WeAmp.PageSpeed.Sidecar.NativeAssets.Linux 1.15.0.3

Learn more about Target Frameworks and .NET Standard.

This package has no dependencies.

1.15.0.3 (packaging revision; engine v1.15.0+r15, bundled nginx 1.30.2): native-engine refresh from r10 to r15 — a security-maintenance update to the bundled module, with no change to optimization behavior or bundled nginx (still 1.30.2). The shipped .so is now built with binary hardening (full RELRO/BIND_NOW, -fstack-protector-strong, _FORTIFY_SOURCE=2, and CET/BTI), asserted on every release artifact. The rewrite path picks up a fix for a double-to-int conversion in the CSS parser's rgb() handling (with an added ASan fuzz harness), an iterative RateController shutdown drain that closes a stack-overflow path, and explicit bounds on header count and HTML nesting depth. The module's vendored attack surface is reduced: dead brotli, closure-compiler, giflib-encoder and serf linkages are dropped, a dead public-suffix component is replaced by maintained libpsl, and the googleurl snapshot is re-pinned. /v1/license/status now reports an honest license_file_error when a license file is present but unreadable, instead of falling silently to UNLICENSED. No managed-code changes; 1.15.0 installs keep working, including with newly issued license keys.

1.15.0.2 (packaging revision; engine v1.15.0+r10, bundled nginx 1.30.2): NuGet packaging refresh on the same native engine as 1.15.0.1.

1.15.0.1 (packaging revision; engine v1.15.0+r10, bundled nginx 1.30.2): refreshed embedded admin console — Purchase points at the current per-site plans, and the License page shows the scope and licensed site for tokens that carry them. The native engine also picks up the runtime ABI guard (inert for the bundled matched pair; relevant only in External mode against a drifted host nginx). No managed-code changes; 1.15.0 installs keep working, including with newly issued license keys.

1.15.0 (GA): the Inverse topology is the default. Add services.AddPageSpeed(config) + app.UsePageSpeed() to your ASP.NET Core app and your Kestrel server stays the public front door — it owns the listening socket, TLS, auth and routing exactly as before. The bundled nginx + ngx_pagespeed runs loopback-only behind your app as an optimize-proxy: the middleware streams optimizable responses over loopback (YARP) to nginx, which optimizes and proxy_pass-es back to a private raw-origin Kestrel endpoint where the middleware bypasses itself. Non-optimizable requests, and any request while the sidecar isn't running, pass straight through un-optimized (always-functional). By default (Sidecar.OwnPublicPort = true) the package binds the public port (Sidecar.ListenPort, 8080) as a code endpoint; set OwnPublicPort = false to bind it yourself via Kestrel:Endpoints (e.g. for in-process TLS). For edge TLS, front the public port with a terminator or load balancer; the loopback hop to nginx is plain HTTP with a single validated X-Forwarded-Proto so optimized asset URLs root at the public scheme.

Zero-config host handling (forward-all): optimization works for any host your app serves with no domain configuration, because the module implicitly authorizes each request's own same-origin resources. Domains.AuthorizedDomains is not a setup step; localhost is always optimized. Defense-in-depth: set Sidecar.RestrictToAuthorizedHosts = true to optimize only hosts you list. The /pagespeed_* admin endpoints return 404 from the public front door by default; set Sidecar.AllowPublicAdmin = true (requires AdminAuth.Enabled) to expose them behind the bearer token.

Modes: Inverse (default), Process (the classic front-proxy where nginx is the public front door — still supported), and External (operator-managed nginx). Docker is reserved and fails validation.

The bundled nginx is on the 1.30 stable branch (1.30.2). A native pagespeed-nginx-launch shim, on by default (Sidecar.UseLaunchShim), arms PR_SET_PDEATHSIG so the bundled nginx can't be orphaned (and hold its loopback port) if the host process is hard-killed (SIGKILL/OOM/container hard-stop) once launch has settled; the bundled runtime identifier (RID) is derived at runtime so the matched nginx resolves on linux-arm64 as well as linux-x64; and a per-RID build-info.json provenance manifest is emitted. The native engine targets a glibc 2.31 floor with statically-linked libstdc++ and no OpenSSL host dependency, so it loads on Debian 11/12, Ubuntu 20.04+, RHEL/Alma 8/9 and Amazon Linux 2023. A single dotnet add package auto-pulls the native engine; binaries are stripped (debug archived separately). This package is mod_pagespeed 1.15 (jpeg/png/webp recompression, CSS/JS minification, critical-CSS inlining, Core-Web-Vitals HTML rewriting); it does not do AVIF (AVIF is ModPageSpeed 2.0 only).