fix(xmpp): obfuscate client identity in protocol exchanges

Modify version responses to return a generic client name and omit
version strings. Drop the "profanity." prefix from dynamically
generated JID resources. Spoof the XEP-0115 capabilities node URI to
prevent service discovery/presence fingerprinting. These adjustments
reduce the client's attack surface by minimizing identifiable metadata.

.github/workflows/docker-publish.yml

@@ -1,44 +0,0 @@
-name: Publish Docker image
-
-on:
-  push:
-    branches: [master]
-  release:
-    types: [published]
-
-jobs:
-  push_to_registry:
-    name: Push Docker image to Docker Hub
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - name: Check out the repo
-        uses: actions/checkout@v7
-
-      - name: Log in to Docker Hub
-        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Extract metadata (tags, labels) for Docker
-        id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051
-        with:
-          images: cproofdev/cproof
-          tags: |
-            type=raw,value=dev,enable={{is_default_branch}}
-            type=sha,prefix=nightly-,enable={{is_default_branch}}
-            type=ref,event=tag
-            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/') }}
-
-      - name: Build and push Docker image
-        id: push
-        uses: docker/build-push-action@2bd26e71295ee32cbf6a73510d165bf7232460f3
-        with:
-          context: .
-          file: ./ci/Dockerfile
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}

ci/Dockerfile

@@ -1,106 +0,0 @@
-# =============================================================================
-# Stage 1: Build
-# =============================================================================
-FROM ubuntu:26.04 AS builder
-
-ENV DEBIAN_FRONTEND=noninteractive
-
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    build-essential \
-    autoconf \
-    automake \
-    autoconf-archive \
-    ca-certificates \
-    libtool \
-    pkg-config \
-    git \
-    wget \
-    libglib2.0-dev \
-    libcurl4-openssl-dev \
-    libsqlite3-dev \
-    libncurses-dev \
-    libreadline-dev \
-    libnotify-dev \
-    python3-dev \
-    python3 \
-    libgpgme-dev \
-    libotr5-dev \
-    libgtk-3-dev \
-    libgdk-pixbuf-2.0-dev \
-    libsignal-protocol-c-dev \
-    libgcrypt20-dev \
-    libqrencode-dev \
-    libxss-dev \
-    libcmocka-dev \
-    && rm -rf /var/lib/apt/lists/*
-
-# Build libstrophe from source (not available as Ubuntu package)
-RUN git clone --depth 1 https://git.jabber.space/devs/libstrophe-gh-mirror.git /tmp/libstrophe \
-    && cd /tmp/libstrophe \
-    && autoreconf -i \
-    && ./configure --prefix=/usr \
-    && make -j$(nproc) \
-    && make install \
-    && rm -rf /tmp/libstrophe
-
-WORKDIR /src
-
-COPY . .
-
-RUN ./bootstrap.sh \
-    && ./configure \
-        --enable-notifications \
-        --enable-icons-and-clipboard \
-        --enable-otr \
-        --enable-pgp \
-        --enable-omemo \
-        --enable-plugins \
-        --enable-c-plugins \
-        --enable-python-plugins \
-        --with-xscreensaver \
-        --enable-omemo-qrcode \
-        --enable-gdk-pixbuf \
-    && make -j$(nproc) \
-    && make install
-
-# =============================================================================
-# Stage 2: Runtime (minimal)
-# =============================================================================
-FROM ubuntu:26.04
-
-ENV DEBIAN_FRONTEND=noninteractive
-
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    ca-certificates \
-    libglib2.0-0t64 \
-    libcurl4t64 \
-    libsqlite3-0 \
-    libncursesw6 \
-    libreadline8t64 \
-    libnotify4 \
-    python3 \
-    libpython3.14 \
-    libgpgme45 \
-    libotr5t64 \
-    libgtk-3-0t64 \
-    libgdk-pixbuf-2.0-0 \
-    libsignal-protocol-c2.3.2 \
-    libgcrypt20 \
-    libqrencode4 \
-    libxss1 \
-    && rm -rf /var/lib/apt/lists/* \
-    && apt-get clean
-
-COPY --from=builder /usr/local/bin/profanity /usr/local/bin/profanity
-COPY --from=builder /usr/local/lib/libprofanity* /usr/local/lib/
-COPY --from=builder /usr/local/include/profapi.h /usr/local/include/
-COPY --from=builder /usr/local/share/profanity /usr/local/share/profanity
-COPY --from=builder /usr/lib/libstrophe.so* /usr/lib/
-
-RUN ldconfig
-
-RUN ldd /usr/local/bin/profanity | grep 'not found' && exit 1 || true
-
-RUN mkdir -p /root/.config/profanity
-
-ENTRYPOINT ["profanity"]

src/xmpp/stanza.c

@@ -931,22 +931,19 @@ stanza_create_caps_query_element(xmpp_ctx_t* ctx)
 
     xmpp_stanza_t* identity = xmpp_stanza_new(ctx);
     xmpp_stanza_set_name(identity, "identity");
-    xmpp_stanza_set_type(identity, "pc");
     xmpp_stanza_set_attribute(identity, "category", "client");
+    xmpp_stanza_set_type(identity, "pc");
 
     ProfAccount* account = accounts_get_account(session_get_account_name());
+    gchar* client = account->client;
+    bool is_custom_client = client != NULL;
 
-    auto_gchar gchar* name = g_strdup(account->client ? account->client : "Pidgin");
+    GString* name_str = g_string_new(is_custom_client ? client : "Pidgin");
 
-    if (account->client) {
-        gchar* space = strchr(name, ' ');
-        if (space) {
-            *space = '\0';
-        }
-    }
     account_free(account);
 
-    xmpp_stanza_set_attribute(identity, "name", name);
+    xmpp_stanza_set_attribute(identity, "name", name_str->str);
+    g_string_free(name_str, TRUE);
     xmpp_stanza_add_child(query, identity);
     xmpp_stanza_release(identity);