v0.6.0: S/MIME, Auto-discovery, Quicksend and more #410
Replies: 1 comment 7 replies
-
|
Looks like an amazing release. Sorry I didn't see this sooner, looking at #373 and #374 I am wondering if the XOAUTH2 mechanism may be selected when offered by a server when only a username and password has been provided. Is this a correct understanding? |
Beta Was this translation helpful? Give feedback.
-
|
No, I haven't. Can you point me to it? Def. wanna check it out! |
Beta Was this translation helpful? Give feedback.
-
|
https://github.com/authelia/authelia/blob/master/internal/notification/smtp_auth.go |
Beta Was this translation helpful? Give feedback.
-
|
It would have to be adapted for mechanisms that don't use username/password combos and needs some refactoring, for the recommended mechanisms from this repo, but the concept should work well as long as people initialize a new one for each authentication to ensure it's reliable. |
Beta Was this translation helpful? Give feedback.
-
|
Cool stuff! I'll check how I can implement this accordingly. |
Beta Was this translation helpful? Give feedback.
-
|
I'm not personally invested if you add it, just thought you may like the idea in general. There's a chance I'm overlooking the usefulness of it too. Also it'd only be compatible with the custom auth I think. |
Beta Was this translation helpful? Give feedback.
-
Welcome to go-mail v0.6.0! This release brings some cool new features. We hope you enjoy!
S/MIME signing support
The PRs #298 and #406 add S/MIME signing support to go-mail. We support RSA and ECDSA keys for the time being. Two new methods have been added to the
Msgtype:Msg.SignWithKeypairwhich allows message signing by providing seperatecrypto.PrivateKeyandx509.Certificateparts andMsg.SignWithTLSCertificatewhich allows to sign messages by providing a correspondingtls.Certificate. Please keep in mind that this is a completely new feature and while we did thorough testing there might be some edge cases that haven't been checked so far. Feedback for this feature is welcome. If you run into issues, please open a Github issue accordingly. This feature has been contributed by @theexiile1305 and has been extended by myself. Big thanks a lot to @theexiile1305 for their contribution!SMTP authentication auto-discovery
PRs #373 and #374 implement a new SMTP auth mechanism to automatically discover and select the strongest supported SMTP authentication type. This feature simplifies the authentication process for users and enhances security by prioritizing stronger mechanisms based on server capabilities.
Quicksend
PR #378 introduces the
QuickSendfunction for sending emails quickly with TLS and optional SMTP authentication. This feature is similar to theSendMailmethod of thenet/smtppackage, but makes use of all go-mailClientandMsgfeatures, including error checking and validations. In essence this new method will create a new client that connects to the server ataddr, switches to TLS if possible, authenticates with the optionalAuthDataprovided inauthand create a new simpleMsgwith the providedsubjectstring andmessagebytes as body. The message will be sent usingfromas sender address and will be delivered to every address inrcpts. QuickSend will always send astext/plainContentType. For the SMTP authentication, ifauthis notnilandAuthData.Authis set totrue, it will try to autodiscover the best SMTP authentication mechanism supported by the server. Ifauthis set totruebut autodiscover is not able to find a suitable authentication mechanism or if the authentication fails, the mail delivery will fail completely.Support for io/fs.FS attachments/embeds
The PR #376 adds support for generic file systems that satisfy the
fs.FSinterface. Sinceembed.FSis such a file system, theembed.FShas been refactored to make use of the more genericfs.FScode. It also introduces two new methodsMsg.AttachFromIOFSandMsg.EmbedFromIOFS.More robust concurrency-/thread-safety
Goroutines are easy, but concurrency is hard, and since we added concurrency just with the latest release, some issues were to be expected. With #386 a concurrency issues was fixed when a user would use
DialAndSendorDialAndSendWithContextin concurrent goroutines instead of using a singleClientand then just usingSendwithin the goroutines. With PR #386 the overall concurrency-safety is made more reliable.Improved filename sanitization in MIME headers
PR #388 introduced proper filename sanitization for attachments and embedded files. It will repace invalid characters with underscore
_characters before encoding them. This prevents control (like new lines) and special characters like backslash or quotes from causing issues in MIME headers and file systems. As a side effect this prevents newline characters from introducing a potential vulnerability by using filenames with newlines characters in it. We also make sure that theContent-Descriptionheader is properly encoded now.Unix domain socket support
PR #408 adds support for connecting to unix domain sockets instead of a TCP connection. This can be easily established by prefixing the hostname with
unix://. This feature has been requested by the Forgejo project. Thanks to them for their input on this.More test overhauling
Following the test suite overhaul of the 0.5.2 release, with #361 the test suite for the go-mail SMTP client has also been completely rewritten for better coverage as well.
What's Changed
CI/CD maintenance changes
New Contributors
Full Changelog: v0.5.2...v0.6.0
This discussion was created from the release v0.6.0: S/MIME, Auto-discovery, Quicksend and more.
Beta Was this translation helpful? Give feedback.
All reactions