SF-Mail
SF-Mail is an unofficial, security-friendly e-mail client for Sailfish OS with built-in OpenPGP and S/MIME. Its goal is to make encrypted e-mail genuinely easy: encrypt, decrypt and sign mail (PGP/MIME, inline PGP and S/MIME), including encrypted attachments. Accounts, folders and messages come from the system mail database, so the app sits next to the stock mail app and shares its accounts. "SF" is not short for Sailfish - it stands for making security friendly.
FEATURES
- Accounts, per-account folders, combined inbox; read, delete, move; raw headers with sender checks (SPF/DMARC via DNS, From/Return-Path mismatch, optional DNS blacklists - only the sender's IP/domain is ever looked up)
- Attachments (plain, PGP, S/MIME): open with... or save as...; large ones download on demand
- OpenPGP: encrypt, sign, decrypt by tap (PGP/MIME and inline PGP), signature status; blind copies stay blind (one message per audience), encrypted subjects via protected headers
- Key management in the app: create RSA-4096 keys, import/export, back up, extend expiry, revoke, publish to keys.openpgp.org; keyserver lookup never auto-imports
- S/MIME: sign/encrypt/decrypt, create a self-signed certificate, import .p12, import a sender's certificate from a signed message
- Crypto type follows the conversation; 1-tap key import with safety checks; address-book picker with per-recipient crypto hint
- Hardened: passphrases never reach the keyboard learning or the process command line, the process is not dumpable, unlocked keys are not kept between operations
- English and German UI
PLEASE READ - THIS CHANGES A SYSTEM FILE
Tapping a "new mail" notification (and mailto: links, "share via e-mail") goes to whichever program owns the D-Bus name com.jolla.email.ui. So that SF-Mail can receive them, the package rewrites /usr/share/dbus-1/services/com.jolla.email.ui.service and adds /etc/sailjail/permissions/EmailUi.permission. The original service file is kept next to it (.sfmail-orig) and restored by rpm -e. A switch in About -> System ("Open mail notifications in this app", on by default) hands everything back to the previous client at any time. The stock client itself is never modified or removed. If you would rather not have this, leave the switch off.
TRUST MODEL
Trust is decided on the device, not delegated to an authority: identities you create and identities you import stand on the same footing and become trusted when you, having seen the fingerprint, say so - for S/MIME exactly as for PGP. Revocation lists are not consulted.
WHY IS A GNUPG BUNDLED?
The system gpg on Sailfish OS is too old to read modern keyrings, so the app ships a maintained GnuPG 2.5 stack under its own prefix with its own keyring - entirely separate from the system keystore. This is where the package size comes from.
ARCHITECTURES
aarch64 (Sailfish OS 5.0+), armv7hl (Sailfish OS 4.6+).
Written with Claude Code (Anthropic), icons included.
Source, issues, releases: https://github.com/JimKnopfIoT/harbour-sfmail
Category:
Keywords:
Application versions:
| Attachment | Size | Date |
|---|---|---|
 harbour-sfmail-0.8.7-1.aarch64.rpm | 3.03 MB | 06/09/2026 - 22:40 |
| harbour-sfmail-0.8.7-1.armv7hl.rpm | 2.48 MB | 06/09/2026 - 22:40 |
Changelog:
- S/MIME signatures are now actually verified. Until this release the app
reported "Signed S/MIME message" on the strength of a header alone and listed
the certificates the message carried; nothing was checked. Signatures are now
put to gpgsm and the reader states the outcome: valid, valid but issued by an
authority you have not trusted, invalid, or not checkable. The certificates a
message brings along are no longer left behind in the store as a side effect.
- Importing somebody's certificate goes through a dialog first: subject,
addresses, issuer, fingerprint, expiry, and a warning when a different
certificate is already stored for that address. A root becomes a trust anchor
only if you say so; it used to happen by itself. Missing issuer certificates
are fetched only on request, only over HTTPS, and never become trusted.
- The OpenPGP signature verdict distinguishes what it used to hide: a revoked or
expired key no longer reads as an ordinary signature, and a good signature made
by a key that does not carry the sender's address is flagged as such. A key
block containing several keys names all of them before importing.
- Recipient lookup matches the address exactly. A key for
"you@example.com.somewhere-else" can no longer answer a search for
"you@example.com".
- Message lists and headers are drawn as plain text. A crafted subject line
could previously make the list fetch a remote image, which tells the sender
that the message was displayed.
- Decrypted attachments are erased when the app starts and when it closes,
including the copies handed to other apps. The debug log is off by default,
capped in size, and readable only by its owner.
- Mail that could not be sent is visible: the account page shows how much is
waiting and retries every account, not just the last one used. Delivery
failures are told apart by their cause instead of by pattern-matching the
server's reply.
- The bundled GnuPG stack ships only the programs the app runs, its sources are
checked against recorded digests at build time, and the unused pinentry stub
is gone. The aarch64 package states its real requirement: Sailfish OS 5.1.
- The interface speaks 32 languages.
Recent comments