Skip to content

Fluxheim 1.7.5

Choose a tag to compare

View all tags
@eldryoth eldryoth released this 08 Jul 09:53
Immutable release. Only release title and notes can be modified.
v1.7.5
This tag was signed with the committer’s verified signature.
eldryoth
SSH Key Fingerprint: EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Verified
Learn about vigilant mode.
c849e33
This commit was signed with the committer’s verified signature.
eldryoth
SSH Key Fingerprint: EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Verified
Learn about vigilant mode.

Fluxheim 1.7.5 Release Notes

Fluxheim 1.7.5 continues the VCL-like WebAssembly cache-policy milestone with
the first bounded cache-key and cache-store metadata hooks. The new host-call
surface is intentionally low-cardinality: plugins can add a symbolic
device-class cache variant, choose fixed TTL/tag metadata, and set one fixed
stored-object response header, but still cannot emit arbitrary key bytes or
mutate arbitrary cached response headers.

Highlights

  • Add a bounded set_cache_key_component(label_id, value_id) host call for
    cache-lookup Wasm hooks.
  • Add symbolic X-Device-Class context under context(5, 0) for cache-policy
    plugins.
  • Allow only the fixed wasm-device-class=mobile and
    wasm-device-class=desktop cache-key components in this slice.
  • Add bounded set_cache_ttl(ttl_id, 0) and add_cache_tag(tag_id, 0) host
    calls for cache-store Wasm hooks.
  • Allow only fixed TTL classes and fixed cache tags in this slice.
  • Add bounded set_cache_store_header(name_id, value_id) for cache-store
    hooks, limited to fixed x-fluxheim-cache-policy values.
  • Add bounded cache-store response content-type inspection through a symbolic
    context(6, 0) class, without exposing raw response headers.
  • Thread Wasm-selected key components through native static-upstream and
    load-balanced proxy cache lookup paths.
  • Thread Wasm-selected key components through fixed-slice range-cache keys so
    ranged mobile and desktop variants cannot share slice objects.
  • Thread Wasm-selected TTL/tag metadata through native cache storage without
    exposing arbitrary response-header mutation.
  • Thread fixed stored response-header metadata into the cached object while
    leaving the immediate origin MISS response unchanged.
  • Add live native HTTP/1 listener coverage proving one URL can cache separate
    mobile and desktop variants, then HIT the original variant.
  • Add live native HTTP/1 listener coverage proving Wasm-selected key
    components also isolate fixed-slice range-cache objects.
  • Add live native HTTP/1 listener coverage proving a plugin TTL override
    expires an otherwise max-age=60 object and refills from origin.
  • Add live native HTTP/1 listener coverage proving a plugin can set the fixed
    stored response header on cache HIT and that forbidden header IDs fail
    closed.
  • Add negative coverage proving duplicate stored-header mutations fail closed
    and stored-header mutation caps are enforced.
  • Add negative coverage for aggregate cache-key component caps, cache-tag caps,
    and TTL singleton merge behavior.
  • Add examples/wasm/cache-lookup-policy.wat,
    examples/wasm/cache-store-policy.wat, and a matching config template for
    the bounded cache-policy ABI.
  • Add live native HTTP/1 listener tests that compile the checked-in example
    Wasm sources and prove image-only cache-store metadata, cache-key, TTL, and
    stored-header behavior.

Security Notes

  • Unknown component IDs, unknown values, duplicate component labels, and
    component counts above the hard cap fail through the plugin fail mode.
  • Duplicate cache-key component labels and aggregate component counts are
    enforced across the full cache-lookup hook chain, not only within a single
    plugin invocation.
  • Unknown TTL IDs, duplicate TTL overrides, unknown tag IDs, and tag counts
    above the hard cap fail through the plugin fail mode.
  • Unknown stored-header IDs, duplicate stored-header mutations, and stored
    header mutation counts above the hard cap fail through the plugin fail mode.
  • Cache-store metadata caps are scoped independently to TTL, tag, and stored
    header metadata so one exhausted metadata family cannot silently drop a later
    family.
  • Oversized cache-store candidates are rejected before cloning response bodies
    for stored-header metadata mutation.
  • Store hooks receive only symbolic content-type classes for response-header
    inspection; raw response header names and values remain unavailable.
  • The hook does not expose arbitrary request headers, raw cache-key bytes,
    request bodies, response bodies, filesystem access, network access, or cached
    object contents.
  • Built-in access, route, rate-limit, concurrency, header, and cache admission
    controls keep their normal order.

Operator Notes

  • This is a preview ABI for controlled cache-key variation. The only accepted
    cache-key label is currently wasm-device-class; the only accepted values
    are mobile and desktop.
  • Store TTL, tag, and stored response-header choices are fixed IDs, not
    arbitrary strings. Richer store admission mutation and cache response policy
    hooks remain staged for later 1.7.x slices.

Checksums And Signatures

  • Commit: c849e3311d9862e336ddeb1171a19a1c064b568a
  • Local gate: GitHub CI green before tag; local release metadata checks passed
  • CodeQL/code scanning: no open release-blocking alerts before tag
  • Source archive checksums:
    • d3316196c58aa0f01a99e4f9f8ec9fe6c45f5ea76d7b43fb63f2f2320bb0bcf8 fluxheim-1.7.5.tar.gz
    • a928f0c6dd9cfaa227871d487135dae167ab9ce23bbd9d1b0deabb7ef31788a8 fluxheim-1.7.5.zip
  • Binary checksums:
    • x86_64:
      • 6275ae5d6542285e15fcf207be68372edd7c8123e3a9d608eae0232b67d52135 fluxheim-1.7.5-full-x86_64-linux.tar.gz
      • d703ce77cec7828eb758188fbbab703843dce91d3762593d9ab1d665fa4f46a5 fluxheim-1.7.5-cache-x86_64-linux.tar.gz
      • 329ca82c825a092c877f92670e65ba5bf2bca969a2c89e31f416fe6774e26b91 fluxheim-1.7.5-proxy-x86_64-linux.tar.gz
      • 87a982cba770134b0334b45beb1ed04ce0fe371c4169bbe380f643c2619c1d05 fluxheim-1.7.5-php-x86_64-linux.tar.gz
      • 99e06ae168e71c277616ebb31c9c1295a5e61cc6e6ee0ce47213476da60dc6b1 fluxheim-1.7.5-load-balancer-x86_64-linux.tar.gz
      • dba07e8f18b8537e667a18056f1ed4bb75681028ad1078a855001d1708e8f376 fluxheim-1.7.5-config-tester-x86_64-linux.tar.gz
    • aarch64:
      • 014e86f4fb850cd69428fa1db73126f33448352d78af906d4cadfb71738b1d79 fluxheim-1.7.5-full-aarch64-linux.tar.gz
      • 1144eb8637e9770e4e8b8ba858ecf07719372e8a4fe9e8ba3f1b82c6f6c53688 fluxheim-1.7.5-cache-aarch64-linux.tar.gz
      • eb177989c3067cdb5e9abc4b0da5cc5f0217b98c4f50ab69787f792db225cb32 fluxheim-1.7.5-proxy-aarch64-linux.tar.gz
      • 02d6c7cbc52f53ba87b5134096739ea25fa3268dc8325106cbf3c4bf167c66e8 fluxheim-1.7.5-php-aarch64-linux.tar.gz
      • 0bceaab3d5897db69b879107d2bc55f1eba1898526d543839a61b56dcc64c606 fluxheim-1.7.5-load-balancer-aarch64-linux.tar.gz
      • 3960a6fde3ffa1f11ce02eb5c7dd081641f2524e61b7aa31be7fbe82a2de36f1 fluxheim-1.7.5-config-tester-aarch64-linux.tar.gz
    • macos:
      • ce34af1384e0936e083c8dc06fc51c962c811b314be94c2edbadadf7767a06ea fluxheim-1.7.5-dev-aarch64-macos.tar.gz
  • SBOM checksums:
    • 0c0fb4585b18442ab1df9f814142d8325aa1a3cbfcce6acfe013b97b077aa0d7 fluxheim.spdx.json
    • 788380fb58d94d8738eedb1b82a02da814172fc67a5fa9991ec1e3c4e8d3a258 fluxheim.cyclonedx.json
  • Reproducible build:
    • 16056a59918c939fccfe1522b11cb1e8ce4a748ea73222bd4f03f146ca3ea072 x86_64
    • add39ef66006d018dfa76ba4d18f7114e1d7fafaf7c61b906ca6e5b2c8495a8e aarch64
    • ec83da96f971f05914d7bda079577be2f2434f31142412aafce21d3a6b1adbfd macos
  • Full Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:39db6caa5b498a68f4455e2f08bba1c109d7f6c6c1c70a3e5ce792bdfcc887ac
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:495ef2913bdfd2c8b0db91101f54cd6e025c7f66f262cd91581d62544b414485
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:0ae64c168a1e5ac435f9922f9db626f4479e6ee1dc3794ab42f33bddcb546e08
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:adb9829ad3c63132ed06b560089ba0703064ab413b7f9aa987ed7f9b47f3bda6
  • Cache Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:22894fbae4dcfc3d0712226eb12a30a8d998792c945f52de8de48070946f5522
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:72c71aaeff9407ec1320de6098ec397fae396e1752649b7cab275d4ca1cf5c42
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:16121cd319cd58155acff3dff193019620c4cd9f14a07bd4a3668b237d8a5a5d
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:ab618b9b41bddcbfe51548d2fe0a91513c871c3ae357898d058c77e1d318a510
  • Proxy Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:2f3c2116106612b831ffe85d335b1a3fbfbd7590cbff2361788a5b3dd8627769
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:05d923cac92dd7bf78874a75b6bcceb5e19e5cd34f44ecf74a42b9d89a956e10
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:ce7c41edb4a4dda642573146ac984a5ec5454af31bac94942becac709e34ec91
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:0248a039b063a5095600388abdf6a68af4d769bfef5390a0d492ff7db837f55f
  • PHP Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:a38e17bad99759a05cff5ad3a6aeade67cf912632c1035b4fb7ff12399f0e328
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:4f2dfcc04e2d53738f489590b1d1d61a98aa9409f92c1e024e1b95dd4e3ab851
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:12f2faeadc9c57d45619073bc4d0bbfa502a40b3e8a3c6704ae1871f50a9f28c
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:4487c4d9307b5d7c6cfa9a0965051c853cbb81f24871cc2a7d62a82e74512875
  • Load Balancer Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:4247e06fe5562382e32589aa6e7da22fc3f73054e191b1cddda5ae2ebffcc57e
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:7c1d596a35346fe4cab29c6ac83468e7fe5db0f4149dd3a9a20488feb5c65bde
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:4b8fc026d8500e3fbec5b65dbf2210681d203e28452aef19a16ea5debd4ef97a
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:46f5527a86c369e08597a814da7887f1bedfb91415a0e446e21b486498f4d19a
  • Tag signature:
    • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Assets 16
Loading
0 Join discussion