Whisperfish - The unofficial SailfishOS Signal client

Whisperfish Whisperfish icon

Note: Registering with Whisperfish is broken. Linking Whisperfish as secondary device is also broken. Fixing this requires implementing a lot under the hood and will take some time. Sorry for the inconvenience!

Note: Groups properly work only in beta.19+

Note: Only beta.12+ works. Any older version can’t connect to the Signal servers at all!

Whisperfish is an advanced but unofficial Signal client. Whisperfish should be in a usable state for many users, but is still considered beta quality software ; make sure to always have the latest version! Also, check our Wiki and feel free to contribute to it! Currently, mimimum supported SailfishOS version is 3.4. We intend to keep compatibility with 3.3 for as long as humanly possible. The build for SailfishOS 3.x is located in a separate OpenRepos application.

Do not ever contact the Signal developers about a Whisperfish issue. You will annoy them and make them dislike us. Contact us instead (see below).

Talk about Signal, Whisperfish and Sailfish OS :video_camera:

Why Signal, what’s so interesting about it? Watch me explain what I like and love about Signal, explained in Lausanne, October 2022, FIXME hackerspace.

SailfishOS fan club group on Signal

Known issues :broken_heart:

Whisperfish is a project by volunteers. Lots of stuff works, lots of other stuff does not work. If you find something that does not work, file an issue or reply to this thread.

The list corresponds to the latest release (see release notes below).

  • Registering Whisperfish is currently broken.
  • Linking Whisperfish as secondary device is broken.
  • Previously installed emojis are not shown anymore
    • This occurs when updating from beta.9 (or older) to beta.10 (or newer)
    • Caused by version bump to Emoji 14/15
    • Fix: Remove the old emojis and re-install the new set(s)
  • Sending the first message to a contact gives a 404 Not Found error:
    Workaround:
    • Use Signal Desktop to send the first message.
    • Ask your contact via another way to send you the first message.
  • Creating groups, inviting new members, deleting members (planned for later)
    Workaround: use Signal Desktop.
  • Getting invited to a group. Ask to be added to the group instead.
    Workaround: use Signal Desktop.
  • Many other UI features are just stubs at this point.
  • Typing notifications have been temporary removed
  • Cover page unread count is not updated
  • Registration if registration lock is enabled.
    Workaround:
    • Wait 7 days, or;
    • Disable the registration lock on the old device in the Settings menu of the Signal app:
      • For Android, this seems to be: Settings → Privacy → Registration lock,
      • and for iOS this is seemingly: Account → Signal PIN → Registration lock.

SailfishOS platform version notes and known issues

The intention is to keep as many versions of SailfishOS supported for as long as possible. Some versions show bugs specific to that SailfishOS version. If it is not possible to upgrade to the version mentioned below, you can use the workarounds mentioned here.

Current highest tested SailfishOS version: SailfishOS 4.5.0.24

SailfishOS 3.x series

Bugs present in the Sailfish 3.x series

In principle, Whisperfish works on SailfishOS 3.3, except for registration. @direc85 keeps testing Whisperfish on Jolla Phone, which runs SailfishOS 3.4.

SailfishOS 4.x series

The Sailfish 4.x series introduced a few issues, and possibly new features; notably.

Contribute: get in touch, report issues and translate! :handshake:

If the app behaves strangely or slow (I have a strong dislike for slow software) to you, please get in touch on Matrix #whisperfish:rubdos.be or on Libera.Chat #whisperfish, file an issue, or email whisperfish [at] rubdos [dot] be, or post on this forum thread. If it works well already, also let me know! That’s good for morale.

Development and progress :nerd_face:

Follow the progress of the rework in the 0.6 milestone on Gitlab. If you are interested in contributing, contact me on Gitlab. If you want to discuss development, join the discussion on Matrix #whisperfish:rubdos.be.

There are nightly builds (in form of RPM) available on Gitlab. Nighlies eat batteries for breakfast, break up with your girlfriend, and use magic to turn phones into bricks. If you want to use them, please come and chat on Matrix or IRC. Whenever there is a version that makes sense, and has a low probability of tearing apart the very fabric of the universe, it’ll be here on Open Repos!

Donations :moneybag:

Thanks for the support, feel free to buy us a coffee! Liberapay allows for donations via PayPal or credit card. While we do appreciate the donations, please do match your donation towards Signal themselves. Also consider donating to Weblate, because they provide their translation hosting service to us and many other SailfishOS applications at no cost!

Licence note :open_book:

The original Whisperfish 0.5.0, by Andrew, was released under GPLv3+. Since we are using the upstream code of Signal themselves, partly licensed under AGPLv3+, the whole of Whisperfish 0.6.0 falls under AGPLv3+.

Release notes :chart_with_upwards_trend:

Whisperfish 0.6.0-beta.23 “FOSDEM release”

Sever cool new features! I tagged this during the Sailfish OS dinner on FOSDEM-Saturday :slight_smile:

(registration is still broken, but we’re working on the root cause!)

Changes

76 files changed, 4234 insertions(+), 1502 deletions(-)
  • Implement disappearing messages (a huge effort by @direc85 and myself)
  • Implement message style rendering (mentions, bold/italics/…)
  • Implement receiving message edits
  • Preparatory work for phonenumber privacy (PNP/PNI)
  • Delete message notifications on remote message deletion
  • Some other small clean ups that were long overdue

Previous releases

0.6.0-beta.22

Whisperfish 0.6.0-beta.22

Several cool fixes and features

Changes

92 files changed, 4695 insertions(+), 2561 deletions(-)
  • Fix a crash when downloading certain attachments
  • Update from Rust 1.52 to Rust 1.75 to allow for many many many new cool things!
  • Inline voice message player (highly overengineered!)
  • Show identified delivery status in debug mode for group messages on per-recipient basis
  • Fix a crash when messages are received on deleted group sessions
  • Performance improvements on loading sessions and receiving read receipts
  • Fix RUSTSEC-2020-0071 RUSTSEC-2021-0139 RUSTSEC-2021-0146 RUSTSEC-2021-0145 RUSTSEC-2021-0127 CVE-2023-42444 and CVE-2023-42447 (although unaffected by any of these)
  • Update Emoji s to version 15
  • Some initial work for receiving stories and distribution lists
  • Fix deleting messages with attachments
  • Decrypt attachments on a threadpool instead of on the executor (fixes lag/unresponsiveness on receiving attachments)
  • Update libsqlite/sqlcipher to 3.41/4.5.0
  • Rework logging subsystem for more concise and more useful logs

Currently, linking and registration is broken because Signal now mandates PNI/ACI support on clients. I will implement that next. There are several other cool new features upcoming too, stay tuned for a very soon update!

0.6.0-beta.21

Whisperfish 0.6.0-beta.21

Several small fixes

Changes

50 files changed, 1443 insertions(+), 611 deletions(-)
  • Embedded QR code scanner for device linking on Sailfish 4 and higher.
  • More relaxed parsing of SMS-based confirmation codes
  • Don’t close keyboard when using send or enter
  • Detect and handled deleted contacts in groups
  • Some fixes relating to attachment fetching, including a crash
  • Update blurhash decoding, should be a lot faster
  • More correct message for empty session view
  • Disable sending messages in UI for unregistered contacts
  • Fix marking of unregistered contacts
  • Hide archived conversations in cover page
  • Add cargo-deny to catch CVE’s in the future
  • Add setting to hide recipient phone number in conversation page
  • Fix relating to profile fetching
  • Correctly handle nullable E164’s and other nullable fields
  • Update libsqlite/sqlcipher to 3.41/4.5.0
  • Rework logging subsystem for more concise and more useful logs

Currently, linking and registration is broken because Signal now mandates PNI/ACI support on clients. I will implement that next. There are several other cool new features upcoming too, stay tuned for a very soon update!

Important note to Sailfish 3 users :warning:

The builds for Sailfish 3 and Sailfish 4 are now the same package again. This was required because the pending update to Rust 1.61 (maybe even 1.64 and 1,72 :pray:).
You may need to tinker with the OpenRepos app in order to update. Worst case, you can uninstall the sf3 build manually, and install the unified application. You can check whether the update worked by opening Whisperfish and opening the about menu: it should show beta 21 or newer.

0.6.0-beta.20

Whisperfish 0.6.0-beta.20

Post-quantum end-to-end encryption, registration fix, and much more.

Changes

69 files changed, 2465 insertions(+), 1179 deletions(-)
  • Post-quantum (Kyber) key-exchange
  • Fix build version number in CI/About page (maybe, I hope)
  • Fix the info row lock size in developer mode
  • Fix muting conversations
  • Fix disappearing messages timer resets
  • Store attachment pointers in database, preparation work for attachment download retries.
  • New, more fine grained notification privacy options
  • Show blur hash while attachments are downloaded
  • Emoji-react to messages (hold message, swipe away, then tap the emoji)
  • Fix logs on panic
  • Implement a captcha test page
  • Handle remote message deletions, implement remote message deletion
  • Show original attachment file name, if available
  • Implement attachment exporting
  • Fix unidentified sending mode resets on profile key reception
  • Fix registration and linking for new registration protocol

Registration

Signal overhauled their registration procedure. In my eyes, the new API flow has been redesigned to allow for registrations without phone number in the future. Signal has, meanwhile, introduced usernames , which will allow you to hide your phone number from contacts and groups. I hope to get this into Whisperfish soon™ too.

Post-quantum key exchange

Signal recently introduced post-quantum key exchanges for their end-to-end encryption protocol. This is, as far as I know, the first broad and permanent real-world deployment of post-quantum cryptography, and follows the very recent NIST standardization of Kyber. Signal is yet to announce this change officially, but it has been in production for two weeks. I expect Signal to roll out a rekey event for all sessions, and at that time announce the roll-out.

The deployment is a hybrid of X25519 and Kyber. This means that if the new Kyber system is horribly broken next week, your sessions will still be secure in the classical sense.

Practically speaking, the current change means that every new session with a contact will be protected against capture-now-decrypt-later attacks by (currently non-existing) cryptographically-relevant quantum computers, under the condition that Kyber remains as secure as it is thought to be.

I expect Signal to trigger session renewals or rekeying events to additionally protect existing sessions from the “quantum threat”.

0.6.0-beta.18/19

Whisperfish 0.6.0-beta.18/19

This release fixes group updating (adding members, changing admins etc.) since Signal changed their API calls. First steps toward PNI support.

Changes

119 files changed, 3454 insertions(+), 1918 deletions(-)
0.6.0-beta.17

Whisperfish 0.6.0-beta.17

With this release, sealed/unidentified sending is now implemented and in active use. This increases privacy, and should render “Signal needs you to complete a captcha so you can continue sending messages” a thing of the past.

Changes

62 files changed, 3373 insertions(+), 1411 deletions(-)
0.6.0-beta.16

Whisperfish 0.6.0-beta.16

Fix an issue during registration, and some QoL improvements. If you want to register after a failed attempt, don’t forget to reset your installation

Changes

26 files changed, 821 insertions(+), 270 deletions(-)
0.6.0-beta.15

Whisperfish 0.6.0-beta.15

Overhauls the QML binding system. This should fix all UI inconsistencies, except for a few that are now introduced.

Changes

108 files changed, 5191 insertions(+), 4061 deletions(-)
0.6.0-beta.14

Whisperfish 0.6.0-beta.14

Bugfix release for most of the bugs we introduced in beta.13, and some fixes for changes upstream.

Changes

15 files changed, 577 insertions(+), 127 deletions(-)
  • Attempt to handle HTTP 428 by responding with a reCAPTCHA challenge
  • Handle device mismatches (fixes sending to contacts that change their linking setup)
  • Attempt at fixing a crash at startup related to profile uploading
  • Fix a crash when opening an empty session
  • emoji.js now supports out-of-date emoji packages as fallback
  • Fix typing notification display of names in certain conditions
  • Marking as read fix for mismatched sessions
  • Cleaner formatting for linked device display
0.6.0-beta.13

Whisperfish 0.6.0-beta.13

Profile fetching and updating, avatar displaying, sender key and unidentified sender support at receiver side, and much more.

Changes

153 files changed, 4549 insertions(+), 2363 deletions(-)
  • Disable defunct “send new message” functionality
  • Don’t crash when Signal desktop sends a SyncMessage about a story.
  • Use move_rows instead of reinserting upon new message reception
  • Big refactoring work by Lucien XU
  • Send messages via the Websocket instead of the PushService
  • Display avatars
  • Display Signal profile names, with preference for local contact names in settings
  • Implement regular profile updating
  • Implement displaying and sending quotes
  • Use Emoji font for displaying reactions when configured as such
  • Move (signed) prekeys, identities, sessions into database
  • Implement sender keys and unidentified sending at the receiver side for much improved privacy
  • Many, many, other tiny and big things.
0.6.0-beta.12

Whisperfish 0.6.0-beta.12

Hotfix release for the new Signal root certificate

Changes

72 files changed, 439 insertions(+), 361 deletions(-)
  • Update root CA certificate for Signal production server (4096 bits RSA instead of 2048!)
  • Multiple fixes for SailfishOS 3.4
  • Fix storage migration corner case
  • Fix some registration issues
  • Fix cover scrolling behaviour
  • Big update of libsignal-protocol version
  • Misc layout and input field improvements
  • Refactored some storage and Sailfish platform code
0.6.0-beta.11

Whisperfish 0.6.0-beta.11

Mostly bugfixes for bugs that we introduced in beta.10, but also implements Whisperfish as secondary device. This release is basically completely due to direc85 and Gabriel Margiani; thank you both!

Changes

37 files changed, 1212 insertions(+), 292 deletions(-)
0.6.0-beta.10

Whisperfish beta.10 :tada:

This is a huge release, thanks to the hackathon we did a month ago with @direc85 (see picture at Whisperfish - The unofficial SailfishOS Signal client - #595 by rubdos).

There’s a ton of useful changes for the users, and there’s also a lot of technical debt fixed that will make the next releases even more awesome. Diffstat since beta.9: 127 files changed, 11795 insertions(+), 5464 deletions(-) (and that’s huge) (translations included)

Changes

106 files changed, 4759 insertions(+), 2962 deletions(-)

Highlights:

  • Registration should work again! Thanks @direc85 and Gabriel Margiani !
  • Cover page is awesome!
  • Typing notifications are cute!
  • Display multiple attachments!
  • Resending failed messages!

This is quite a milestone. The next big milestone will be porting Rust 1.61 to SailfishOS, because that will allow us to further push the dependencies and implement all the new GroupV2 and sealed sending features more easily.

0.6.0-beta.1 ... beta.9

beta.9: 44 files changed, 986 insertions(+), 544 deletions(-)
beta.8: 49 files changed, 1582 insertions(+), 878 deletions(-)
beta.7: 43 files changed, 2640 insertions(+), 2331 deletions(-)
beta.6: 38 files changed, 877 insertions(+), 839 deletions(-)
beta.5: 3 files changed, 25 insertions(+), 8 deletions(-)
beta.4: 12 files changed, 1063 insertions(+), 529 deletions(-)
beta.3: 3 files changed, 79 insertions(+), 84 deletions(-)
beta.2: 59 files changed, 2038 insertions(+), 583 deletions(-)
beta.1: 192 files changed, 18088 insertions(+), 10474 deletions(-) (since alpha.3)

Whisperfish 0.6-alpha.3

Hello, world!

Today I’m feeling healthy and confident enough to start a thread about Whisperfish, the Signal client originally built by Andrew E. Bruno in 2016 (thank you so much, Andrew). In February 2019, aebruno announced the EOL of his Whisperfish. I have then, four months later, volunteered to take the lead and rewrite the whole thing against libsignal-protocol-c, the official and upstream ratchet/axolotl/e2ee library.

It’s taken me a long time, and during the time I switched to Rust, which turned out to be a radical choice back then, but has since paid of: Signal themselves started switching the protocol library to Rust, and SailfishOS introduced preliminary Rust support in 3.4. I had to DIY my Rust SDK (and haven’t migrated yet).

What followed was a painful rewrite of many things, but it is now starting to pay off. I’d like to thank Markus Törnqvist and Gabriel Féron for their efforts in respectively the Sailfish part and the back end part. I have (re)written the bulk of the application, including a very experimental (but very much working) async/await-enabled Qt interface, which I want to get cleaned up by Whisperfish 1.0.0.

The result of our efforts is, currently, Whisperfish 0.6-alpha.3. While I am confident many more people can use the “new” Whisperfish, be aware that this is an alpha release. This means that things will fail and you might lose data. That being said: I have many reports of people losing data with Whisperfish 0.5, data that is not lost on my rewrite. This is due to the new cryptographic library, and many updated API calls. If you install this software (thanks!) please leave feedback, both positive and negative in this thread.

Implemented features (in alpha.3):

  • Sending and receiving messages
  • Receiving attachments

Notably not implemented (in alpha.3):

  • Registration
  • Sending attachments
  • Starting conversations with new people
  • Altering groups

The above means, that if you can wait with sending pictures (my priority number one) and if you have a working Whisperfish 0.5 installation, you can probably start using the Whisperfish 0.6-alpha’s. Be prepared to send me feedback, either through the forum, Matrix or IRC (freenode#whisperfish). Bug reports and feature requests are more than welcome on the Gitlab issue tracker

Downloads

Before downloading any of this, please read the above paragraph.

Master branch builds (“nightlies”)

All RPMs are published on the Gitlab package archive.

Version history

Published versions can be found on my OpenRepos account.

52 Likes

Do I understand correctly, that if I don’t have Whisperfish 0.5 I can’t install 0.6?

That is correct for now, indeed. I want the adoption to go slowly, to catch some bugs early on, and not to overwhelm the Signal servers just yet. alpha.4 will have registration, as well as sending attachments.

Thanks for all of your efforts with this @rubdos. It’s great to see Whisperfish being kept alive… and driven forwards. I’m looking forward to trying it out.

4 Likes

I thank you, and will happily donate $ to this cause! The old Whisperfish stopped accepting attachments, so I had to go back to the Android app. Which I hate, and which loses the data connection every time I get an MMS. So I’d love to go back to Whisperfish when it is ready.

1 Like

Thanks, @flypig and @sethdove for the kind words!

If you’re really keen on donating, I have a Liberapay account at https://liberapay.com/rubdos/. I’ve stopped to refuse donations, although I have to tell you: I am full time employed (at the Vrije Universiteit Brussel as researcher in applied cryptography), and money sadly doesn’t buy me time. It does buy me coffee and beer though, which is of course appreciated :slight_smile:

10 Likes

Update! I’ve pushed Whisperfish 0.6.0-alpha.4. I do not have the rights (yet?) to edit my topic start, to update the overview, or is that not-done here?

Either way: I am quite confident that at this point, Whisperfish is usable for a lot of users! :partying_face:

Implemented features:

  • Registration
  • Sending attachments

Notably not implemented:

  • GroupV2
  • UUID-only devices
  • Creating new conversations (contact selection)
  • Group management (creating and modifying groups)
  • Linking devices (i.e., Signal Desktop)

Known issues

  • New 3.4 installs (the ones with defaultuser) will panic on displaying messages. (fixed on master)
  • Entering a phone number for new messages doesn’t accept leading +, but you can just leave it out! (fixed on master)
12 Likes

Woohoo, wonderful thanks to you and your team! :champagne: :love_you_gesture: :notes:

Sooo that would mean Whisperfish is ready for new users, who didn’t have 0.5 installed?

It absolutely is. Please do check whether you created any Signal groups after the October update (or Signal Beta, if that’s your thing). If you have, please wait until we implement groupsv2!

If you have an old (defunct) 0.5 installation, or if you tried to register with 0.5 before, you may want to remove .local/share/harbour-whisperfish (recursively) and .config/harbour-whisperfish/*. I have not implemented anything as a “re-register” functionality yet!

4 Likes

Hej Rubdos

first, thanks a lot for your work… this kind of things are neccesary for sailfish.

when trying to do a new message the app doesnt recognize any contact and if I try to write them manually the + bottom doesnt work , so I cant introduce any number. I am using it in a sony xa2

2 Likes

Same for me on XA2 Ultra.

Also thanks for amazing work!

1 Like

Contact selection is indeed unimplemented, but manually entering a phone number should work. The regex is a bit flakey there (I’ll note that for beta.1, thanks for the report!), but it should work if you just leave the + out! +32474123456 becomes 32474123456.

EDIT: the patch that accepts the + is on the master branch. Should be fixed in next release (and contact selection is on the road map)

2 Likes

it doesnt work yet. if no symbol, no recognice number

Just had a look at it: try using the 00 prefix instead of +, that seems to work here. +32474123456 -> 0032474123456. I’ll take note to make that clearer in the UI!

EDIT; doesn’t look like I can actually send a message to a new number though. That’s planned for the next release! :slight_smile:
Receiving messages from a new number does work, so you can always ask to have them send you something on Signal, via another medium.

2 Likes

Doing some testing. Aside from the observations already noted (no contact selection, sending messages to new numbers doesn’t work), it seems I can’t get Whisperfish to work over my LTE data connection. The card icon stays orange after entering my password, and messages don’t go through. When I close Whisperfish, enable WiFi and reenter my password, the icon goes green and messages are sent normally (verified with double check mark and another device). I have verified internet connectivity, and have rebooted/toggled airplane mode on and off.

I’m not sure what’s going on here. Device is an Xperia XA2 Ultra, on T-Mobile LTE (US). Data works, confirmed with speedtest and other apps. Let me know if I can be of further assistance.

That’s peculiar indeed! I don’t immediately see what could cause that. Could you provide me with a (partial) trace log? Switch to LTE, then open Whisperfish on the terminal: RUST_LOG=trace harbour-whisperfish, and enter password as per usual. The terminal will be extremely chatty.

Important: currently the logs are not sanitized: they print phone numbers and secrets. You might want to cherry-pick some lines that you judge may be interesting. I expect to see ERROR and WARN lines that should jump out, those will quickly give me or Gabriel a clue.

Let me know if I can help obtaining the log (and feel free to come have a chat on Matrix/IRC).

After some debugging (thank you for the tip on the trace log), I discovered that T-Mobile (US) suddenly changed behavior on the fast.t-mobile.com APN. I reverted to the old epc.t-mobile.com APN and everything works as expected. Changing the APN back makes the “couldn’t create websocket” error return, so I’m now certain it is the culprit… nothing to do with Whisperfish. Apologies!

4 Likes

Slightly off-topic:
Isn’t Signal very much against third-party/unofficial clients? Do Whisperfish developers have any official agreement with them?

They seemed very much against it a few years ago, but our feeling is that they don’t mind it much any more. We haven’t heard from they yet, and they never really seemed terribly unhappy with Whisperfish 0.5 either as far as I know.

I’m quite sure they changed their minds, or at least tolerate us now!

If I remember correctly, Signal faced severe backlash over their stance on third-party clients. They reversed position pretty rapidly.

2 Likes