Skip to content

Fluxheim 1.7.6

Choose a tag to compare

View all tags
@eldryoth eldryoth released this 09 Jul 08:43
Immutable release. Only release title and notes can be modified.
v1.7.6
This tag was signed with the committer’s verified signature.
eldryoth
SSH Key Fingerprint: EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Verified
Learn about vigilant mode.
c231d0b
This commit was signed with the committer’s verified signature.
eldryoth
SSH Key Fingerprint: EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Verified
Learn about vigilant mode.

Fluxheim 1.7.6 Release Notes

Fluxheim 1.7.6 starts the mature WebAssembly runtime hardening pass after the
initial live hook families landed in 1.7.1 through 1.7.5.

Wasm Runtime Hardening

  • Compiled WebAssembly modules now carry an explicit cache identity made from
    the plugin SHA-256 digest, manifest ABI version, native hook feature surface,
    and Fluxheim crate version.
  • The native HTTP/1 hook registry compiles plugins through manifest-derived
    identities, so future module reuse cannot silently cross ABI, feature, or
    release boundaries.
  • The runtime compile API now has regression coverage proving a supplied
    compiled-module identity from one plugin cannot be accepted for another
    plugin's bytes.
  • Cache-lookup and cache-store Wasm hooks now acquire a derived per-vhost
    admission budget under the process-wide cache-hook budget, so one vhost
    cannot starve cache hook execution for another vhost.
  • Prometheus Wasm plugin metrics now preserve bounded labels for every current
    hook family, including route selection, cache lookup pass/bypass, cache-store
    skip/deny, and the cache-specific global and per-vhost admission scopes.
  • Authenticated admin status now reports both the general Wasm process-wide
    admission budget and the separate cache-policy process-wide admission budget.

Test Coverage

  • Add runtime tests proving ABI and feature-surface changes produce distinct
    compiled-module identities for the same plugin bytes.
  • Add runtime coverage for digest-mismatch rejection before module compilation
    can be accepted under the wrong identity.
  • Add live native HTTP/1 coverage proving a saturated cache hook on one vhost
    does not block cache hook execution on another vhost.
  • Extend metrics and admin-status tests for the mature hook-family visibility
    fields added in this release.
  • Add a live native HTTP/1 cross-family chain regression test that exercises
    access-decision, request-header mutation, route-decision branch selection,
    cache-key mutation, cache-store metadata, cached HIT behavior, and
    response-header mutation in one request flow.
  • Add reload classification regressions for Wasm plugin digest changes and
    attachment phase changes so module/hash and hook-chain updates remain
    process-upgrade events.

Checksums And Signatures

  • Commit: c231d0ba594069e8344cf874c477aecc53c31c8d
  • Local gate: GitHub CI green before tag; local release metadata checks passed
  • CodeQL/code scanning: no open release-blocking alerts before tag
  • Source archive checksums:
    • c94b429c07259e8cde0657603dc408e94090509ff7c7d0ed7536095e69a82c49 fluxheim-1.7.6.tar.gz
    • 03d363b71af3454af89149425afe17950196f6843c833e4197e2a0b6f6f9cdbd fluxheim-1.7.6.zip
  • Binary checksums:
    • x86_64:
      • ba4034ad0465467c47e5fc1dfb5268ab52790401550aa1ba3b1feb5d229e7fb5 fluxheim-1.7.6-full-x86_64-linux.tar.gz
      • eaff8b4edd4722a35be7f331387caa131bdc1c019ddeeb5eb71260ca7c263dcf fluxheim-1.7.6-cache-x86_64-linux.tar.gz
      • aadb9a9395c6c520bdf5a3cac3d7c7aa40adb8de15fa05592fb20c6468a93209 fluxheim-1.7.6-proxy-x86_64-linux.tar.gz
      • a7e37c42511a04ebd4dac10740d8cc259bd9b2f712675abe911c0d78e7e88181 fluxheim-1.7.6-php-x86_64-linux.tar.gz
      • 4aa9be2ce7210746bcfe329291d68dd0001b0e7e3d342845949405a7b5a6d4db fluxheim-1.7.6-load-balancer-x86_64-linux.tar.gz
      • 6beceee3d220867007ee95ec2f7f40e6bae413283aa0eccefa938de96e712505 fluxheim-1.7.6-config-tester-x86_64-linux.tar.gz
    • aarch64:
      • 0465cf84d6cb458c71c4feeffc5817e18906618bfeeb41e890220e4342729bde fluxheim-1.7.6-full-aarch64-linux.tar.gz
      • cda18da6022f865a43a28513b7b85bb4649f71d6bf7cdfc2874e06e03f9f9d3d fluxheim-1.7.6-cache-aarch64-linux.tar.gz
      • b5f7277af6c5d91291d2a83a1246d99182a84988bd3d858b0988f94c46b03ef7 fluxheim-1.7.6-proxy-aarch64-linux.tar.gz
      • c659872adffce902dc509a60bbccf1cbca9283a825a08f5652887cd62b4bac91 fluxheim-1.7.6-php-aarch64-linux.tar.gz
      • 825e9e70b9e7e4f9f4ebd8706768f195eed301b4eadca2d6045b8700f5b1765b fluxheim-1.7.6-load-balancer-aarch64-linux.tar.gz
      • 790ec7e1e8a9e0c364d2fec5d42ea399f4e06a6dbbc4a4b5df3716a64ddbc3f8 fluxheim-1.7.6-config-tester-aarch64-linux.tar.gz
    • macos:
      • f0ccf2aaab50775c0f190f80972524bc045037523cb443ebda2c67b16535b908 fluxheim-1.7.6-dev-aarch64-macos.tar.gz
  • SBOM checksums:
    • ac35ec4409927685e4cae635bcca524c9736d9a52b276f72787a9ab71dd6ea80 fluxheim.spdx.json
    • d456b9b6f5b844ed4eee13245544b4915ec4923a95643629b4dc189be8803cd3 fluxheim.cyclonedx.json
  • Reproducible build:
    • 854523f27160e547093f5730eff3c15975fc2777a2f0410d6904cea3d501c2a8 x86_64
    • 877526f4c8aabe5f302658790de493710e60da34a3175281115db79aaa75937c aarch64
    • 3d1a69e5c99354e04e4f9dde5bd5fad0f3f79a89c026da8fa5a95f645bc82ded macos
  • Full Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:462b98287a0eb0e405cd302b818c5bab0507e18845191eb0abe3732bfd953477
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:73fa2fac2aeafb9b6c526947feadbc593f64cad8d7e8cda151e251e7ddb1d264
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:1b9f669cc292bc603f469bcf5f2bb1151e998f7c1e16cb8efbd8a65eaed95e4f
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:42c6bb83a9221d5a9197ae7650c6c9746b9f042ebb1d153b8a6b8d4a965e73f8
  • Cache Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:516e1b6a845fad44abd7adcb0e55ea4e4aff84fe5ba1f4f9f414274b8fae5b81
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:15499cba800245ee55f3539cbe8a284c46b111209d7fb977b4878eb3c78765ae
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:7b83328c5b2bcb904a185ef52ecaf33e3a54ab5c0b7a2b9902fa01e756c26252
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:0dac5e12c5f77ef2e90e0cb9ebfe40d6e7d21b88226eb50761ebefee0de7668a
  • Proxy Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:b4c53ff4fa77edd3ceb205794bceda9555c87c6d317e5ef3f12b48de5e13bcac
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:06b16018d2136d40fb38ae2d2fbdded43b806b8a11672dd1816a398bd8657a4b
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:83f47565b19863884df0842d32f0564f32f917ed8ad2be684414e5d410ebf411
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:96b321626f2356326daefb3d9394c0dbc382be8f66379b175201ea9d0bed21aa
  • PHP Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:65a3f46bcd7981319c8e38a1cf53e5b4fdd4ea745ca994682532d805e52f2d9d
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:617c59eeb6252d39bd7af50a701d78e5242c8bcf17755469887e954675c33288
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:380c4dd0cf9477265fca8e5cd63f96230b79dd4da9be065d45b8f02f55b3161d
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:888798aec2a6dd514c42821e149b4f279108164206c46f3c67d7400e12aed167
  • Load Balancer Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:5f9140cf1dcff8a6f74d7bbad2fe16cf854bfb88c1fc7b73beabdcb643923a9d
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:132c7659712399a2bd435e8b70560e7cbd43856202ecfca9e5abb293220797aa
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:4a6dafe13049dc769504981026df8a733445349c7fb93e9d0e43784c49f2bd0a
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:243d9ae5e71d603d62c22dc6682afb287c6bc9ad7574626a503cb57c5c718184
  • Tag signature:
    • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Assets 16
Loading
0 Join discussion