Skip to content

Fluxheim 1.7.9

Choose a tag to compare

View all tags
@eldryoth eldryoth released this 12 Jul 19:43
Immutable release. Only release title and notes can be modified.
v1.7.9
This tag was signed with the committer’s verified signature.
eldryoth
SSH Key Fingerprint: EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Verified
Learn about vigilant mode.
e519f61
This commit was signed with the committer’s verified signature.
eldryoth
SSH Key Fingerprint: EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Verified
Learn about vigilant mode.

Fluxheim 1.7.9 Release Notes

Fluxheim 1.7.9 is the documentation and runnable-example parity release for
operators translating common F5 iRules, nginx Lua/OpenResty, HAProxy Lua/SPOE,
and VCL-style policy jobs into Fluxheim's typed WebAssembly policy ABI. It
provides capability mappings, not syntax or runtime compatibility with those
products.

Added

  • Add a checked-in F5 iRules-style route access policy and complete config
    fixture using Fluxheim's typed access-decision ABI.
  • Add real listener coverage proving public requests reach origin, attached
    admin requests are denied before origin dispatch, and plugin traps fail
    closed.
  • Add scripts/smoke_wasm_policy_examples.sh to scripts/test_starter.py and
    the opt-in Wasm release gate.
  • Add a checked-in nginx Lua/OpenResty-style header policy and complete config
    fixture. Live coverage proves the allow-listed origin request mutation,
    client response mutation, upstream-header removal, and fail-closed rejection
    of unknown mutation IDs.
  • Add a checked-in HAProxy Lua/SPOE-style route policy and complete config
    fixture. Live coverage proves symbolic canary/mirror selection, unavailable
    branch rejection, selected-route policy enforcement, native load balancing,
    and managed-cookie persistence without exposing backend addresses.
  • Promote the existing cache lookup/store WAT pair to the validated VCL-like
    parity example. The live smoke now proves pass, MISS/HIT, bounded variants,
    image-only TTL/tag/header metadata, expiry, tag purge, non-image isolation,
    and fail-closed invalid mutations.
  • Add a deterministic policy builder that emits deployable .wasm files and
    SHA256SUMS under target/wasm-policy-examples/.
  • Add one complete Wasm smoke shared by scripts/test_starter.py and the
    opt-in stable/deep release gate, fixing the launcher's previous multi-script
    command wiring.
  • Add a standalone binary smoke using generated modules, exact digest pins, a
    private plugin root, file-based configuration, two local origins, and real
    HTTP traffic through every migration family.

Fixed

  • Stop attempting to initialize the native disk-cache backend for memory-only
    cache policies, avoiding an incorrect missing-path error at startup.

Security

  • ACME certificate installation now retains the exact trusted storage-boundary
    descriptor and reconciles every managed descendant to the selected UID/GID
    through descriptor-relative, no-symlink traversal. Restart repairs
    intermediate 0700 root:root directories left by an interrupted root-run
    handoff, while outside-boundary targets fail before mutation. Linux also
    enforces openat2(RESOLVE_NO_XDEV) and other Unix platforms reject device-ID
    changes before ownership mutation, preventing reconciliation through nested
    mount points. The bind-mount regression is explicitly ignored in
    ordinary Rust runs and executed by CI and the deep release gate through a
    dedicated smoke using root-mapped user and private mount namespaces, without
    a privileged container. Hosts that disable user namespaces use a
    digest-pinned, network-isolated, read-only container with every capability
    dropped except the mount operation's required SYS_ADMIN capability. The
    regression requires the precise EXDEV result from Linux RESOLVE_NO_XDEV
    using the namespace's mapped identity, so a later ownership error cannot
    produce a false pass.

  • Managed ACME account generation now creates P-256 material in zeroizing
    RustCrypto secret/document types before importing it into Ring and retaining
    the durable copy in sanitization::SecretVec, removing the transient
    non-zeroizing Ring PKCS#8 document.

  • Open private snapshot files with platform no-follow semantics before
    validating type and permissions from the opened descriptor. This removes a
    check-then-open race while retaining fail-closed symlink handling.

  • Use the snapshot store's atomic writer and descriptor-based permission
    changes for corruption fixtures, keeping negative security tests realistic
    without normalizing raw path mutation patterns.

  • Use one no-follow parent-directory descriptor for Unix snapshot publication,
    with descriptor-relative temporary creation, create-new linking, replacement,
    cleanup, metadata checks, and directory synchronization. This prevents
    parent replacement from redirecting an in-progress atomic write.

Compatibility Boundary

  • The migration examples use Fluxheim's typed, bounded policy ABI; they do not
    execute iRules, Lua, SPOE, or VCL source directly.
  • Every example remains bounded by configured symbolic IDs and denies arbitrary
    filesystem, network, secret, request-body, and cache-object access.

Checksums And Signatures

  • Commit: e519f61f7bf0df139933cc2831f6917be040d8d5
  • Local gate: GitHub CI green before tag; local release metadata checks passed
  • CodeQL/code scanning: no open release-blocking alerts before tag
  • Source archive checksums:
    • 1dfdbb19535b18aecc50e37afe7fd33509a2b4734b1d5468b0368afb08254eef fluxheim-1.7.9.tar.gz
    • 16339d6794bf0a5d3832e2e509e2f61558c81fed36d34d20f64150b6af421354 fluxheim-1.7.9.zip
  • Binary checksums:
    • x86_64:
      • bfc1553d98cb019a5391f6d3f5234134c9e2040c76698acf73d1e430350a64bc fluxheim-1.7.9-full-x86_64-linux.tar.gz
      • 0940e0bb095182d56b1258e9ce55487dc07d2a94aae6c7ba89570c34cd270662 fluxheim-1.7.9-cache-x86_64-linux.tar.gz
      • 10ea8f355c3126c4bb0b9a660fd7677b449d14eb096e72114ee82c27b76ac5b5 fluxheim-1.7.9-proxy-x86_64-linux.tar.gz
      • 5369cde5b9077e42fcd0c676ff69b25167080e3735bce37e673790898a0c47f0 fluxheim-1.7.9-php-x86_64-linux.tar.gz
      • cccf9f6106044546daa915f10af4f82abca579c9a3671826ae870afd05c1c018 fluxheim-1.7.9-load-balancer-x86_64-linux.tar.gz
      • e8cb7e5dcc1a8f07dd58e6b8eeb3b00ca56605aaf978eab892ebb2c4602d8716 fluxheim-1.7.9-config-tester-x86_64-linux.tar.gz
    • aarch64:
      • 8bf812c771ba17652830b51e52c45f7bee56471f83e2993a9f055d555bb0c997 fluxheim-1.7.9-full-aarch64-linux.tar.gz
      • ef4be1c37e1d3ac302666724fe4121d25ad1d41907571da17a1dfbae75e3f47f fluxheim-1.7.9-cache-aarch64-linux.tar.gz
      • 03c51decace5fbb84378505bf2683cb1b373a8bb3d1696ebcc0a33941f184751 fluxheim-1.7.9-proxy-aarch64-linux.tar.gz
      • b0af61c8b40253a0c7b32f3bae5bcee179bda022e6852b95c5a331329bda9b5a fluxheim-1.7.9-php-aarch64-linux.tar.gz
      • 52bc13f5974fdd5019cf4fb34c04dbfe74725ec97a40351dfd45c5a5418e42a0 fluxheim-1.7.9-load-balancer-aarch64-linux.tar.gz
      • 33a4db9b8ceffc80e37636814886729c2ff3d6d28e6e30ec3013cba7bb211ad0 fluxheim-1.7.9-config-tester-aarch64-linux.tar.gz
    • macos:
      • f04427e1ea8c72a8fcc6c86610e68c547c5d195f14e395ed052d5cc2155cecba fluxheim-1.7.9-dev-aarch64-macos.tar.gz
  • SBOM checksums:
    • e828a1b78d9e88504c63bdabd424d7d59662addf9c26f26fea38f63de46fdb06 fluxheim.spdx.json
    • ca9b4f5434af58bd1bbf26ae431ca890cdb0945207c579d77c04d1c963c9f37f fluxheim.cyclonedx.json
  • Reproducible build:
    • 5f162d370d7e838111e28e2521daa5d2172eb2ddd0adb73e354420f3a473a2fc x86_64
    • 4ab04d472433f057f131451fe0e25c67e86795f69ab40b30dfeb1f71e11f7615 aarch64
    • 4fde8e05dd1d6afa822864e94de7d5b79a6deb14ee108c3edb7f752672bb66f1 macos
  • Full Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:04367b7d87273dd5cdbf55ad25b00733cbb1f8f044fe3c25a0159aa13c18a1f6
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:2df48353f7abc17f95595e27f12c585e51d4b46b65cc952a72da740e9025b9fb
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:a27c44c696061d9a663f0188c090b68c93369a375a0648d01788a454b2f1e9c0
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:64f8b7a68ca7a7e9a37f120ab6a4a03fc8aebc9e643340b8b949edc24b98433b
  • Cache Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:1abba7e7de90316daa6841e7e8227eb5938297b132dade100ac62eeb05f31376
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:af9b18de1435fffb0ba44b549d7ed11149d4abe3a097c0f53a56b7196ba3caaa
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:3404c189198cd886bc96f03b124abdc7c23e0a9d3cbd2685d2cd2bf4b6dc6bc5
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:33cf42f29b659ac85b1bf45164353aae5b6545eeed75d519b38349e4cbb7435b
  • Proxy Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:073a6657ab2cf4565e42e53ac49535ad8d0b70a2866703f0604b7cd7427cd7e0
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:2b11fa9ada18406a3ebba7a92c06559a6186bf9404243bd5f5338faf59c0463e
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:6599273d86a47bbb31b2c44fc7120d1930ab10dc45fc6ee3b2c0312940401e99
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:a02062b5e8e7b8b2b99b61954ea96360e7e8ee7837f3b1e57011077d75c58f45
  • PHP Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:2f9c2c2987720a3e0b1f664f167db6ac8d159bb1bcf8cfdf738e491116ce8b94
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:49c3db68bf39714740cdd58fc82439c1afefdbe64906390c80a5355d2b528216
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:16b99092b64111631933f7399bf186483cd5fb303e097fc75b46e79dd28ca523
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:303514a229d2fe90019749fff52d01142a046205380168b03a4c1ccf4c86c7c2
  • Load Balancer Build Container digests:
    • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:5225aea52c588afedb2b941470956b93e42f6795c4e39d8b3aaeb1c1d6d92aaa
    • Alpine: ghcr.io/valkyoth/fluxheim@sha256:0f8d2cf891e1701017c675c6ecf1f1d1ee3d6c9733763e44b3a2240e8a04f7ed
    • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:70495df79b2d183fd3f2c3ab68ccec1f6dafdbe4a3023cd18ffa9fef0dfe2055
    • Debian: ghcr.io/valkyoth/fluxheim@sha256:3b6531548e9ef5c6807ceaa3cda3fda3c81bf96fa9a0e42a4ba209ceaf949cc2
  • Tag signature:
    • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Assets 16
Loading
0 Join discussion