Plico 0.2.8

Security hardening for shared files, more reliable sync and sends, and a smoother mailbox and Compose.

Requires Android 15 or later, on all ABIs (the APK has no native code). An update from 0.2.7 keeps your accounts, mail and settings.

Changed

• A share to Plico opens Compose at once. Before, the inbox showed first while Plico copied the files, and then the screen changed. Back now returns to the app that shared.
• Back from a folder to All inboxes now has the predictive back animation.
• Plico starts faster: the push engine does no system calls on the main thread at start.
• When you open Plico, it removes old "Message not sent" alerts. The mailbox shows failed sends.

Fixed

• After you changed the sender name or the days of mail bodies to keep, sends and downloads used the old value until Plico connected again. Now they use the new value.
• A draft with many large attachments could make the app run out of memory during the upload to the server, and then retry again and again. Now Plico refuses it with a clear error.
• A server that refuses COMPRESS or ENABLE stopped all sync for that account. Now Plico continues without them.
• A Sent copy on Riseup could be saved two times after a network error. A retry now checks for a copy first.
• Search downloaded the bodies of the oldest new results. Now it downloads the newest.
• An unexpected error during the build of a message left the draft in "Sending", and Plico later said that it "may have been sent". Now it shows the error.
• The Undo bar went away after a rotation, and it could wait behind other messages until its time was over.
• "Delete forever" in multi-select lost the selection when you tapped Cancel.
• The "Send again?" dialog closed on rotation.
• Files picked in Compose could be lost if you left the screen before the copy ended, and Send did not wait for them.
• A "Push stopped" notification action could start the push service while push was stopped from the Task Manager.
• Remote images were downloaded again after a rotation, and could stop loading. Inline BMP and AVIF images now show.

Privacy and security

• Plico does not attach a shared file that the sending app cannot read itself. Before, another app could get a file that you picked earlier in Plico.
• Shared files have a size limit for all files together, so a share cannot fill the storage of the phone.
• A copied link goes off the clipboard after 60 seconds.
• On Setup and Reauth, Plico hides the overlays of other apps, so that no app can draw over a password field.
• XML attachments that contain XHTML or SVG are now marked as dangerous files.
• Build: Gradle gets only Google groups from the Google repository.

File	Use
Plico-0.2.8.apk	Release build, signed.

SHA-256:

• Plico-0.2.8.apk: e31065f8b34d5ff67669e6933fa21aafd86b0c8a0fb12eb7d9183bda251be625

Signing certificate SHA-256: 26:25:a6:b9:7f:74:65:52:7e:9a:d0:c0:d2:70:4e:fc:d8:df:f2:e3:a8:c4:ff:f7:08:fa:21:c8:f0:d9:06:c3

Check the certificate with apksigner verify --print-certs Plico-0.2.8.apk or with AppVerifier. Do not install an APK with a different certificate.

Plico 0.2.7

A smaller APK, more stable notifications and drafts, and dialogs that stay open after a rotation.

Requires Android 15 or later, on all ABIs (the APK has no native code). An update from 0.2.6 keeps your accounts, mail and settings.

Changed

• The APK is about 9% smaller (4.1 MB, before 4.5 MB). It has only English text. Some labels from the Android libraries, for example "Close sheet", were in the language of the phone before. Now they are in English, as the rest of the app. This is also true for TalkBack.
• TalkBack and Switch Access say "Compose" for the Compose button in the mailbox. Before, the button had no name.
• In the dialogs for the account label, the sender name and the Google and Microsoft client IDs, the keyboard Done key and Enter save the value. They do the same check as the Save button.
• Build and internal: code that the app did not use is removed.

Fixed

• A rotation, a theme change, a font-size change or a window resize closed some dialogs: "Delete forever?", "Empty Trash?", "Empty Spam?", "Send again?", "Unsubscribe?" and the Move and Labels picker of a message. Now they stay open and act on the same messages. The ticks in the Labels sheet also stay.
• When Android stopped Plico in the background, a dialog that was open (for example "Discard this draft?") could open again with no tap when you went back to that screen. Now Plico starts again with no old dialogs.
• After a rotation during the Undo send time, the "Sending…" bar showed the full time again. An Undo tap in the extra time got "Too late to undo". Now the bar shows only the time that is left.
• If one update of the notifications failed, the notifications of that account stopped until Plico started again. Read, archived or deleted mail stayed in the notification shade. Now the next change updates them.
• If you edited a server draft with more than about 2 MB of text, the mailbox screen could crash at each start until you cleared the app data. Now Plico shows an error for a server draft with more than 500,000 characters and does not copy it. The draft on the server does not change, and you can still read it.

Privacy and security

• One message can download at most 8 MB of text. Before, a crafted mail with many large text parts could use all the memory of the app. Push for that account could then stop, and the app could crash when you opened the message. Now the text parts after the first 8 MB show as attachments. Normal mail does not change.

File	Use
Plico-0.2.7.apk	Release build, signed.

SHA-256:

• Plico-0.2.7.apk: a126a6a7fc2c1038624332ea7a7fa464114dd1e9c2bb0b5194e207f1413eeb77

Signing certificate SHA-256: 26:25:a6:b9:7f:74:65:52:7e:9a:d0:c0:d2:70:4e:fc:d8:df:f2:e3:a8:c4:ff:f7:08:fa:21:c8:f0:d9:06:c3

Check the certificate with apksigner verify --print-certs Plico-0.2.7.apk or with AppVerifier. Do not install an APK with a different certificate.

Plico 0.2.6

A security fix: hidden characters in a received address now show.

Requires Android 15 or later, on all ABIs (the APK has no native code). An update from 0.2.5 keeps your accounts, mail and settings.

Privacy and security

• Plico shows hidden characters in a received address as "�". These are control and format characters (bidi marks, zero-width characters), variation selectors and other characters that the screen does not show. A sender cannot use them to make an address look like a different address, and the sender checks see them. Plico does not remove them, so "pay<hidden>pal.com" does not become "paypal.com".

File	Use
Plico-0.2.6.apk	Release build, signed.

SHA-256:

• Plico-0.2.6.apk: dba3f4ce40350d9afdb0913bb14b17ba44e63a623c2a8896ccd7424e3913d97c

Signing certificate SHA-256: 26:25:a6:b9:7f:74:65:52:7e:9a:d0:c0:d2:70:4e:fc:d8:df:f2:e3:a8:c4:ff:f7:08:fa:21:c8:f0:d9:06:c3

Check the certificate with apksigner verify --print-certs Plico-0.2.6.apk or with AppVerifier. Do not install an APK with a different certificate.

Plico 0.2.5

More reliable sync and queued sends, clearer errors, better accessibility, and more privacy and security checks.

Requires Android 15 or later, on all ABIs (the APK has no native code). An update from 0.2.4 keeps your accounts, mail and settings. At the first start, Plico upgrades its database to version 6 with new indexes. This is automatic. Senders that you trusted before stay trusted.

Changed

• You can pinch to zoom the message body. A wide newsletter is then easier to read.
• Send asks a question when the subject is blank, or when your text names an attachment and the message has no file. Quoted and forwarded text does not cause the question.
• Plico asks before it removes an identity.
• The banner for a failed secure connection tells the cause, for example an expired certificate or a certificate that Android does not trust. Its Account button opens the account settings, which tell you what to do. You still cannot accept a bad certificate.
• The Undo time for archive, delete, move and spam follows the Android setting "Time to take action" when that setting is longer. Undo send, when it is on, waits at least that long. Without the setting, nothing changes.
• The search field names the open folder, for example "Search in Trash".
• Server search names the mailbox that it searches, for example "Search Inbox on server". The search scope does not change.
• TalkBack: the screen tells the name of the open folder, the message subject is a heading, and a drawer folder with the bell says "Notifications on".
• At a large font size, the reply buttons go on more lines, so that their full labels show.
• Haptics: a tick when a row swipe gets to the point where it acts, and a confirm when Send puts the mail in the queue. Both follow the system touch feedback setting.
• When you come back to the app, Plico does only the quick check of each folder. The full check of message flags runs on pull to refresh, when you open a folder, and every 6 hours. On servers without CONDSTORE (for example Microsoft), this uses less data and battery.
• Less work during sync: new database indexes for the message list, the unread counts, notifications and the first-contact check. An open message reads its body one time, not at each sync step. Plico needs fewer server requests to find deleted messages.
• Build and internal: the APK no longer has Kotlin metadata, debug tool files or an unused native library. Debug builds use StrictMode. New tests and a new README.

Fixed

• One bad message could stop the download of message bodies at each connection, and push then did not go into IDLE. Now Plico downloads at most 50 text parts of a message and shows the other parts as attachments. It sends short commands and tries a failed group of messages one at a time. Plico skips a message that still fails. Its body loads when you open it.
• With push paused or stopped, a mail in its Undo send time, or an archive or delete in its Undo time, could wait until the next app start. Now an Android job does this work when a network is available, also after you leave the app.
• Typing in a reply or forward of a very long message could be slow. The quote now stops after 32,000 characters, with a "[…]" line at the end.
• A group of large messages could use much memory during the body download (tens of MB, estimate). Plico now saves each part of the download before it gets the next part.

Privacy and security

• "Always show images from this sender" now keeps where you set it. A trust that you set on a verified Gmail message counts only on verified messages. A message with the same sender address on a different account does not load remote images.
• With the logo source "Website of the sender", Plico gets a logo only for a sender that you sent mail to, whose images you always show, or whose earlier mail you read. Before, two messages from one address were sufficient to make your phone connect to the domain of the sender.
• Forwarded photos and videos, and all videos that you add, show the "metadata kept" tag. A video file name with a date and time (for example VID_<date>_<time>.mp4) goes out as video-1.mp4, video-2.mp4 and so on, as images already do.
• Lookalike domains made of Latin letters that copy ASCII letters (for example ɡoogle.com with a script g, or lınkedin.com with a dotless i) now get the warning. The link sheet always opens for them, also with "Confirm links" off. Plico does not get sender logos from these domains.
• Plico shows only the target of a Google redirect link when the link is on a real Google domain. A host such as google.example.com no longer hides the true target in the link sheet.
• Notifications show text-direction control characters as "�", as the list and the message view do. A sender cannot reorder the name, the subject or the preview on the lock screen.
• Before Microsoft sign-in, Plico checks that no other app can catch the sign-in reply. The check now also sees apps that use the Microsoft redirect form.
• A server can no longer make Plico use all of its memory with a very large range of message numbers.
• Build only: the release build reads the signing passwords only when it signs a release. The key script does not put a password on the command line.

File	Use
Plico-0.2.5.apk	Release build, signed.

SHA-256:

• Plico-0.2.5.apk: 3c38ed852a81be4d75096ff9e4d50c4f009be466eb351ae0b3c3056906342a70

Signing certificate SHA-256: 26:25:a6:b9:7f:74:65:52:7e:9a:d0:c0:d2:70:4e:fc:d8:df:f2:e3:a8:c4:ff:f7:08:fa:21:c8:f0:d9:06:c3

Plico 0.2.4

Hardening only: memory tagging, no Play Services emoji font, and checked dependencies.

Requires Android 15 or later (arm64). An update from 0.2.3 keeps your accounts and mail.

Privacy and security

• Memory tagging (MTE) is on. Plico reads untrusted data from the network in its own process (sender logos, part of the message view). On a phone with MTE (GrapheneOS, or a Pixel 8 or later with the developer option or Advanced Protection), a bad memory access stops the app at once.
• Plico no longer asks for a downloadable emoji font. On a phone with Google Play Services, that request went to the Play Services font provider. Plico uses the system emoji font.
• The build checks the SHA-256 of each dependency and of the Gradle distribution.

File	Use
Plico-0.2.4.apk	Release build, signed.

SHA-256:

• Plico-0.2.4.apk: 3b5d714bf4d2c8ea686ba14d449ed66967f977ffabbe739cabb2b9d2758c7208

Signing certificate SHA-256: 26:25:a6:b9:7f:74:65:52:7e:9a:d0:c0:d2:70:4e:fc:d8:df:f2:e3:a8:c4:ff:f7:08:fa:21:c8:f0:d9:06:c3

Plico 0.2.3

An attachment download stops when the server sends more data than the attachment has.

Requires Android 15 or later (arm64). An update from 0.2.2 keeps your accounts and mail.

Fixed

• A server that ignores the requested range of a partial fetch no longer makes an attachment download fill the storage. Plico now stops with an error when the server sends more than it asked for, or more than the size of the attachment, and deletes the partial files.

File	Use
Plico-0.2.3.apk	Release build, signed.

SHA-256:

• Plico-0.2.3.apk: f11b701fcb9a31bbcc077af25aa582c0e690d8db0fc3e3a783bdcca731f93104

Signing certificate SHA-256: 26:25:a6:b9:7f:74:65:52:7e:9a:d0:c0:d2:70:4e:fc:d8:df:f2:e3:a8:c4:ff:f7:08:fa:21:c8:f0:d9:06:c3

Plico 0.2.2

Wide emails fit the screen, and fixes from a full review of the app.

Requires Android 15 or later (arm64). An update from 0.2.1 keeps your accounts and mail.

Changed

• Wide emails: an email that is wider than the screen now zooms out until it fits. You do not scroll sideways. Narrow emails keep their normal size.
• Send a draft that may have been sent: Compose now asks "Send again?" first, as the Retry button does.

Fixed

• A very large message (more than about 2 MB of text) no longer crashes the app when you open it.
• A change made offline, or a copy for Sent, is no longer dropped after a day without a connection. Plico now gives up only after 24 hours of failed tries.
• On servers without ESEARCH, the check for deleted mail in a very large mailbox could stop the sync of the account. It now searches in smaller parts.
• Deleting many messages is faster (new database index).
• When you dismiss one notification, the summary now shows the new count.
• Rare: stopping push at the same time as a new start no longer crashes the app.

Privacy and security

• A mailto link can no longer show a false address in the recipient field. Plico keeps only the addresses from a link, not the names.
• Hidden text-direction characters in the sender or subject of the message list become visible, so they cannot disguise text (for example a file name).

File	Use
Plico-0.2.2.apk	Release build, signed.

SHA-256:

• Plico-0.2.2.apk: b934fee51e6edc860e1f793e00881a0c238632834b8d96951447abd64ebba6b9

Signing certificate SHA-256: 26:25:a6:b9:7f:74:65:52:7e:9a:d0:c0:d2:70:4e:fc:d8:df:f2:e3:a8:c4:ff:f7:08:fa:21:c8:f0:d9:06:c3

Plico 0.2.1

Two fixes for the message list settings.

Requires Android 15 or later (arm64). An update from 0.2.0 keeps your accounts and mail.

Changed

• Mark unread mail off: unread mail no longer has bold text. Unread and read mail look the same.
• Account dots (new, on by default): when a list shows mail from more than one account, a small dot shows the colour of the account. Before, this dot came with "Colour for unread mail".
• Colour for unread mail off: all avatars are neutral. The account colour shows only as the dot.

File	Use
Plico-0.2.1.apk	Release build, signed.
Plico-0.2.1-debug.apk	For the live tests. Installs as a separate app (app.plico.debug).

SHA-256:

• Plico-0.2.1.apk: bd83fc8572eaa58fee60e83c444a7185706a62d18cc2816097b3a500a2a2fc1e
• Plico-0.2.1-debug.apk: ed7d9834b08caf1bfa3794779b1c26f7cd4184031731de0ba2243dafca334a8e

Signing certificate SHA-256: 26:25:a6:b9:7f:74:65:52:7e:9a:d0:c0:d2:70:4e:fc:d8:df:f2:e3:a8:c4:ff:f7:08:fa:21:c8:f0:d9:06:c3

Plico 0.2.0

Plico now works with any IMAP mail account, and the message list shows unread mail clearly.

Requires Android 15 or later (arm64). An update from 0.1.0 keeps your accounts and mail.

New

• Setup has one email field. Plico finds the server settings: from its list of common providers, from the autoconfig file of your mail domain, or from DNS. You can also enter the servers yourself.
• Any IMAP and SMTP server with SSL/TLS or STARTTLS. Plico never connects without encryption.
• Servers without IMAP IDLE: Plico checks for new mail at an interval.
• Outlook.com and Microsoft 365: sign in with Microsoft in the browser. This needs your own Microsoft client ID (see the README). Not yet tested with real Microsoft accounts.
• Settings → Message list:
  • Mark unread mail: unread mail gets a dot and bold text. Read mail uses lighter text.
  • Colour for unread mail: unread mail gets a colour for each sender. Read mail keeps the usual colour.
  • Sender logos (off by default): the logo comes from DuckDuckGo, the website of the sender, or Google. Plico sends only the domain of the sender, never the address.

Privacy

• At setup, Plico asks only your mail domain for its settings (HTTPS only) and uses the DNS of your phone. No third party gets your address.
• Sender logos add network connections only when you turn them on.

File	Use
Plico-0.2.0.apk	Release build, signed.
Plico-0.2.0-debug.apk	For the live tests. Installs as a separate app (app.plico.debug).

SHA-256:

• Plico-0.2.0.apk: caf40b70cfa3c1809f5ba8bcd6838afe75b9e9f31cc07de127bc41f5fa0c53ce
• Plico-0.2.0-debug.apk: ae996d28aeb0efb004471b42960d4023cff170d9abe96e0d0bb20a24ee1e6ead

Signing certificate SHA-256: 26:25:a6:b9:7f:74:65:52:7e:9a:d0:c0:d2:70:4e:fc:d8:df:f2:e3:a8:c4:ff:f7:08:fa:21:c8:f0:d9:06:c3

Plico 0.1.0

First build of Plico. Pre-release: IDLE push, sync and sending are not yet tested against real Riseup and Gmail servers. See docs/LIVE-TESTS.md.

Requires Android 15 or later (arm64).

File	Use
Plico-0.1.0.apk	Release build, signed.
Plico-0.1.0-debug.apk	For the live tests. Installs as a separate app (app.plico.debug).

SHA-256:

• Plico-0.1.0.apk: 12c05782293407d8c36b9031dd2f596946f6c6b0f3a84cfc7ac7d36b1ab64640
• Plico-0.1.0-debug.apk: ac9e96c6d7522456b35f62049af0069dea022ff8ebe18784e36649cdcba4efe2

Signing certificate SHA-256: 26:25:a6:b9:7f:74:65:52:7e:9a:d0:c0:d2:70:4e:fc:d8:df:f2:e3:a8:c4:ff:f7:08:fa:21:c8:f0:d9:06:c3