Finalize hashavatar-api 1.1.2 release candidate

Author: eldryoth

CLOUDFLARE.md

@@ -67,16 +67,24 @@ If you want stricter cache deduplication:
 
 - normalize query ordering at the application layer
 - prefer canonical URLs in clients
-- keep `id`, `kind`, `background`, `format`, `size` only
+- include every rendering parameter in the cache key: `id`, `tenant`,
+  `style_version`, `algorithm`, `kind`, `background`, `accessory`, `color`,
+  `expression`, `shape`, `format`, and `size`
 - prefer the path API when you want the cleanest cache key shape
 
 ## 7. Why this is safe to cache hard
 
 The avatar response is deterministic for the full request tuple:
 
 - identity
+- tenant and style version
+- algorithm
 - kind
 - background
+- accessory
+- color
+- expression
+- shape
 - format
 - size
 

DEPLOYMENT-HETZNER.md

@@ -75,8 +75,11 @@ podman-compose up -d --build
 ## Notes
 
 - Fluxheim listens publicly on `80` and `443`
+- the Compose example pins the Fluxheim `1.7.6` Wolfi image by digest
 - the Rust app stays internal on port `8080`
+- both containers have CPU, memory, PID, and file-descriptor ceilings
 - `HASHAVATAR_TRUSTED_PROXIES` is set to the private Compose network so the app
   only honors forwarded client IP headers from Fluxheim
 - if Cloudflare is in front, keep DNS proxied and apply the cache rules from [`CLOUDFLARE.md`](./CLOUDFLARE.md)
 - the avatar endpoints are deterministic, so they are safe to cache hard at the edge
+- do not add a public Fluxheim route for the loopback-only `/metrics` endpoint

Dockerfile

@@ -10,11 +10,11 @@ RUN cargo build --release \
     && rm -rf target /usr/local/cargo/registry /usr/local/cargo/git
 
 FROM cgr.dev/chainguard/wolfi-base:latest@sha256:02dab76bd852a70556b5b2002195c8a5fdab77d323c433bf6642aab080489795
-RUN apk add --no-cache ca-certificates glibc \
-    && addgroup -S appuser \
+RUN addgroup -S appuser \
     && adduser -S -D -H -u 10001 -G appuser appuser
 WORKDIR /app
 
+COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 COPY --from=build /usr/local/bin/hashavatar-api /usr/local/bin/hashavatar-api
 
 ENV PORT=8080

PROVENANCE.md

@@ -13,7 +13,8 @@ This repository serves avatars generated by the `hashavatar 1.1.2` Rust crate.
 
 - Identity input is hashed with `SHA-512`.
 - Digest bytes are mapped into visual parameters such as proportions, colors, spacing, and facial details.
-- Final images are rendered using drawing primitives provided by Rust crates such as `image` and `imageproc`.
+- Final images are rendered using the `hashavatar` crate and encoded through
+  the Rust `image` ecosystem.
 
 ## Current avatar families
 

README.md

@@ -77,13 +77,15 @@ Intentionally external:
 | Renderer crate | crates.io `hashavatar 1.1.2` |
 | MSRV | Rust `1.97.0` |
 | Runtime container | Wolfi |
+| Gateway example | Fluxheim `1.7.6` Wolfi image, digest-pinned |
 | HTTP framework | `axum` |
 | Object storage | Optional S3-compatible backend |
 | Rate limiter | Bounded LRU map |
 | Forwarded IP policy | Trusted proxies only |
 | Internal errors | Detailed logs, generic client body |
 | Security headers | CSP, permissions policy, referrer policy, `nosniff`, frame denial, CORP, COOP, HSTS |
 | Release evidence | fmt, metadata, docs, clippy, tests, deny, audit, smoke, SBOM, reproducibility |
+| Release inputs | Actions and container images pinned to immutable revisions |
 | Code scanning | GitHub CodeQL default setup |
 
 Security-control details live in
@@ -429,10 +431,11 @@ The repository includes:
 - Markdown link checks
 - security invariant checks
 - clippy with warnings denied
-- unit tests for rate limiting, trusted proxy handling, renderer validation,
-  and internal error disclosure behavior
+- unit tests for rate limiting, trusted proxy handling, body limits, transport
+  validation, renderer validation, cache keys, and internal error disclosure
 - local HTTP smoke tests for health, WebP rendering, security headers,
-  unsupported algorithm/format rejection, and invalid namespace rejection
+  S3-enabled startup, unsupported algorithm/format/style rejection, oversized
+  body rejection, and invalid namespace rejection
 - local Podman smoke tests for the Wolfi image when
   `HASHAVATAR_API_GATE_PODMAN=1` is set
 - `cargo deny` dependency and license policy

THIRD_PARTY_NOTICES.md

@@ -1,7 +1,13 @@
 # Third-Party Notices
 
-Portions of the raster drawing primitives in `src/lib.rs` are adapted from
-`imageproc` drawing modules.
+This service does not vendor third-party source or avatar artwork. Rust
+dependencies and their licenses are tracked by `Cargo.lock`, `cargo deny`, and
+the SPDX and CycloneDX SBOMs generated by `scripts/generate-sbom.sh`.
+
+The procedural renderer is provided by the separately published `hashavatar`
+crate. Renderer-specific source attribution and notices are maintained in its
+upstream repository. The linked renderer contains raster primitives adapted
+from `imageproc`; its required notice is reproduced below.
 
 ## imageproc
 

deploy/README.md

@@ -5,7 +5,8 @@ It runs two containers on one private network:
 
 - `hashavatar`: builds this repository with the Wolfi runtime image from
   `../Dockerfile` and listens internally on port `8080`.
-- `fluxheim`: runs `ghcr.io/valkyoth/fluxheim:v1.6.30-wolfi`, publishes ports
+- `fluxheim`: runs the digest-pinned
+  `ghcr.io/valkyoth/fluxheim:v1.7.6-wolfi` image, publishes ports
   `80` and `443`, terminates TLS, redirects HTTP to HTTPS, redirects
   `www.hashavatar.app` to `hashavatar.app`, and proxies traffic to
   `hashavatar:8080`.
@@ -26,6 +27,10 @@ tmpfs, and CPU, memory, PID, and file-descriptor ceilings. Fluxheim has separate
 resource ceilings. Tune these values with production load tests rather than
 removing them.
 
+The deployment image, build image, runtime image, and GitHub actions are pinned
+to immutable revisions. The Wolfi runtime does not download packages during the
+build; its CA bundle is copied from the pinned Rust builder.
+
 Both Fluxheim and Axum reject request bodies larger than `4KiB`; the public API
 uses request bodies only for small, bounded telemetry events.
 

deploy/podman-compose.yml

@@ -33,7 +33,7 @@ services:
       - hashavatar
 
   fluxheim:
-    image: ghcr.io/valkyoth/fluxheim:v1.6.30-wolfi
+    image: ghcr.io/valkyoth/fluxheim:v1.7.6-wolfi@sha256:462b98287a0eb0e405cd302b818c5bab0507e18845191eb0abe3732bfd953477
     container_name: hashavatar-fluxheim
     restart: unless-stopped
     cpus: 2.0

docs/SECURITY_CONTROLS.md

@@ -21,7 +21,7 @@ local test and release gates.
 | PII in infrastructure logs | Email-shaped identities are accepted for compatibility; callers who want less personal data in URL logs should send opaque stable ids or one-way hashes. |
 | Vulnerable or incompatible dependencies | `cargo audit` and `cargo deny check` run in the standard check script and CI. |
 | Plaintext backend transport | Remote OTLP and custom S3 endpoints require HTTPS. HTTP is accepted only for loopback-local development endpoints, and the application enables explicit Rustls-backed clients for both integrations. |
-| Mutable release inputs | GitHub actions and Docker base images are pinned to reviewed commit SHAs and image digests. Dependabot tracks Cargo, action, and Docker updates; image publishing emits SBOM and maximum provenance attestations. |
+| Mutable release inputs | GitHub actions, Docker base images, and the Fluxheim deployment image are pinned to reviewed commit SHAs and image digests. The runtime image does not install from a live package repository; its CA bundle comes from the pinned builder. Dependabot tracks Cargo, action, and Docker updates; image publishing emits SBOM and maximum provenance attestations. |
 
 ## Self-Testing
 

release-notes/RELEASE_NOTES_1.1.2.md

@@ -1,14 +1,14 @@
 # hashavatar-api 1.1.2 Release Notes
 
-Status: draft
+Status: release candidate
 
 ## Summary
 
 `1.1.2` is the next stable patch release for the API, renderer dependency,
 Rust toolchain, dependency graph, and CI tooling.
 
-These notes are based on the current working tree and should be rechecked
-against the final tag before publishing.
+These notes describe the release candidate and should be checked against the
+final tag before publishing.
 
 ## Changed
 
@@ -33,12 +33,14 @@ against the final tag before publishing.
 - Hardened embedded JSON, drawing arithmetic, and object-key identity hashing.
 - Pinned GitHub actions and container bases to immutable revisions, enabled
   image SBOM/provenance attestations, and added deployment resource ceilings.
+- Pinned the Fluxheim deployment image and removed live APK package installation
+  from the runtime image build.
+- Updated the digest-pinned Fluxheim Wolfi deployment image to `v1.7.6`.
 
 ## Verification
 
 ```bash
 cargo outdated --workspace --root-deps-only
-scripts/checks.sh
-scripts/smoke_local.sh
-scripts/podman_smoke.sh
+HASHAVATAR_API_GATE_PODMAN=1 scripts/stable_release_gate.sh check
+podman compose -f deploy/podman-compose.yml config
 ```