Librem5: ProtonMail app

[SteveR]

I run Ubuntu and am a long-time paid Protonmail user and am happy with Protonmail as a service. But I hate the Protonmail bridge and don’t plan to install it again. The bridge often breaks and I don’t like having to always reconnect it.

But there is one problem with the bridge that is worse than that. Somehow, a certificate or authentication key expired and there was nothing I could do to fix that. At least from Seahorse, I should have been able to fix that Problem. Every time, the authentication failed, the message said that the errors involved the Protonmail bridge. Replacing the keys and certificates didn’t help. The Protonmail bridge authentication failure issue prevented any updates or installation of any other programs and is relentless about reminding you often about the failure. I had to disable all Security key and certificate requirements to get control of my PC back. I am running Ubuntu 20.04 and want to wipe and reload the OS anyway. But I don’t plan to install the protonmail bridge again. The web interface should run on the Librem 5.

[Loki]

I don’t have an account for the wiki and I’m not really interested in getting that involved.

This would be for building on PureOS byzantium, arm64. I have not been paying much attention to development of PureOS, from what I can see at the moment, the version of Go available from within crimson is also lesser than required so the steps outlined below for downloading and installing Go would still apply to crimson. The basic steps are…

1. Install the basic build utilities
2. Install the required dependencies (libraries and header files)
3. Download and install suitable version of Go
4. Download the proton-bridge source files
5. Compile
6. Install

Install the basic build utilities…

sudo apt-get update
sudo apt-get install build-essential git

Install the required dependencies (libraries and header files)…

sudo apt-get install libglvnd-dev libsecret-1-dev

Download suitable version of Go (see: All releases - The Go Programming Language current stable version is 1.25.1)…

cd ~/Downloads
wget https://go.dev/dl/go1.25.1.linux-arm64.tar.gz

Install Go (see: https://go.dev/doc/install), I assume no previous version of Go installed…

sudo tar -C /usr/local -xzf go1.25.1.linux-arm64.tar.gz
export PATH=${PATH}:/usr/local/go/bin

Download the proton-bridge source files…

git clone https://github.com/ProtonMail/proton-bridge.git

Compile…

cd proton-bridge
make build-nogui

Install executables (make produces two binary executable (proton-bridge and bridge)…

sudo install -m 755 bridge /usr/local/bin
sudo install -m 755 proton-bridge /usr/local/bin

Run the proton-bridge executable in interactive mode to setup…

proton-bridge --cli

Notes:

1. Depending on the speed of your net connection, the make process may appear to “hang” while grabbing the uniseg package, it hasn’t, wait it out

2. If it’s a “one off” build you may wish to clean and remove source files and also the Go installation, the Go installation is self contained and can be removed with...

sudo rm -rf /usr/local/go

3. If you are keeping Go installed then consider permanently adding it’s path to your PATH environment variable.

[Loki]

I’ve certainly heard some chatter regarding proton-bridge and it’s interaction with the keychain, although, it’s more about how noisy it can be with the frequency in which it hits the key chain rather than any authentication or connectivity problems.

General consensus among those I know who use proton-bridge is to use pass rather than the main system keychain, and to setup a dedicated user solely for proton-bridge and give that user it’s own gpg key and pass instance. While still less than great, it’s far less obtrusive than having it use the main system keychain or your own pass store.

[veleno]

Thank you so much!!

I followed your step by step guide with success but when I try to add email account on geary I receive “Account not created: Check your email address and password” although I tried 5-6 times and I’m sure email and password are correct!

Please any idea? Maybe I’d do something before create the new email account on geary?

Thank you

PS: after investigation I found it (please see screenshot), maybe it doesn’t work with free email account? I opened it few days ago so I’m trying the free plan before to buy a subscription! Maybe bridge is forbidden for free plan?

[Loki]

A paid plan with Proton Mail is required in order to make use of the proton-bridge application. I don’t think that is mentioned on the github project page but it is stated on the Proton Mail Bridge product page, of their website, and I’m sure it’s also been mentioned previously in this thread

The paid plans do include a “30-day money-back guarantee” so you could, if happy with the free plan, then upgrade to check out additional features of a paid plan and if it doesn’t meet your needs or expectations, cancel within the 30 day period (I would however, carefully read the terms and conditions to ensure that you’ll meet the 30-day money-back guarantee criteria before upgrading).

[kms]

thanks @Loki, this was definitely helpful.

I am curious for those who were saying the web app was an option? It was for me, for years, but starting this spring, I began experiencing incredible latency in using the web app. I’m curious if others have similar performance? It could take me over 30 seconds to open an email?! I contacted Proton about it, and they looked into it a bit, but basically they are saying I should get a new device that has better performance. I said this problem also was happening with my raspberrypi 4. And shouldn’t they want to have their web app viable on raspberry’s. But Proton, seems to just want to focus on the big player devices?! Disheartening.

Having the bridge operational an arm64 device is hopeful though. @Loki, your instructions worked perfectly for me, so thank you.

One comment for others, the Proton instructions weren’t clear how to setup your email client. So, for Geary, make sure the security protocol is StartTLS not TLS. And set the IMAP server to 127.0.0.1.

Another thing people should keep in mind is disk space. Bridge will sync emails to your local device, which can use up a lot of disk space. My proton account has a lot of mail, so it just about used up the remaining disk space on my L5. Which raises the on-going challenge that 32gb is just too small for the L5. So, while I got the bridge working, I’m not sure if it will be viable for me. unless I can find a way to link the protonmail folder to my microsd card. If I try that, I will try let everyone know how it goes.

[veleno]

@kms

I am curious for those who were saying the web app was an option? It was for me, for years, but starting this spring, I began experiencing incredible latency in using the web app. I’m curious if others have similar performance? It could take me over 30 seconds to open an email?! I contacted Proton about it, and they looked into it a bit, but basically they are saying I should get a new device that has better performance. I said this problem also was happening with my raspberrypi 4. And shouldn’t they want to have their web app viable on raspberry’s. But Proton, seems to just want to focus on the big player devices?! Disheartening.

AI suggested me it:

Got it ! Here’s the full translation of my detailed explanation about **Tutanota’s WebApp**, in clear and simple English: — ## What is the Tutanota WebApp? The **WebApp is the heart of Tutanota**. Unlike ProtonMail (which has a hybrid system with Bridge, special backends, etc.), Tutanota decided: *“We build one single app, in HTML+JavaScript, that works everywhere.”* Which means: - in a **browser** (any, even on the Librem 5), - on **Android/iOS**, - on **desktop apps (Linux, Windows, macOS)**, …it’s actually always the same **WebApp** code, wrapped in different containers. — ## How it works in practice 1. You open [https://mail.tutanota.com](https://mail.tutanota.com). 2. You log in with **username + password**. - The password doesn’t just “unlock” your account: it **derives your personal encryption key**. 3. All your emails are stored **encrypted on Tutanota’s servers**. 4. When you log in, the **decryption happens inside the WebApp, in your browser** → so: - the server remains **blind** (it only sees encrypted data), - messages are readable only on your device. — ## Encryption model - Tutanota does **not** use standard PGP exactly as Proton does. - They built their **own open‑source encryption system**. - Why? Because they wanted: - to encrypt not just the body, but also **subject lines, sender/recipient fields, attachments**, - an ecosystem fully integrated with their clients → no need for Bridge software. - All of this is handled inside the WebApp. You just write/send; encryption and decryption are transparent. — ## Why the WebApp is lighter - **Minimalist interface:** no flashy, heavy widgets or animations. - **Mobile‑first design:** the UI was created to work on small screens → responsive layout, touch‑friendly buttons. - **One codebase everywhere:** less overhead, lighter app. So, compared to Proton’s web app, Tutanota feels **snappier on modest ARM hardware** like a Librem 5 or Raspberry Pi. — ## Differences vs ProtonMail WebApp | Aspect | Proton WebApp | Tutanota WebApp | |-------------------------|---------------------------------|-----------------------------| | **Encryption** | OpenPGP integrated | Custom E2EE crypto (open source) | | **IMAP support** | None (needs Bridge) | None (only official clients/web) | | **Performance** | Heavy on small ARM devices | Much lighter | | **Extra features** | Advanced filters, aliases, calendar | Simpler calendar, fewer advanced features | | **Mobile experience** | Works great on iOS/Android apps, but heavy as web | WebApp is the **same** app used on mobile → light/touch‑friendly | — ## How it becomes an “App” on the Librem 5 On Librem 5 you can open Tutanota in **GNOME Web (Epiphany)** and save it as a WebApp: - Go to `https://mail.tutanota.com` - Menu → *Install as WebApp* - You get a Tutanota icon in the Phosh launcher. - When you tap it, it opens full screen with no browser bar, just like a native app. - Internally, it’s still the WebApp, but it feels exactly like a mobile app. — ## Advantages for Librem 5 users 1. **No Bridge** needed. 2. **No huge local storage** use: emails stay on the server. 3. **Works fine on ARM** because it’s browser‑based. 4. **Mobile‑friendly UI** out of the box. 5. **100% open source** (WebApp code is on [GitHub]( GitHub - tutao/tutanota: Tuta is an email service with a strong focus on security and privacy that lets you encrypt emails, contacts and calendar entries on all your devices. )). — ## Current limitations - No IMAP: can’t integrate with Thunderbird/Geary. - Fewer advanced features than Proton. - No real *offline mode* (you need to be online to read messages). — ## In a nutshell - **The Tutanota WebApp *is* the app.** - It lives in the browser, but behaves like a real standalone app on Librem 5. - Encryption/decryption happens inside your browser → servers can’t read your mail. - Compared to Proton: **less feature‑rich but more lightweight** and responsive. - Perfect for Librem 5 users: simple, open source, touch‑friendly, and doesn’t gobble up local storage. — Would you like me to now write a **step‑by‑step “recipe” in English** for turning Tutanota into a WebApp on Librem 5 (with its own launcher icon, fullscreen), so you can use it exactly like a native app?

It seems interesting although no VPN but you can add it using riseupVPN (FLOSS philosophy) by donations

[Loki]

It’s good to see that others are able to build the bridge utility without issues.

Some email clients provide an option for specifying the location or your mail director(ies|y) if Geary provides such an option then storing your Proton mail on a microSD card should be straightforward. Similarly, linking the mail directory on disk to a directory on microSD should be achievable without much issue I would think.

Some mail clients give you the option of initially downloading mail headers only and only downloading the full message when specifically view the message, this is helpful for conserving space but more of a hindrance if you need to do deep search within your mails.

Due to the limited capacity, it’s probably best to remove all the build tools and utilities that you installed for the build. As well as removing go which I mentioned previously, you could also purge the build-essential and git packages, also note that during the make some additional packages were downloaded, these were probably cached by go so you’ll probably have a directory at ~/go which can be removed.

I never went so deep as to check if the development libraries were statically or dynamically linked at compile time, and I don’t have access to the phone right now to check, but you might be able to remove those also.

Another potential space saving is that apt caches a copy of downloaded/installed packages, you might find some space can be reclaimed by clearing the caches found at /var/cache/apt/archives