An unofficial Signal client for Sailfish OS
Whisperfish is an unofficial, third-party native Signal client for Sailfish OS. You can install it from OpenRepos or from the package registry.
Registering Whisperfish as a primary device can fail for various reasons, but errors (e.g. registration lock) are ill-reported. Linking as a secondary device works as a workaround.
References: whisperfish#746 , whisperfish!801
After the dme-sender release (v0.6.0-beta.44), reception from contacts who have a stale, mismatched identity stored locally (e.g. they re-registered or changed devices) wedges: group messages still arrive but stop decrypting, and until a 1:1 exchange surfaces the stale identity, neither group traffic nor DME retry receipts can reach that contact. Further testing revealed the identity-reset path left stale sessions for the contact's other devices in place, wedging reception again for every device except the one that triggered the reset. Update to v0.6.0-beta.45 or later; after upgrading, reception self-heals as senders re-share their sender keys.
The dme-sender release added a retry receipt (DecryptionErrorMessage / DME) so a group message failing to decrypt with NoSenderKeyState self-heals: the receiver asks the sender to re-share its sender key. That DME is delivered over the 1:1 encrypted channel, whose session establishment gates on is_trusted_identity. When the contact has a stored, mismatched identity locally, the DME send failed with UntrustedIdentity and was logged-and-dropped. Fix on MR !822: run the same identity recovery as the receive side (recover_untrusted_identity) on UntrustedIdentity failures from both the DME send and the receive path, then retry once, and don't let the recovered-identity failure poison the per-(recipient,device,distribution_id) rate-limit slot. Follow-up findings while testing on device: the UntrustedIdentity error hides in four different error-nestings depending on the code path (ServiceError, SealedSenderDecryptionError.inner, MessageSenderError::ProtocolError, MessageSenderError::ServiceError) — all must be matched or recovery silently never runs; and recover_untrusted_identity originally deleted only the identity key, leaving sessions of the contact's other devices established under the old identity, which re-wedged reception device-by-device. The revived identity reset now also archives all sessions of the contact, mirroring Signal-Android's identity-replace flow (archiveSiblingSessions + sender-key share invalidation, plus the safety-number-change notice).
Fixed in v0.6.0-beta.45 (commit f94b552e).
References: whisperfish!822
Until v0.6.0-beta.44, a contact who merely knows your phone number could send a forged synchronize message that Whisperfish processed as if it came from one of your own devices. Such a message could mark conversations as read, insert messages into existing conversations, change your block list, or on a primary device replace your locally stored account key material (used for storage service and SVR). Update to v0.6.0-beta.45 or later; see advisory GHSA-wjhx-4prr-c426.
A libsignal-service-rs dependency-bump refactor (4b2e602a, pulled in by Whisperfish f15c8c25 and released in v0.6.0-beta.40) weakened the sync-message sender check in ServiceCipher::open_envelope to only run when the receiving cipher's local identity is the ACI. Messages addressed to the PNI — which anyone who knows your phone number can send, by design of PNI messaging — were decrypted by the PNI cipher without any sender check, so a stranger's SyncMessage reached the app layer, which treats sync content as trusted self-data (read state, sent transcripts, block lists, account entropy pool). The fix (fb92b13c8) restores the check on every receive path: sync messages whose sender is not our own ACI are dropped, and — matching upstream clients, which never route sync messages to a PNI — every sync message on the PNI path is dropped. The same bump also avoids a panic in sealed-sender processing when a sender certificate names a PNI (874797d45; not reachable with certificates the Signal server issues). Reported via libsignal-service-rs#474, published as GHSA-wjhx-4prr-c426.
Fixed in v0.6.0-beta.45 (commit 056852d8).
References: libsignal-service-rs!474 , libsignal-service-rs@fb92b13c8 , libsignal-service-rs@874797d45 , whisperfish@056852d8