v0.1.0 — JA4+ suite in Go

First release of ja4plus-go — a clean, dependency-free Go implementation of the full FoxIO JA4+ network fingerprint suite.

Fingerprints

• JA4 — TLS client (ClientHello), with GREASE filtering and a bounds-checked parser
• JA4S — TLS server (ServerHello)
• JA4H — HTTP client request
• JA4L — one-way latency / light distance (client & server variants)
• JA4T — TCP SYN fingerprint
• JA4X — X.509 certificate (issuer/subject RDN OIDs, extension OIDs)
• JA4SSH — SSH traffic sample

All exported as pure, I/O-free functions over parsed inputs. Standard library only.

Verification (no fabricated hashes)

• JA4: the three cipher/extension hash vectors from JA4.md match verbatim; a real curl 7.81.0 ClientHello parses to t13d3113h2_e8f1e7e78f70_ce5650b735ce, identical to tls.peet.ws; all 6 ALPN vectors match.
• JA4S: real example.com TLS 1.3 ServerHello → t130200_1302_234ea6891581 via the documented algorithm.
• JA4H: full a_b_c_d output matched against FoxIO's ja4h.py reference algorithm.
• JA4X: oidToHex matches 6 known DER encodings; a single-CN subject = 7022c563de38, matching FoxIO's published Async/Quasar/BitRAT subject hash; end-to-end on a real certificate.
• JA4T / JA4L / JA4SSH: FoxIO's published example vectors reproduced.

See the verification-status table in the README for the exact method and honest gaps per fingerprint.

Quality

go build / go vet / gofmt -l / go test -race all green (22 tests). CI runs on Go 1.22 and 1.23.

Credit & licensing

JA4+ is the work of FoxIO, LLC. This Go code is MIT; the JA4+ methods remain FoxIO's IP (JA4 = BSD-3-Clause; the rest patent-pending under the FoxIO License 1.1). "JA4"/"JA4+" are trademarks of FoxIO, Inc.