SF-Mail

SF-Mail is an unofficial, security-friendly e-mail client for Sailfish OS with built-in OpenPGP and S/MIME. Its goal is to make encrypted e-mail genuinely easy: encrypt, decrypt and sign mail (PGP/MIME, inline PGP and S/MIME), including encrypted attachments. Accounts, folders and messages come from the system mail database, so the app sits next to the stock mail app and shares its accounts. "SF" is not short for Sailfish - it stands for making security friendly.

FEATURES
- Accounts, per-account folders, combined inbox; read, delete, move; raw headers with sender checks (SPF/DMARC via DNS, From/Return-Path mismatch, optional DNS blacklists - only the sender's IP/domain is ever looked up)
- Attachments (plain, PGP, S/MIME): open with... or save as...; large ones download on demand
- OpenPGP: encrypt, sign, decrypt by tap (PGP/MIME and inline PGP), signature status; blind copies stay blind (one message per audience), encrypted subjects via protected headers
- Key management in the app: create RSA-4096 keys, import/export, back up, extend expiry, revoke, publish to keys.openpgp.org; keyserver lookup never auto-imports
- S/MIME: sign/encrypt/decrypt, create a self-signed certificate, import .p12, import a sender's certificate from a signed message
- Crypto type follows the conversation; 1-tap key import with safety checks; address-book picker with per-recipient crypto hint
- Hardened: passphrases never reach the keyboard learning or the process command line, the process is not dumpable, unlocked keys are not kept between operations
- English and German UI

PLEASE READ - THIS CHANGES A SYSTEM FILE
Tapping a "new mail" notification (and mailto: links, "share via e-mail") goes to whichever program owns the D-Bus name com.jolla.email.ui. So that SF-Mail can receive them, the package rewrites /usr/share/dbus-1/services/com.jolla.email.ui.service and adds /etc/sailjail/permissions/EmailUi.permission. The original service file is kept next to it (.sfmail-orig) and restored by rpm -e. A switch in About -> System ("Open mail notifications in this app", on by default) hands everything back to the previous client at any time. The stock client itself is never modified or removed. If you would rather not have this, leave the switch off.

TRUST MODEL
Trust is decided on the device, not delegated to an authority: identities you create and identities you import stand on the same footing and become trusted when you, having seen the fingerprint, say so - for S/MIME exactly as for PGP. Revocation lists are not consulted.

WHY IS A GNUPG BUNDLED?
The system gpg on Sailfish OS is too old to read modern keyrings, so the app ships a maintained GnuPG 2.5 stack under its own prefix with its own keyring - entirely separate from the system keystore. This is where the package size comes from.

ARCHITECTURES
aarch64 (Sailfish OS 5.0+), armv7hl (Sailfish OS 4.6+).

Written with Claude Code (Anthropic), icons included.

Source, issues, releases: https://github.com/JimKnopfIoT/harbour-sfmail