Web-GPGME Demo

A demonstration web application showing how to integrate GPG signing functionality into a web page using gpgme-json, similar to Mailvelope's approach.

Overview

This demo shows:

• How to list available GPG keys
• How to sign messages using selected keys
• How to verify PGP signatures
• A clean web interface for GPG operations

Current Implementation

This demo uses a backend proxy server to communicate with your local gpgme-json installation. The architecture:

1. Web Frontend: JavaScript client that makes API calls
2. Bun Server: Acts as a proxy between the web page and gpgme-json
3. gpgme-json: Native application that interfaces with your local GPG installation

This approach avoids the need for browser extensions while still providing access to your real GPG keys.

Installation & Running

# Install dependencies
bun install

# Start the development server
bun run dev

# Open http://localhost:3000 in your browser

Project Structure

web-gpgme/
├── public/
│   ├── index.html          # Main demo page
│   └── js/
│       ├── gpgme-client.js # GPGME-JSON client wrapper
│       └── app.js          # Application logic
├── src/
│   └── server.ts           # Bun web server
└── package.json

How It Works

1. gpgme-client.js: Provides a JavaScript interface to communicate with gpgme-json
2. app.js: Implements the UI logic - listing keys, handling user input, and displaying results
3. index.html: Simple, clean interface for signing messages

Requirements

• gpgme-json: Must be installed on your system (usually comes with GPGME)
• GPG: With at least one secret key configured
• Bun: JavaScript runtime (already included in the Nix flake)

API Endpoints

The server provides the following API endpoints:

• GET /api/version - Get GPGME version information
• GET /api/keys?secret_only=true - List available GPG keys
• POST /api/sign - Sign a message with a specific key
• POST /api/encrypt - Encrypt a message
• POST /api/decrypt - Decrypt a message
• POST /api/verify - Verify a signature

Security Considerations

• Never expose private keys in the browser
• All cryptographic operations should happen in gpgme-json
• Validate all input before passing to GPG
• Use HTTPS in production
• Consider implementing passphrase caching policies

References

• GPGME Documentation
• Mailvelope Source
• Native Messaging API