![Maven Central Adds Sigstore Signature Validation](https://cdn.sanity.io/images/cgdhsj6q/production/7da3bc8a946cfb5df15d7fcf49767faedc72b483-1024x1024.webp?w=400&fit=max&auto=format)
Security News
Maven Central Adds Sigstore Signature Validation
Maven Central now validates Sigstore signatures, making it easier for developers to verify the provenance of Java packages.
github.com/jay-dee7/smtp
github.com/mailhog/smtp
implements an SMTP server state machine.
It attempts to encapsulate as much of the SMTP protocol (plus its extensions) as possible without compromising configurability or requiring specific backend implementations.
proto := NewProtocol()
reply := proto.Start()
reply = proto.ProcessCommand("EHLO localhost")
// ...
See MailHog-Server and MailHog-MTA for example implementations.
Interaction with the state machine is via:
Parse
functionProcessCommand
and ProcessData
functionsYou can mix the use of all three functions as necessary.
Parse
should be used on a raw text stream. It looks for an end of line (\r\n
), and if found, processes a single command. Any unprocessed data is returned.
If any unprocessed data is returned, Parse
should be
called again to process then next command.
text := "EHLO localhost\r\nMAIL FROM:<test>\r\nDATA\r\nTest\r\n.\r\n"
var reply *smtp.Reply
for {
text, reply = proto.Parse(text)
if len(text) == 0 {
break
}
}
ProcessCommand
should be used for an already parsed command (i.e., a complete
SMTP "line" excluding the line ending).
ProcessData
should be used if the protocol is in DATA
state.
reply = proto.ProcessCommand("EHLO localhost")
reply = proto.ProcessCommand("MAIL FROM:<test>")
reply = proto.ProcessCommand("DATA")
reply = proto.ProcessData("Test\r\n.\r\n")
The state machine provides hooks to manipulate its behaviour.
Hook | Description |
---|---|
LogHandler | Called for every log message |
MessageReceivedHandler | Called for each message received |
ValidateSenderHandler | Called after MAIL FROM |
ValidateRecipientHandler | Called after RCPT TO |
ValidateAuthenticationHandler | Called after AUTH |
SMTPVerbFilter | Called for every SMTP command processed |
TLSHandler | Callback mashup called after STARTTLS |
GetAuthenticationMechanismsHandler | Called for each EHLO command |
The state machine also exports variables to control its behaviour:
Variable | Description |
---|---|
RejectBrokenRCPTSyntax | Reject non-conforming RCPT syntax |
RejectBrokenMAILSyntax | Reject non-conforming MAIL syntax |
RequireTLS | Require STARTTLS before other commands |
MaximumRecipients | Maximum recipients per message |
MaximumLineLength | Maximum length of SMTP line |
Copyright © 2014-2015, Ian Kent (http://iankent.uk)
Released under MIT license, see LICENSE for details.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Maven Central now validates Sigstore signatures, making it easier for developers to verify the provenance of Java packages.
Security News
CISOs are racing to adopt AI for cybersecurity, but hurdles in budgets and governance may leave some falling behind in the fight against cyber threats.
Research
Security News
Socket researchers uncovered a backdoored typosquat of BoltDB in the Go ecosystem, exploiting Go Module Proxy caching to persist undetected for years.