eef244015fd9550b6e5e517662d2915a4999f2e80 fluxheim-1.7.4-php-aarch64-linux.tar.gz
      • 666ca2a57fb51716b532cd642a84f5964f7c68a47141205135a76193a5593b27 fluxheim-1.7.4-load-balancer-aarch64-linux.tar.gz
      • a728616b18ff81e86cf4c3bb4135e357cb9bb2fb0feb922110e1af6c701800a6 fluxheim-1.7.4-config-tester-aarch64-linux.tar.gz
    • macos:
      • 5131694028fe19c4d4918745814f9d8e35ec8ff176ab24c6bec9d3c7b58c4ddf fluxheim-1.7.4-dev-aarch64-macos.tar.gz
  • SBOM checksums:
    • 621d1868a28d782a439c252d1a4bb7b1511b3e5c5e88b1527a32594fb0010e41 fluxheim.spdx.json
    • 6a0a727a2814c6ddf91d965d38ede300e51c6d168e8dbbcd8d37e770ee84ddc6 fluxheim.cyclonedx.json
  • Reproducible build:
    • cb13c979cb1fcf036cab9a69bdee22949946d9bceb85f966b12844fd174bdbd1 x86_64
    • f5f6b2338628c3ef525a3b0ae7c0da8fe9ae4d0948247510a685b1ca2a185d01 aarch64
    • 8ef32281b2227cf23e337d5e00344b14a80be8505d51e6ea0013250fa4e5c465 macos
  • Full Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:398d019d80aa15cfe26506506dba67f67b3e1a3583a17bb894af2288945e76b9
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:634cab1db3054b01750a25c65f9c7baa244ec93240ee0b90081d67f1c37f4981
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:b3221a2d5910ec08a779cd024920defe715fbc9643ca653592d239e46ac71f1d
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:c220b2c6b58561f43f391b964a1226a1b9cc31ff859195a01beed4dc4a8d6091
  • Cache Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:5e7475427223812a04e54ea72517ffc97a2b3fce88f91341f34e0e93641b0b34
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:ed9222cc22773ca54a6517d6701ab90b991ca017651a66d56e904c2f29125320
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:6e6fcb4d88f0ee0470c61bd68622f9728db1a33b1271a1c07ff934c034e27426
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:284f65e27589ecf6e3b9f4d41c342749b53ce09405d2f813bce70ad075f300bc
  • Proxy Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:541a33fa75070779d397a6befe950d869c2cdc842658ebe0ec5039ff0c766231
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:19b648c78277770a13e7366ebdee181334b9dcfcd22e30a8295f81986168cc89
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:1bf0212048daa4fbda4479fffd526b66797a5cb3875d68834aeb03bb678be0f5
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:cd5fc3880948367dec623b3133e150f324faf141d23147d5b1906399618b41f4
  • PHP Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:bf1c533b2ba75bca8b97d2d94b6b73f72f62d3a3e99c161b287b35b1a18c6d96
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:65a3452a111107c81d6253cbab35e616fee5c4be48ced1a5ca4b71671b22eb44
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:bbeafeb00f8303d593e8f7b1145b54b52b935d8bad6a61bf42f121d76d30f3c5
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:81a159f9bc07df0302aa2a588e057eaf9ee4b9f57c5d8eac7d8c26972ac9d527
  • Load Balancer Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:1cc26ae633ed681f9c8ae2d56285fdeeecbcea956a3129aa9e78d2f4decc02d4
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:09521f3c366001644bb81fffd85fe41b62e604e83095038936ee918edfd45006
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:457f2783d0c2d0272557646935b0a43f9ef3c8378fab9a5754956342305efe46
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:171e2b339403aca700a857af40f573b9d94cb30045d9c4c9588da3dac4d3eda5
  • Tag signature:
    • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Assets 16
Loading
0 Join discussion