Fluxheim 1.7.10

[eldryoth]

Fluxheim 1.7.10 Release Notes

Fluxheim 1.7.10 is the stabilization and release-gate hardening release for
the 1.7 WebAssembly policy line. It turns the documented migration examples
into explicit operator-selectable and release-gated acceptance evidence while
keeping the typed policy ABI constrained.

Added

• Expose focused scripts/test_starter.py entries for F5 iRules-style,
  nginx Lua/OpenResty-style, HAProxy Lua/SPOE-style, and VCL-like Wasm policy
  examples.
• Keep focused and aggregate Wasm policy checks on one implementation path,
  and validate that the deep release gate requires the complete Wasm smoke.
• Audit every guest-controlled symbolic ID decoder for total, panic-free
  behavior over arbitrary integer inputs.
• Make the in-process native host-callback contract explicit: finite symbolic
  operations only, with blocking I/O and third-party callback code requiring a
  future killable subprocess boundary.
• Add opt-in response-hardening profiles and typed modern browser policy fields
  without changing the default response behavior.
• Add validated request-aware CORS, local preflight handling, correct dynamic
  Vary, and live listener evidence that preflights do not reach the origin.
• Add bounded Retry-After guidance to generated capacity-limit responses.

Compatibility Boundary

• Fluxheim provides bounded capability mappings, not source-syntax or runtime
  compatibility with iRules, Lua/OpenResty, SPOE, or VCL.
• New host capabilities that require blocking I/O or third-party native
  callback code remain out of process until a killable, bounded IPC runner is
  designed and proven.

Fixed

• Strip the historical Proxy-Connection hop-by-hop header on native HTTP/1
  and HTTP/2 upstream paths through one shared header policy.
• Strip Envoy, original-forwarding, Azure, Fly, proxy-user, and forwarded client
  certificate identity headers before trusted replacements are generated.
• Treat the first Set-Cookie segment only as the cookie name/value pair, so
  cookies named Domain or Path are not mistaken for attributes.
• Preserve closing quotes and trailing syntax while rewriting quoted exact-
  origin Refresh URLs.
• Enforce CORS method allowlists on actual responses and serialize bounded
  Reporting-Endpoints dictionaries with strict keys and HTTPS collectors.

Security

• Strip the distinct spoofable Client-IP identity header, including in
  privacy-mode request sanitization.
• Reject repeated, embedded, and unbalanced quotes plus bracketed IPv4 in
  trusted X-Forwarded-For chains instead of normalizing malformed hops.
• Make Forwarded construction fallible, use a typed HTTP/HTTPS protocol, and
  reject invalid host values before producing an upstream header.
• Add a compile-gated fuzz target for trusted forwarding parsing, Forwarded
  construction, hop-by-hop policy, Refresh, and Set-Cookie rewrites.

Checksums And Signatures

• Commit: e86a4ecc1c6dd7c2bf62f3920a643b5a44bfe06a
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • bd1e69759083bd082591821ee57934299f0878fff94686f2e2d8eff7862d3918 fluxheim-1.7.10.tar.gz
  • 7b32171a101fc105a6a1b2bcf05092177d28f66071df35e314ceefa2c5bf05f7 fluxheim-1.7.10.zip
• Binary checksums:
  • x86_64:
    • d0da284b57d77d5699de4e25505e92db2ef9025e665fbd764b48d56fcbcc21cf fluxheim-1.7.10-full-x86_64-linux.tar.gz
    • 48186cc930922680fdc58d47aaf08e1a026d947181f50387bc15f4f72198cf86 fluxheim-1.7.10-cache-x86_64-linux.tar.gz
    • 337698ab3d79665ff4175daf0f223862a327ceaa95e02178a522ea80ca813e1f fluxheim-1.7.10-proxy-x86_64-linux.tar.gz
    • 52e330a6572e42178c642cf17908e68736924e141dd03565fe94c0f5dfe2661b fluxheim-1.7.10-php-x86_64-linux.tar.gz
    • eb35faa2a586f0a859f1e2a963b39ccbc44918df5f674778916b3151933cfa4d fluxheim-1.7.10-load-balancer-x86_64-linux.tar.gz
    • 52eed70769d9c488d1f9829bc1d9ffb6b166a0019eecafc5f0bfc23a12e5466e fluxheim-1.7.10-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • 06ee8c79689245c5ad07a383c34c4287332d20ae8141ed39641951bc45166b21 fluxheim-1.7.10-full-aarch64-linux.tar.gz
    • c6f94884f34e978a426fb6be2efc5f2955188b636bf3e9e47df7ffefc6d8880b fluxheim-1.7.10-cache-aarch64-linux.tar.gz
    • ca6d9121ff08c02812aef7a6bd21548136f92720820592c3527a9c8024789532 fluxheim-1.7.10-proxy-aarch64-linux.tar.gz
    • 99862e52782702013cb9fee2932cda053b74e3b6cc913b540d26f87274f2f8de fluxheim-1.7.10-php-aarch64-linux.tar.gz
    • a1623f4dea00de896b618c55e2573c209a36595df21848db174521e05dd6d8f8 fluxheim-1.7.10-load-balancer-aarch64-linux.tar.gz
    • 87b9490f8c86e1252d8653fac3c14c9f754b27154346f0b49dabd133417c1a54 fluxheim-1.7.10-config-tester-aarch64-linux.tar.gz
  • macos:
    • b4ee10f598e76cf4ac8676aa3e8fcc0069bfb2924b4b42dcd270202c3c0afa34 fluxheim-1.7.10-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • 0d01222bde0b5964cfab329e8be3e142c15678a1071d04e59a9b52e2795ac256 fluxheim.spdx.json
  • d8c81f48767bf2c1180bb388f88fdd1676f3931212d138d081dc0428348782e7 fluxheim.cyclonedx.json
• Reproducible build:
  • 373492627f919df004bb21708edcfec192a156fbb056a45375c1d1b640d7889e x86_64
  • 8520afc5b115ca34c56580b77700110a0b517c35946aeb929996091b5c1587a8 aarch64
  • ec027dec96121d999bb838c336abf953e8d21c3cbee5a129cec2b87d9c910826 macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:38d2ca30f3a9dd2fa3a2a684807303f3890d6f7972e995841b0a59409185a820
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:bf07f44ff76f2ec694a10cc076fa67ece4d1ccd134c9fb2db63871495c6d08ad
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:35a6df827d93638e09110b61f15cdc7aa277bc65db513fbffefce94625b5f993
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:136d8df87a78a080aba7bc801e9b933ef330bebf9a0856dcdcf3dfd9e890d75c
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:20a8c0ebe8cb728b45a8282bf9008849b463d26620d92bb8b25ab167acdcf927
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:1aeb39c1199095c122673331bb1e8386eca541d628cde2396722695fcdbb88b8
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:60ac6b9771453199ccb0812b652b2fa5b35e18beebf8e814dc41dddac3991ea5
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:64f896f74790f6e57a2e9767ac144fa9a4f7d7e4a88489d6ae10fa162c7a44a3
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:4122f60b2218ee317187cf7806d2555c297453d0f6ea793d11f8d6049fd03ae5
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:8a99ab8fe7e6e5050ae1564b544f338fadae0d6e48308beb764654781db197b6
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:50b58a2f4ab9a5d6d7191721fe9c5cb1a1941187f9f020ba80219758381723c8
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:34dce0b19c44edf46ef8479dcf7b4271ddf69f6c320b092a1e5581e31e2c0b02
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:415abd0c52cffa04ec5d54cb782868446659cc2002ca82384edb487c19352e3d
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:20b807219c4c1216046e24aacf45bf8fc919feb39cb3c60fa8e4f987ef7f79ac
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:93a96b5750c8e766146df11079011e51e12733c9994cd77e4ecf37d1801ee255
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:21404682e73d54a2d43e0884816ba638bdef0d40a01495be4ef6a43a64cb41fd
• Load Balancer Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:634c2b5d8864f175c953be96eca213ed5e2ed633c7949958f8648428814c3ec6
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:480ee28b1fa4366826f38ef8047a5cea7199a89fdcb262e43e6b157a9a2a4cd9
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:0c11ff2d5299db0eed231cd7306e0090872b42bf2e5d4f02cb00ff89fb3241be
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:7b13d51089f533acff532e1e25f16f25e8262fcb8c40c8251634a9e246fc0207
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

---

This discussion was created from the release Fluxheim 1.7.10.