Plico 0.2.8

Security hardening for shared files, more reliable sync and sends, and a smoother mailbox and Compose.

Requires Android 15 or later, on all ABIs (the APK has no native code). An update from 0.2.7 keeps your accounts, mail and settings.

Changed

• A share to Plico opens Compose at once. Before, the inbox showed first while Plico copied the files, and then the screen changed. Back now returns to the app that shared.
• Back from a folder to All inboxes now has the predictive back animation.
• Plico starts faster: the push engine does no system calls on the main thread at start.
• When you open Plico, it removes old "Message not sent" alerts. The mailbox shows failed sends.

Fixed

• After you changed the sender name or the days of mail bodies to keep, sends and downloads used the old value until Plico connected again. Now they use the new value.
• A draft with many large attachments could make the app run out of memory during the upload to the server, and then retry again and again. Now Plico refuses it with a clear error.
• A server that refuses COMPRESS or ENABLE stopped all sync for that account. Now Plico continues without them.
• A Sent copy on Riseup could be saved two times after a network error. A retry now checks for a copy first.
• Search downloaded the bodies of the oldest new results. Now it downloads the newest.
• An unexpected error during the build of a message left the draft in "Sending", and Plico later said that it "may have been sent". Now it shows the error.
• The Undo bar went away after a rotation, and it could wait behind other messages until its time was over.
• "Delete forever" in multi-select lost the selection when you tapped Cancel.
• The "Send again?" dialog closed on rotation.
• Files picked in Compose could be lost if you left the screen before the copy ended, and Send did not wait for them.
• A "Push stopped" notification action could start the push service while push was stopped from the Task Manager.
• Remote images were downloaded again after a rotation, and could stop loading. Inline BMP and AVIF images now show.

Privacy and security

• Plico does not attach a shared file that the sending app cannot read itself. Before, another app could get a file that you picked earlier in Plico.
• Shared files have a size limit for all files together, so a share cannot fill the storage of the phone.
• A copied link goes off the clipboard after 60 seconds.
• On Setup and Reauth, Plico hides the overlays of other apps, so that no app can draw over a password field.
• XML attachments that contain XHTML or SVG are now marked as dangerous files.
• Build: Gradle gets only Google groups from the Google repository.

File	Use
Plico-0.2.8.apk	Release build, signed.

SHA-256:

• Plico-0.2.8.apk: e31065f8b34d5ff67669e6933fa21aafd86b0c8a0fb12eb7d9183bda251be625

Signing certificate SHA-256: 26:25:a6:b9:7f:74:65:52:7e:9a:d0:c0:d2:70:4e:fc:d8:df:f2:e3:a8:c4:ff:f7:08:fa:21:c8:f0:d9:06:c3

Check the certificate with apksigner verify --print-certs Plico-0.2.8.apk or with AppVerifier. Do not install an APK with a different certificate.