Skip to content

Releases: ChocoTonic/Mailspring

Release list

Verified security fork desktop packages (unsigned)

Verified security fork desktop packages (unsigned) Pre-release
Pre-release

Choose a tag to compare

View all tags
@ChocoTonic ChocoTonic released this 22 Oct 04:20
security-desktop-20261022
7d493a0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Unsigned portable security-fork packages for Windows x64, Linux x64/ARM64 and macOS x64/ARM64, built from 7d493a0.

Electron is pinned to 44.9.3. The separate native mail/HTTPS process is pinned to tested source f003261db0f4745161313ad000f6f4b5f22649ac and the verified native release: https://github.com/ChocoTonic/Mailspring-Sync/releases/tag/emudhra-security-20261021 .

Validation: all five packaging jobs passed. Each packaged native executable matches its tested release digest, starts successfully and passes two isolated database migrations. Package source markers and fork-update policy were checked. Full Linux app installation, lint, type checking and the Electron suite passed on the published source. Independent Windows checks confirm Electron 44.9.3 and the native executable digest. SHA256SUMS and desktop-release-provenance.json record the archives and CI evidence.

Download the archive matching your OS and CPU, verify its SHA-256, and extract the entire archive so executable permissions and framework links are preserved. Quit the existing app normally and back up the mail profile before replacing app files. Keep the full app directory together; copying only Mailspring.exe or mailsync is insufficient. These are portable app bundles, not signed platform installers.

The security fork uses manual updates from this repository. Background checks do not use upstream installers, which could replace the fork's native mitigation. Existing installations are not changed by this release.

Requirements and limits:

  • macOS 13.5 or later; packages are unsigned and not notarized.
  • Linux x64 requires glibc 2.34 or later; ARM64 requires glibc 2.38 or later, plus the app's normal desktop runtime libraries.
  • Native macOS HTTPS-proxy URLs are rejected; HTTP and SOCKS proxies remain supported.
  • DIGEST-MD5 authentication is disabled without fallback to a weaker method.
  • Native OpenSSL 3.6.5 is patched, but its release branch reaches end of support on November 1, 2026 and requires a supported-baseline update before then.

Source: https://github.com/ChocoTonic/Mailspring/tree/7d493a0634307f35bae9b6252acbe589135a0fd5
Packaging and native execution checks: https://github.com/ChocoTonic/Mailspring/actions/runs/39719304148

Loading