Thelemail
Sign in Create free mailbox

Download Thelemail

Choose the app for your device.

iPhone & iPad

Get Thelemail on your iPhone or iPad.

Download for iOS from the App Store

Android

Get Thelemail on your Android device.

Download for Android from Google Play

Use Thelemail in your browser.

Open web app

Verify your download

Compare the SHA-256 checksum before installing.

Filename Thelemail_0.22.1_aarch64.dmg
SHA-256 9e759b15ae41ea0046f33daa75ae59f3b7ecbf8571a34a6b921e8f9fb089a973
Verify with shasum -a 256 'Thelemail_0.22.1_aarch64.dmg'

SHA256SUMS Signature bundle Build provenance Source SBOM
Signature verification

A matching checksum confirms file integrity. Verify the signature and build provenance to check its origin.

Run this command in the folder containing the downloaded installer. Compare the result with the checksum above. Do not install if they differ.

Verify publisher

macOS checks the Developer ID signature and notarization. Do not bypass a rejected check.

macOS spctl --assess --type open --context context:primary-signature -v "Thelemail_0.22.1_aarch64.dmg"

Verify the checksum manifest signature

Download SHA256SUMS and its signature bundle from the same release, then verify the bundle with cosign.

cosign cosign verify-blob --bundle SHA256SUMS.sigstore.json --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity 'https://github.com/thelemail/desktop-client/.github/workflows/release.yml@refs/tags/v0.22.1' SHA256SUMS

Build provenance

Use the GitHub CLI to verify the installer’s build provenance against thelemail/desktop-client.

GitHub CLI gh attestation verify 'Thelemail_0.22.1_aarch64.dmg' --repo thelemail/desktop-client --signer-workflow thelemail/desktop-client/.github/workflows/release.yml --source-ref refs/tags/v0.22.1

The signature and provenance commands require cosign and GitHub CLI. cosign · GitHub CLI