Skip to content

Fluxheim 1.8.0

Latest
Latest

Choose a tag to compare

View all tags
@eldryoth eldryoth released this 23 Jul 15:53
· 1 commit to main since this release
Immutable release. Only release title and notes can be modified.
v1.8.0
This tag was signed with the committer’s verified signature.
eldryoth
SSH Key Fingerprint: EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Verified
Learn about vigilant mode.
c742f04
This commit was signed with the committer’s verified signature.
eldryoth
SSH Key Fingerprint: EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Verified
Learn about vigilant mode.

Fluxheim 1.8.0 Release Notes

Fluxheim 1.8.0 packages the completed Wasm extensibility line as an explicit
distribution profile and begins a shared portable archive contract for Linux,
macOS, and Windows.

Wasm Distribution Profile

  • Add profile-wasm as profile-full plus the reviewed proxy-ABI and WASI
    capability surfaces.
  • Keep profile-full and the unsuffixed full container image Wasm-free.
  • Add dedicated wasm container-image and binary-archive profiles with ACME,
    metrics, and OpenTelemetry support matching the full production package.
  • Require an explicit read-only plugin mount such as
    /srv/infra/fluxheim/plugins:/etc/fluxheim/plugins:ro,Z; no operator plugin
    is embedded in the image.
  • Document that container read-only mounts do not protect their host source,
    require hash pinning for every production module, and recommend
    digest-pinned derivative images containing reviewed modules for
    high-assurance deployments.

Portable Archives

  • Generate .tar.gz and .zip from the same staged release directory.
  • Add per-profile archive selection so the Wasm artifact can be built and
    tested independently.
  • Preserve a common archive naming and content contract as the basis for
    unsigned macOS and Windows portable releases.
  • Validate the same seven public profile names, Cargo feature sets, and binary
    layout across Linux, macOS, and Windows, including .exe naming on Windows.
  • Generate and validate the archive matrix through one native Python planner
    consumed by the POSIX asset builder, avoiding WSL-versus-Git-Bash command
    resolution on Windows, and use portable package-version extraction in both
    native archive jobs.
  • Build representative full and wasm archives on native macOS CI while
    keeping Windows at archive-plan and fail-closed config-boundary validation
    until native runtime and archive work begins in 1.8.2.
  • Compile Windows configuration and admin-socket planning without relying on
    Unix-only symbols, while keeping configuration-file loading fail-closed
    until Windows owner and ACL trust checks are implemented in 1.8.2.
  • Fix the release helper's --profile all state handling so one completed
    profile cannot suppress the remaining six archives.
  • Keep signed/notarized macOS packages and Authenticode/MSI/MSIX delivery
    deferred until company-backed publisher credentials exist.

Verification

  • Validate that profile-full cannot accidentally enable Wasm.
  • Validate that the image and archive matrices retain the dedicated Wasm
    profile.
  • Extract the Wasm release tarball and run the real F5 iRules-style,
    nginx/OpenResty-style, HAProxy Lua/SPOE-style, and VCL-like cache-policy
    examples through the packaged binary.
  • Build the dedicated Wasm Wolfi image, mount a hash-pinned policy module
    read-only at /etc/fluxheim/plugins, prove writes fail inside the container,
    and exercise live allow/deny decisions.
  • Prove configured request-header variance partitions fixed-slice cache objects
    and reject response-only slice variance that cannot be known at lookup time.
  • Prove a concurrent 32-request burst for one missing range slice produces one
    origin fetch when cache locking is enabled.
  • Prove ordinary and fixed-slice cache-fill waiters cannot miss a fast writer
    notification and receive a bounded retryable 503 after one total wait
    deadline without creating another origin request.
  • Bound runtime and inspection Vary keys to one SHA-256 component regardless of
    permitted request-header value length.
  • Prove non-cache Wasm admission is partitioned per vhost beneath the native and
    preview process-wide ceilings, matching the existing cache-hook isolation.
  • Run a native Windows regression proving unsupported filesystem ownership and
    ACL trust checks return an error rather than silently accepting a config
    path.
  • Keep Unix descriptor-relative cache storage out of Windows profile builds
    until the native Windows filesystem implementation is reviewed in 1.8.2.
  • Compile and test the full workspace against sanitization 2.0, including
    request-body clearing, TLS and ACME secret input handling, snapshot
    integrity, administrative authentication, and persistence-cookie checks.
  • Build RPM evidence from the exact release-candidate tree instead of remote
    main, and tag both FIPS backend evidence images with the candidate package
    version.

Security Notes

  • Record the ACME provider's opaque active signing-key representation as an
    accepted upstream residual. Fluxheim clears its transient PKCS#8 copies but
    does not claim provider-owned key-state zeroization.
  • Apply the existing per-key cache-fill gate to fixed range slices, preventing
    same-slice origin stampedes.
  • Register cache-fill notifications before releasing shared state, and enforce
    one total waiter deadline across ordinary and fixed-slice fills.
  • Tune cache-lock waits above normal upper-tail origin latency but below
    surrounding request deadlines, with age_timeout_secs no shorter than the
    intended waiter budget.
  • Replace variable-width encoded Vary material in cache keys with a fixed-width
    SHA-256 digest. Persisted variants using the prior key format become cold and
    age out or can be purged.

Checksums And Signatures

  • Commit: c742f04806881baaf2ace05a29f0b37274c4893f
  • Local gate: GitHub CI green before tag; local release metadata checks passed
  • CodeQL/code scanning: no open release-blocking alerts before tag
  • Source archive checksums:
    • 0a8a3cbcfa50a59106915d2e8c9b3515b50d7fbc18a2af1aecbd94e609fd151f fluxheim-1.8.0.tar.gz
    • 3f85ac8cbe705d6837c129d63aad4bd546dde856f1718a17e5333aafa0d7d984 fluxheim-1.8.0.zip
  • Binary checksums:
    • x86_64:
      • 28adc45a0bb0ef927553ccff642a0c90fb33413f0284f0394f802fa6b8dfaed3 fluxheim-1.8.0-full-x86_64-linux.tar.gz
      • c2d05bd1773cf3a91fc181751031727d6139a0397dc73ac96e9925e1035b0cbf fluxheim-1.8.0-wasm-x86_64-linux.tar.gz
      • 7ce9cddf7f928e7cc0964f7042da588a0bc72a8a5df9471913ddea17633c4125 fluxheim-1.8.0-cache-x86_64-linux.tar.gz
      • 43751d81060cc64fe74c7c00bce60bfa07fe03bed974eb042e5ccc46ed2698b3 fluxheim-1.8.0-proxy-x86_64-linux.tar.gz
      • f5ff81d82dfa18b202a802ef9690f3ceab73f74c11dd10b0226cb8e8c065294f fluxheim-1.8.0-php-x86_64-linux.tar.gz
      • d2760f90ee88b8694d0cbf77b0672ca1e8168eb3f413479e295f6317a843d514 fluxheim-1.8.0-load-balancer-x86_64-linux.tar.gz
      • 1017ac8aa1d60d3292911be14a03dd64dba41c54677733c77bc46a1e1021e048 fluxheim-1.8.0-config-tester-x86_64-linux.tar.gz
    • aarch64:
      • 4187ff089c8eae80e8d69d0c6192d3cccb8d942a1be840120b668dbbdeaf5873 fluxheim-1.8.0-full-aarch64-linux.tar.gz
      • af42bb7b65b8539832834d013c5f004decd42351efbb3f2501afb1df42e7938f fluxheim-1.8.0-wasm-aarch64-linux.tar.gz
      • d876729ea999f43aa97d55707242f1c801123245159339e626cd82bbe93d3674 fluxheim-1.8.0-cache-aarch64-linux.tar.gz
      • 57da93d2aed30e97c7fef9b6709ce85f104b611fce5c173afcbb6531986bd8dd fluxheim-1.8.0-proxy-aarch64-linux.tar.gz
      • 304e32569e9865135deea72531e91a7b69124971ad054e2804fb0d318a9f067c fluxheim-1.8.0-php-aarch64-linux.tar.gz
      • 284d4c6aeeed79d730bf2e5c240bda4cb573940a415f885692ec4ed3116bed14 fluxheim-1.8.0-load-balancer-aarch64-linux.tar.gz
      • 16572c27ef0c4f0f66b10efa9022472cbd9445a489a2e49a617b889623cf6962 fluxheim-1.8.0-config-tester-aarch64-linux.tar.gz
    • macos:
      • 4d79f18ad545f809d6298c3695dc404b9a6ef405627ed5d10b28915698bcd34c fluxheim-1.8.0-dev-aarch64-macos.tar.gz
  • SBOM checksums:
    • 491d4938bb89f0f6e49ce71a4f3cb0be64b3125ab0f4f9b1177fb988e1654d4c fluxheim.spdx.json
    • 64e2fa96894d861c1f66c35f081a37229ae3a9d25f1ce68bacd510684ae2d6ff fluxheim.cyclonedx.json
  • Reproducible build:
    • 2d5008e33460f650fc94bd76b1049d8e75c2be83a02dfe11ca7f0acc0e7a2a55 x86_64
    • ffe2aa0ab406a3144d4bc5a10cd19db1de195de8660012b634ddcdf3edb3a1a8 aarch64
    • 06e93ec6d8824823a30173e5161bb580f0210d5ea17f199e45593cb7748c1ef5 macos
  • Full Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:a682e09cbbd1b740b7347189e0d2b99e2706d8c654fa265e5929948e349cca05
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:2693e0a0224ddc907eb9bdad60b426a6a1451e9dfdfe53c0a11fd48087c160f9
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:3d6ebafbad12766cab4429317c9826804c60622a23f89aafeb234068ac32b03f
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:a975e3fa0d5feefb3e711bcf4f9aa4048cba19aa62a09a5864603dbf7cee9adb
  • Wasm Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:c42e29dc265c98cd8709968892ded0a00ddf9e45fe9db999d8d1bfd3726a4d1f
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:72fcb5c907b8febe8ac75e04a21ffe709e3c884560f77c86bb4283d1de678a67
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:36ba40df614c7ce15e073556691d07d27622281b02fff1731b1541fe0b1536f7
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:03f77de74c7547453877caff5d39c9727e7421048837e544808bbba22b0b6b63
  • Cache Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:08854c36ef96a79751cf1837c7d74610669bc97152e856fbc7e0d2032e312928
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:18166639730ac7f1862ad3a85ed29281809cbed6af7757aa4dc3d7c537b12299
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:2be9539d6c6259764b610b6783e2d6b0a27b660fdfd2a573a3963df86e0d9809
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:b6c475405479707765b495127c7fe52ab8f508565c2528cff1fe434b0be80a9b
  • Proxy Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:69d751d9102c34205c94443859014252a2af0df07b520e8836b59a5657cd1ac8
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:2292091dcd9153c38747d26c7a9f1b0d46d6584c954fd7da9b89efa8eae1cef8
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:76fd4c96bd2a881a08b01f131c31cbcc0662e0b7c3be73bd3ad150fd99ec5b14
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:09a6510fb1efae52e267288fe81701acdadfa08b0940aab0b60973a7f1bc05bb
  • PHP Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:0261b9c11d826ba44cb0b90b67af9838df06c31726b5fc7a55ed5cfd0e05c8dc
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:0d0083d2f01fc54d96d6004ff84bfca855e8d34912101f9e0e2a95b5d113496e
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:64d9ca2e706e066543b018abb73ab212c774e2ad53ee557f0d8bf60923b8037e
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:1f2683196479b972e599248cea7ea32e19ea3ac0459be1b4963ca1a4fc1f44e5
  • Load Balancer Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:47c7085e04d622b292fd21c6479d7c5c50d87275b69a12623bd7c768f47c9a49
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:37f54a81fc3f22e8fb2553d425673f5d73f8fa6133a264542c7e9fe66152c653
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:485e1c65bb611aa7292ce363d6ba58d2281b8baa85e1eddde9f9864e9ad8ddf4
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:ec1b6ce58871f221a02851a2fb646ce3e66337251aa45a58e6091e2e6c5fae57
  • Tag signature:
    • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Assets 18
Loading
0 Join discussion