Remove gpg-suite Mail.app plugin

[ckundo]

• The plugin autodecrypts messages, which exposes users to EFAIL vulnerability.
• https://efail.de/
• https://www.eff.org/deeplinks/2018/05/attention-pgp-users-new-vulnerabilities-require-you-take-action-now

[Closes #531]

[derekprior]

This would break the asdf install of nodejs which attempts to verify the package signatures. We can disable this check when installing nodejs, but then any future installs of nodejs would need to know to do this.

Another alternative would be to rm /Library/Mail/Bundles/GPGMail.mailbundle

[ckundo]

@derekprior from what I can tell, the asdf node installation uses gpg cli, which doesn't require the entire gpg-suite installation. I think just brew install gpg2 would work.

https://github.com/asdf-vm/asdf-nodejs/blob/7edd9d6b9a04d2eef8aeeb9c8d9fe038d07f57a4/bin/install#L165

Edit: brew install gpg2 alone is not enough, looks like the keyservers are not configured on install.

[georgebrock]

If I've understood the vulnerabilities correctly, they require the message to not only be decrypted but also rendered in a mail agent that downloads images, styles, etc. by default.

Seems like Derek's proposed solution (rm …/GPGMail.mailbundle) would mitigate that, without needing to remove the whole of the GPG suite.

See https://efail.de/ for more.

[cpytel]

This PR was made against master, so I needed to recreate it. I also wanted to test it on a fresh install of macOS Monterey. While searching, I found an alternative brew package which does not install the mail extension and I opened a PR for that instead #607

[ckundo]

thanks @cpytel sounds good!