PGP for Apple's Mail
GPGMail is a plug-in for Apple's Mail, providing a front-end to gpg for some operations.
GPGMail extends Apple's Mail application and allows you to read and send PGP authenticated and/or encrypted messages. You can use GPGMail for plain text and MIME messages, following RFC 3156.
GPGMail does not contain any encryption code: it is a client to gpg executable.
GPGMail is a complete hack, relying on Mail's private internal API. Use it at your own risks!

GPGMail has been localized in 9 different languages, thanks to contributors: it is distributed in English, Spanish, Japanese, French, German, Danish, Korean, Swedish and Italian!
(September 10, 2002) GPGMail Release 0.5.4 (v22) is currently available.
Information on this page includes:
Once started, Mail has a new submenu, PGP, in its
Message menu, containing 4 items:
- Decrypt
- Authenticate
- Encrypt New Message
- Sign New Message
|
|
Mail also has a new Preferences panel in which you
can set:
- your PGP Identity (aka userID)
- some other options like auto-decryption, auto-authentication, passphrase cacheing, etc.
In the Composer window, you can also add two toolbar items (by customizing the toolbar) to set the
encryption (on/off) and add or not your PGP signature; you can also use menu items
PGP/Encrypt New Message and PGP/Sign New Message. When you compose
a new message, you can sign it (you will be asked for your identity
passphrase), and/or you can encrypt it. Note that encryption/signature is applied on the whole message.
GPGMail can use two different formats for encryption/signature: if your message consists only of plain text (no attachments, no rich text attributes like bold, italic, etc.), GPGMail will use the old PGP format, with in-line -----PGP----- armored signature/encryption. In the other case, it will use the new OpenPGP/MIME format, with MIME attachments, which is not recognized by some mail agents like Outlook/Entourage/Eudora, but welcomed by Sylpheed, Mulberry and others. If you prefer GPGMail to always use the OpenPGP/MIME format, then quit Mail, launch Terminal, type defaults write com.apple.mail GPGOpenPGPStyleOnly YES and restart Mail.
When you browse through messages, GPGMail can operate automatically, or on-demand. In automatic mode, it tries to authenticate or decrypt the currently selected message; in manual mode, you click on a button/menu to decrypt or authenticate the currently selected message; you can also use the contextual menu.
If you've set GPGMail to automatically authenticate messages and you don't want to be bothered by messages telling you that the message has be successfully authenticated, and would prefer to be warned only of invalid signatures, then use the following user default: GPGBadAuthenticationAlertOnly (default value is NO).
Encryption/decryption of plain text and MIME messages works.
Note that there is a hidden user default, GPGEncryptsToSelf, which allows
you to not encrypt messages with your key: by default it is set to YES, allowing
you to re-read encrypted sent messages.
Decryption of HTML messages works too, if there's a plain text alternative, but you need to tell Mail to display the plain text alternative after you decrypted the message (menu Message/Show/Plain Text Alternative). Don't expect better support in the future!
If you allow passphrase cacheing, passphrase is stored in cache during
a small amount of time (default is 60 seconds): if it has not been used during this time, cache
is cleared.
Current limitations
- GPGMail accepts only one personal PGP key.
- GPGMail always uses your default identity and all message receivers
addresses as recipients for encryption (
To and CC. For security considerations, BCC recipients are not taken in account).
- GPGMail does not support PGP keys distribution (following RFC 3156)
- GPGMail does not support S/MIME
- GPGMail encrypts/signs the whole message, and can decrypt/verify
only the whole message. You can not choose which part you want to encrypt.
- Encryption operation cannot be interrupted
- You cannot send encrypted messages with
BCC recipients.
- You cannot forward or reply to encrypted messages: encrypted message is used. You need to copy decrypted message into new message, or select the decrypted content and click on the Reply button.
- If Mail cannot deliver the message immediately, it postpones delivery but doesn't prevents you from modifying the message; do NOT modify a signed or encrypted message!!!
- No warning to user if only part of the message was signed.
You need MacOS X 10.1.x or 10.2.x; GPGMail will not work as-is on other OS versions, because the internals of Apple's Mail changes on every revision...
You need a gpg version >= 1.0.6.
You can use MacGPG distribution, available at MacGPG web site.
gpg executable is expected to be located in /usr/local/bin/. The location can be modified using
user default gpg.
Stéphane Corthésy makes this software available for anyone to use, under the terms of this Open Source License.
GPGMail is ©copyright 2000-2002 Stéphane Corthésy. I reserve all
rights to this piece of software. I take no responsibility for any
damage this software, through omission or error, might cause. This software
is provided "as is" and with no warranty.
As usual, I welcome feedback on this piece of code.
If you have bug reports, suggestions or, even better, patches for
GPGMail, please send an e-mail to gpgmail@sente.ch
My PGP key is available from the following keyserver (use --keyserver option for gpg): wwwkeys.us.pgp.net. My key ID: 0x992020D4. My key fingerprint: A5BA B3D8 4F6C AE03 8B22 76F2 5467 B616 9920 20D4
If you like it, tell it to me, and to Apple, this way they will (perhaps...) help me to port it to future MacOS X releases.
GPGMail is free software, but if you want to give something... well, send me a postcard for my birthday (September 22nd) ;-)
Sen:te, Petit-Chêne 18ter, 1003 Lausanne, Switzerland
Following suggestions from users, I set up a mailing list, gpgmail-users@sente.ch. It is intended to be a very low traffic mailing list, mainly used by me to announce news on GPGMail development. Anyone can subscribe. Archives can be consulted on-line. Note that you may post messages too, if you want to exchange opinions/ideas on GPGMail with other users.
(Sep 10th, 2002) GPGMail Release 0.5.4 (v22) is currently available.
- Added Swedish translation from Daniel Aarno
- Added Italian translation from Filippo Stefanelli
- Corrected some glitches with passphrase panel
- No longer leaves files in
/tmp
- Added an installer
- Documentation translated in French
- License has been modified
- Corrected Korean translation
- Added support for MacOS X 10.2.x
- Corrected compatibility problem between contextual menu and other Mail plug-ins
(Jun 23rd, 2002) GPGMail Release 0.5.3 (v20):
- Added Spanish translation from Sergio Rodríguez Concha
- Added French translation from Michel Poulain
- Added Japanese translation from Tomio Arisaka
- Added beautiful icons from Michel Poulain
- Modified "decrypted" icon, by Jamin Wilson
- Added new userDefaults,
GPGOpenPGPStyleOnly (default value is NO), to force always using OpenPGP-style encryption/signing
- Corrected problems with attachments which were not yet loaded
- Corrected problem with Kotoeri input method
- Added German translation from Hauke Müller
- Added Danish translation from Thomas Dyhr
- Stopped support for MacOS X Server (Rhapsody)
- Added Korean translation from Sangduk Park
- Added support for encapsulated signature (RFC1847); this is now the default method used when encrypting a signed message with OpenPGP style.
- Corrected state of newly added toolbar buttons
- Corrected problems due to character sets (no longer forces use of UTF8)
- Added contextual menu for decryption/authentication
- Corrected header decoding bug
- Corrected signature bug
- Corrected compatibility problems with Sylpheed, Evolution, Entourage, Outlook, Eudora, etc.
- Corrected compatibility problem with MacOS X 10.1.5
- Added basic support for HTML signed/encrypted messages
- Corrected problem with gpg 1.0.7: you no longer need to sign keys before using them for encryption. With gpg 1.0.6, you still need to: if you don't, encryption is refused.
- Corrected problems with MailPriority >= 1.1
(Nov 22nd, 2001) GPGMail Release 0.5.2 (v13):
- Ported to MacOS X 10.1.x
- Corrected problems with character sets
- Added keyboard shortcuts
- Now needs gpg version >= 1.0.6
- No version for MacOS X Server 1.x
(Sep 8th, 2001) GPGMail Release 0.5.1 (v8):
- Ported to MacOS X 10.0.4
- Corrected bugs in the application of RFC 3156
- Corrected lots of other bugs
(Feb 7th, 2001) GPGMail Release 0.5 (v4): initial release, for MacOS X Server 1.x and MacOS X Public Beta.
Known bugs
- Decryption fails if message was also signed and signer key is not
available.
- Toolbar buttons are sometimes duplicated, when you have multiple
viewers.
- Toolbar buttons are sometimes lost or moved.
- In some circumstances, GPGMail is unable to decrypt MIME messages
if your secret keyring contains more than one key.
- Appearance of encrypted mail attachments changes over time.
Ideas for future developments
- Use a sheet when asking for passphrase
- Add full compliance with RFC 3156
- Better filtering of
gpg error messages by using GPGME
- Add support for multiple PGP identities
- Allow recipients choice
- Use KeyChain Manager
- Customize display of signed/encrypted message
- Add support for
BCC recipients
- Add support for partial encryption/signature (not the whole message)
- Full multithreading of encryption/decryption
- Add support for S/MIME
- Full localization, in different languages (if you're interested to translate GPGMail in another language, read this)
- Allow decrypted message forwarding/replying
- Automatic search of missing keys for encryption
- Automatic check of key trust level
- Full parameter customization in preferences panel (passphrase cacheing timeout, OpenPGP use, etc.)
- Use a tempest-attack resistant font for display
- [ADD YOUR REQUIREMENTS HERE]
The source code for GPGMail can be downloaded from Sen:te's FTP server, either in .dmg format or in GZIP compressed TAR files that can be decoded with the command gnutar xzf filename or using Scott Anguish's excellent OpenUp; don't use StuffIt, as some versions may fail to open correctly some .tgz archives. You need the Developer Tools to compile the sources.
Packages are PGP-signed: to verify them, download also the accompanying detached signature and verify the package integrity. You can use GPGDropThing to do this, or in the Terminal, type:
gpg --verify package.dmg.asc
My key ID is 0x992020D4, and my key fingerprint is A5BA B3D8 4F6C AE03 8B22 76F2 5467 B616 9920 20D4
- Download and install
gpg; binaries are available from MacGPG.
- Create a PGP key if necessary (see gnupg documentation)
- Launch the Installer, or
- Check that you have installed the BSD package when installing MacOS X. If you didn't, the
defaults command will not be available.
- Quit Mail
- Copy GPGMail.mailbundle into
$(HOME)/Library/Mail/Bundles/ (create directories if necessary)
- In the Terminal, type:
defaults write com.apple.mail EnableBundles YES
- Restart Mail
I wrote a little FAQ to help you solve most common problems related to GPGMail and gpg. Please, read it!
"PGP" and "Pretty Good Privacy" are registered trademarks of Network Associates, Inc.
"GnuPG" is Copyright 1998-2002 Free Software Foundation, Inc.
Thanks to Michel Poulain for the artwork (icons & web site images)
Thanks to all beta-testers and users
Thanks to translators: Sergio Rodríguez Concha (Spanish), Michel Poulain (French), Tomio Arisaka (Japanese), Hauke Müller (German), Thomas Dyhr (Danish), Sangduk Park (Korean), Daniel Aarno (Swedish), Filippo Stefanelli (Italian)
Special thanks to Tomio for numerous patches and Japanese support (http://www.max.hi-ho.ne.jp/tomio-a/GPGMail.html)
Software Library
More Mac OS X, WebObjects or OPENSTEP software to download from Sen:te
More Mail plug-ins developed by other people:
Welcome
Search
Information
Ask Sen:te
©Copyright 2000-2002, Stéphane Corthésy. All rights reserved.
|