agoalofalife / password-frog

Desktop application based on Electron.js for keep passwords on own computer
0 stars 0 forks source link

Find solution to use gpg through application #1

Open RGamz opened 1 day ago

RGamz commented 1 day ago

At the moment we don't have any information - how use gpg utility through application. I am used to use it in console and obviously we must do it in node js. Fast research lead me to this package https://www.npmjs.com/package/gpg I suppose there are a few options how to resolve it. The first one is install gpg in background in appeal to it through shell call. By the way, the process of installation might be more complicated because of OS(operation system). The second one, find preset gpg in node js package or some way to use this utility without installation. The main task to ensure that we can use gpg in our application and have work way.

RGamz commented 1 day ago

@agoalofalife

GPG is licensed under GPLv3, which is a copyleft license requiring that derivative works are also distributed under GPLv3.

Obligations: Source Code Availability: You must make your application's source code available under GPLv3. License Notices: Include the GPLv3 license text with your application and inform users of their rights.

Conclusion on Licensing:

If you are comfortable releasing your app under GPLv3, then bundling GPG binaries is acceptable. If you prefer to keep your app proprietary or under a different license, bundling GPG binaries may not be feasible due to the licensing restrictions.

RGamz commented 1 day ago

@agoalofalife the module requires the GPG binary to be installed on the user's system and accessible via the $PATH environment variable. This contradicts the requirement of not forcing users to install GPG by themselves or separately.

Also Installation methods for GPG differ across operating systems, potentially complicating the user experience.

To avoid requiring users to install GPG themselves, we can bundle the GPG binaries with the Electron app and configure node-gpg to use these binaries. This will mean that we will need to manage and update GPG binaries for multiple platforms.

RGamz commented 1 day ago

@agoalofalife there is an alternative solution : https://openpgpjs.org/

Ease of Integration: Pure JavaScript library that integrates smoothly with Electron. Licensing Flexibility: LGPL-3.0 license allows inclusion in proprietary software under certain conditions. Simplified Deployment: No external binaries or dependencies to manage. Consistent User Experience: Uniform functionality across all supported platforms.

So please decide and give your opinion on which way to go. Thanks

agoalofalife commented 14 hours ago

Let's consider other alternatives as js library for encrypt and decrypt information