[WORK IN PROGRESS] feat: warning if autoping is disabled

Remove -c http.sslverify=false from all git clones
(enables proper TLS verification, closes MITM risk).
Explicitly install ca-certificates in every CI Docker image.

Dockerfile.arch

@@ -13,6 +13,7 @@ RUN pacman -S --needed --noconfirm \
   autoconf-archive \
   automake \
   base-devel \
+  ca-certificates \
   ccache \
   check \
   cmake \
@@ -64,7 +65,7 @@ USER root
 RUN pacman -U --noconfirm libstrophe-git/libstrophe-git-*.pkg.tar.zst
 
 WORKDIR /usr/src
-RUN git clone --depth 1 -c http.sslverify=false https://git.jabber.space/devs/stabber
+RUN git clone --depth 1 https://git.jabber.space/devs/stabber
 
 WORKDIR /usr/src/stabber
 RUN ./bootstrap.sh

Dockerfile.debian

@@ -9,6 +9,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
   autoconf \
   autoconf-archive \
   automake \
+  ca-certificates \
   ccache \
   gcc \
   git \
@@ -40,8 +41,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 RUN mkdir -p /usr/src/{stabber,libstrophe,profanity}
 WORKDIR /usr/src
 
-RUN git clone --depth 1 -c http.sslverify=false https://git.jabber.space/devs/stabber
-RUN git clone --depth 1 -c http.sslverify=false https://github.com/strophe/libstrophe
+RUN git clone --depth 1 https://git.jabber.space/devs/stabber
+RUN git clone --depth 1 https://github.com/strophe/libstrophe
 
 WORKDIR /usr/src/stabber
 RUN ./bootstrap.sh

Dockerfile.fedora

@@ -11,6 +11,7 @@ RUN dnf install -y \
   autoconf-archive \
   automake \
   awk \
+  ca-certificates \
   ccache \
   gcc \
   git \
@@ -50,7 +51,7 @@ ENV TERM=xterm
 RUN mkdir -p /usr/src
 WORKDIR /usr/src
 
-RUN git clone --depth 1 -c http.sslverify=false https://git.jabber.space/devs/stabber
+RUN git clone --depth 1 https://git.jabber.space/devs/stabber
 WORKDIR /usr/src/stabber
 RUN ./bootstrap.sh
 RUN ./configure --prefix=/usr --disable-dependency-tracking
@@ -59,7 +60,7 @@ RUN make install
 
 WORKDIR /usr/src
 RUN mkdir -p /usr/src/libstrophe
-RUN git clone --depth 1 -c http.sslverify=false https://github.com/strophe/libstrophe
+RUN git clone --depth 1 https://github.com/strophe/libstrophe
 WORKDIR /usr/src/libstrophe
 RUN ./bootstrap.sh
 RUN ./configure --prefix=/usr

Dockerfile.tumbleweed

@@ -10,6 +10,7 @@ RUN zypper --non-interactive in --no-recommends \
   autoconf \
   autoconf-archive \
   automake \
+  ca-certificates \
   ccache \
   gcc \
   git \
@@ -49,7 +50,7 @@ ENV TERM=xterm
 RUN mkdir -p /usr/src
 WORKDIR /usr/src
 
-RUN git clone --depth 1 -c http.sslverify=false https://git.jabber.space/devs/stabber
+RUN git clone --depth 1 https://git.jabber.space/devs/stabber
 WORKDIR /usr/src/stabber
 RUN ./bootstrap.sh
 RUN ./configure --prefix=/usr --disable-dependency-tracking

Dockerfile.ubuntu

@@ -8,6 +8,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
   autoconf \
   autoconf-archive \
   automake \
+  ca-certificates \
   ccache \
   gcc \
   git \
@@ -39,8 +40,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 RUN mkdir -p /usr/src/{stabber,libstrophe,profanity}
 WORKDIR /usr/src
 
-RUN git clone --depth 1 -c http.sslverify=false https://git.jabber.space/devs/stabber
-RUN git clone --depth 1 -c http.sslverify=false https://github.com/strophe/libstrophe
+RUN git clone --depth 1 https://git.jabber.space/devs/stabber
+RUN git clone --depth 1 https://github.com/strophe/libstrophe
 
 WORKDIR /usr/src/stabber
 RUN ./bootstrap.sh

src/config/account.h

@@ -57,6 +57,7 @@ typedef struct prof_account_t
     gchar* muc_service;
     gchar* muc_nick;
     gboolean enabled;
+    gboolean autoping_received;
     gchar* otr_policy;
     GList* otr_manual;
     GList* otr_opportunistic;

src/config/preferences.c

@@ -1816,6 +1816,7 @@ _get_group(preference_t pref)
     case PREF_TRAY:
     case PREF_TRAY_READ:
     case PREF_ADV_NOTIFY_DISCO_OR_VERSION:
+    case PREF_AUTOPING_WARNING:
         return PREF_GROUP_NOTIFICATIONS;
     case PREF_DBLOG:
     case PREF_CHLOG:
@@ -2156,6 +2157,8 @@ _get_key(preference_t pref)
         return "force-encryption.enabled";
     case PREF_FORCE_ENCRYPTION_MODE:
         return "force-encryption.policy";
+    case PREF_AUTOPING_WARNING:
+        return "autoping.warning";
     default:
         return NULL;
     }

src/config/preferences.h

@@ -188,7 +188,8 @@ typedef enum {
     PREF_VCARD_PHOTO_CMD,
     PREF_STATUSBAR_TABMODE,
     PREF_FORCE_ENCRYPTION,
-    PREF_FORCE_ENCRYPTION_MODE
+    PREF_FORCE_ENCRYPTION_MODE,
+    PREF_AUTOPING_WARNING
 } preference_t;
 
 typedef struct prof_alias_t

src/ui/console.c

@@ -1739,6 +1739,11 @@ cons_notify_setting(void)
     else
         cons_show("Subscription requests (/notify sub) : OFF");
 
+    if (prefs_get_boolean(PREF_AUTOPING_WARNING))
+        cons_show("Autoping warning (/autoping warn)   : ON");
+    else
+        cons_show("Autoping warning (/autoping warn)   : OFF");
+
     gint remind_period = prefs_get_notify_remind();
     if (remind_period == 0) {
         cons_show("Reminder period (/notify remind)    : OFF");

src/xmpp/iq.c

@@ -129,6 +129,7 @@ static void _ping_get_handler(xmpp_stanza_t* const stanza);
 static int _version_result_id_handler(xmpp_stanza_t* const stanza, void* const userdata);
 static int _disco_info_response_id_handler(xmpp_stanza_t* const stanza, void* const userdata);
 static int _disco_info_response_id_handler_onconnect(xmpp_stanza_t* const stanza, void* const userdata);
+static int _disco_autoping_warning_message(GHashTable* features);
 static int _http_upload_response_id_handler(xmpp_stanza_t* const stanza, void* const upload_ctx);
 static int _last_activity_response_id_handler(xmpp_stanza_t* const stanza, void* const userdata);
 static int _room_info_response_id_handler(xmpp_stanza_t* const stanza, void* const userdata);
@@ -2439,6 +2440,7 @@ _disco_info_response_id_handler_onconnect(xmpp_stanza_t* const stanza, void* con
             }
             child = xmpp_stanza_get_next(child);
         }
+        _disco_autoping_warning_message(features);
     }
 
     connection_features_received(from);
@@ -2446,6 +2448,26 @@ _disco_info_response_id_handler_onconnect(xmpp_stanza_t* const stanza, void* con
     return 0;
 }
 
+static int
+_disco_autoping_warning_message(GHashTable* features)
+{
+    gboolean supports_ping = g_hash_table_contains(features, "urn:xmpp:ping");
+    gboolean is_autoping_disabled = prefs_get_autoping() == 0;
+
+    // if "autoping" in disco + user wasn't alerted earlier after login + prefs for autoping recommendation alert is set
+    // then cons_show("Autoping is disabled, but server supports autoping.")
+
+    if (supports_ping && is_autoping_disabled) { // && !connection->disco_ping_alert_shown
+        // TODO: later add preference check: if (prefs_autoping_recommendation_enabled())
+        cons_show("This server supports XEP-0199: XMPP Ping (better keepalive detection),\n"
+                  "but autoping feature is currently disabled in settings.\n"
+                  "Consider enabling it (e.g., `/autoping set 30`) for improved connection stability.\n"
+                  "Use `/autoping warn disable` to disable this message.");
+        // connection->disco_ping_alert_shown = TRUE;
+    }
+    return 0;
+}
+
 static int
 _http_upload_response_id_handler(xmpp_stanza_t* const stanza, void* const userdata)
 {