![Maven Central Adds Sigstore Signature Validation](https://cdn.sanity.io/images/cgdhsj6q/production/7da3bc8a946cfb5df15d7fcf49767faedc72b483-1024x1024.webp?w=400&fit=max&auto=format)
Security News
Maven Central Adds Sigstore Signature Validation
Maven Central now validates Sigstore signatures, making it easier for developers to verify the provenance of Java packages.
github.com/kovel/go-xmpp
Fluux XMPP is a Go XMPP library, focusing on simplicity, simple automation, and IoT.
The goal is to make simple to write simple XMPP clients and components:
The library is designed to have minimal dependencies. Currently it requires at least Go 1.13.
It is not recommended to disable the check for domain name and certificate chain. Doing so would open your client to man-in-the-middle attacks.
However, in development, XMPP servers often use self-signed certificates. In that situation, it is better to add the root CA that signed the certificate to your trusted list of root CA. It avoids changing the code and limit the risk of shipping an insecure client to production.
That said, if you really want to allow your client to trust any TLS certificate, you can customize Go standard
tls.Config
and set it in Config struct.
Here is an example code to configure a client to allow connecting to a server with self-signed certificate. Note the
InsecureSkipVerify
option. When using this tls.Config
option, all the checks on the certificate are skipped.
config := xmpp.Config{
Address: "localhost:5222",
Jid: "test@localhost",
Credential: xmpp.Password("Test"),
TLSConfig: tls.Config{InsecureSkipVerify: true},
}
XMPP stanzas are basic and extensible XML elements. Stanzas (or sometimes special stanzas called 'nonzas') are used to leverage the XMPP protocol features. During a session, a client (or a component) and a server will be exchanging stanzas back and forth.
At a low-level, stanzas are XML fragments. However, Fluux XMPP library provides the building blocks to interact with stanzas at a high-level, providing a Go-friendly API.
The stanza
subpackage provides support for XMPP stream parsing, marshalling and unmarshalling of XMPP stanza. It is a
bridge between high-level Go structure and low-level XMPP protocol.
Parsing, marshalling and unmarshalling is automatically handled by Fluux XMPP client library. As a developer, you will generally manipulates only the high-level structs provided by the stanza package.
The XMPP protocol, as the name implies is extensible. If your application is using custom stanza extensions, you can implement your own extensions directly in your own application.
To learn more about the stanza package, you can read more in the stanza package documentation.
TODO
TODO
We have several examples to help you get started using Fluux XMPP library.
Here is the demo "echo" client:
package main
import (
"fmt"
"log"
"os"
"gosrc.io/xmpp"
"gosrc.io/xmpp/stanza"
)
func main() {
config := xmpp.Config{
TransportConfiguration: xmpp.TransportConfiguration{
Address: "localhost:5222",
},
Jid: "test@localhost",
Credential: xmpp.Password("test"),
StreamLogger: os.Stdout,
Insecure: true,
// TLSConfig: tls.Config{InsecureSkipVerify: true},
}
router := xmpp.NewRouter()
router.HandleFunc("message", handleMessage)
client, err := xmpp.NewClient(config, router, errorHandler)
if err != nil {
log.Fatalf("%+v", err)
}
// If you pass the client to a connection manager, it will handle the reconnect policy
// for you automatically.
cm := xmpp.NewStreamManager(client, nil)
log.Fatal(cm.Run())
}
func handleMessage(s xmpp.Sender, p stanza.Packet) {
msg, ok := p.(stanza.Message)
if !ok {
_, _ = fmt.Fprintf(os.Stdout, "Ignoring packet: %T\n", p)
return
}
_, _ = fmt.Fprintf(os.Stdout, "Body = %s - from = %s\n", msg.Body, msg.From)
reply := stanza.Message{Attrs: stanza.Attrs{To: msg.From}, Body: msg.Body}
_ = s.Send(reply)
}
func errorHandler(err error) {
fmt.Println(err.Error())
}
The code documentation is available on GoDoc: gosrc.io/xmpp
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Maven Central now validates Sigstore signatures, making it easier for developers to verify the provenance of Java packages.
Security News
CISOs are racing to adopt AI for cybersecurity, but hurdles in budgets and governance may leave some falling behind in the fight against cyber threats.
Research
Security News
Socket researchers uncovered a backdoored typosquat of BoltDB in the Go ecosystem, exploiting Go Module Proxy caching to persist undetected for years.