GUI Reference (rustpg)

rustpg is the graphical binary. It shares the same keyring, config file, and crypto library (rpglib) as the CLI — keys generated or imported in one are immediately available in the other.

Built with egui / eframe. Window title: Rust PrivacyGuard. Default size: 900 ×ばつ 600 px.

Startup

On launch, rustpg resolves the master password and opens the keyring:

1. Load master_password and symmetric_password from the OS keyring.
2. If key_material.rpg exists:
   • If the password was cached and decryption succeeds → open silently.
   • Otherwise → show Open keyring dialog (dark red, password pre-filled from OS keyring).
3. If no .rpg file exists:
   • Seed two demo identities (Alice, Bob) into memory, or load the legacy key_material.txt if present.
   • Show Protect your keyring dialog to set a master password.
4. After the dialog resolves → apply_km_to_session() sets the active identity.
5. If a file was passed as a CLI argument → load it now (deferred until the keyring dialog is gone).

Layout

┌─────────────────────────────────────────────────────┐
│ File Operations Keys Format View Help │ ← Menu bar
├─────────────────────────────────────────────────────┤
│ View: [Plain text] [Hex dump] │ Identity │ Filepath │ ← Toolbar
├─────────────────────────────────────────────────────┤
│ │
│ Central panel (buffer view) │
│ │
├─────────────────────────────────────────────────────┤
│ Status message Type N bytes │ ← Status bar
└─────────────────────────────────────────────────────┘

Toolbar shows: view mode toggle (plain/hex, when applicable) · active identity · open file path.

Status bar shows: last operation result (left) · buffer type and byte count (right).

The buffer

All data lives in a single in-memory buffer managed by CryptoSystem. Every operation reads from and writes back to this buffer — there is no separate input/output concept. Loading a file, pasting from clipboard, or running a crypto operation all replace the buffer contents.

Two write gates exist:

• load_data(bytes) — used by file open, paste, and edit buffer.
• run_crypto_op(fn) — used by all crypto and format operations; updates the status bar on success or shows an error.

Both bump buffer_generation, which invalidates the cached hex dump.

Buffer classification and view modes

On every frame the buffer is classified into one of these kinds:

BigFile* kinds are detected by reading only the first 50 bytes of the file. The full content is never loaded into RAM. The central panel shows a centered filename + size placeholder instead of a text view.

The view mode is set automatically when data loads:

The toolbar shows a view toggle (Plain text / Hex dump) for armored and plaintext buffers when show_plaintext is enabled in Settings.

Masked display

When show_plaintext = false (the default), every printable ASCII character in plaintext, binary-signed, and clearsigned buffers is replaced with * in the viewer. Ciphertext and armor always display unmasked regardless of this setting.

Hex dump

Pre-formatted into Vec<String> and cached by buffer_generation. Display is capped at 1 MiB; the hex view renders all pre-formatted lines but is not yet virtualised.

Keyboard shortcuts

Ctrl+C and Ctrl+V are intercepted as egui::Event::Copy / egui::Event::Paste — they do not go through the standard key-press path.

File menu

Large file threshold: 25 MiB. Files above this size are opened in big-file mode: only the first 50 bytes are read for format detection, no content is loaded into the buffer, and the central panel shows a filename/size placeholder. Crypto operations that require buffer data (sign, armor, verify, asymmetric encrypt) show a hint to use LFM instead. Decrypt and symmetric encrypt route to LFM automatically when Large File Mode is enabled in Settings.

Operations menu

Encrypt

Decrypt Ctrl+D

Auto-detects from the 4-byte magic:

• RPGA → asymmetric decrypt with the current identity's X25519 private key. If the decrypted payload is a binary-signed blob, the signature wrapper is stripped and a signer picker opens.
• RPGS or unknown → opens the symmetric passphrase dialog (pre-filled from OS keyring).
• BigFileCipherText (file > 25 MiB) → opens the Stream Decrypt File (LFM) dialog directly.

Sign (your key)

Verify

Auto-detects binary or clearsign format from the buffer. If neither, opens a file picker for a detached signature file. Opens the identity picker (signer key). After a good verification, the signature wrapper is stripped and the status bar shows Good signature from <name>..

Keys menu

Identity picker (ChooseKey dialog)

The red identity picker opens for encrypt, sign+encrypt, verify, and select-own-identity operations. Identities are sorted by name. The last-used identity for the purpose (stored in rustpg.conf as last_recipient_id or last_verification_id) is highlighted white. Pressing Enter selects the highlighted identity immediately — repeat operations on the same key require no mouse click.

Revoked identities appear in light red with [REVOKED] appended.

Format menu

View menu

Settings dialog

Settings are written to ~/.config/rustpg/rustpg.conf immediately on OK.

Security dialogs

Dialogs that handle sensitive material use a dark red background (rgb(150, 0, 0)) with pale text to make them visually distinct from normal UI:

• Open keyring / Protect your keyring — master password entry
• Symmetric Encrypt / Decrypt — passphrase entry
• LFM Encrypt / LFM Decrypt — passphrase entry for stream operations
• ChooseKey (encrypt, sign+encrypt) — recipient selection
• Revoke My Key — irreversible revocation confirmation
• Copy to clipboard — warns before copying plaintext
• Save keyring unencrypted — warns before writing private keys in plaintext

Progress modal — while a streaming LFM operation is running, a centered dark green window (rgb(0, 100, 40)) overlays the app showing a progress bar (percentage + MB processed). The rest of the UI remains live during the operation.

All password/passphrase fields have a 👁 visibility toggle. Passwords are stored in Zeroizing<String> and zeroed on drop.

Themes

Six themes selectable in Settings:

File association

On Linux, rustpg.desktop registers rustpg as a handler for .rpg files (Thunar, Nautilus, etc.). When a file is opened this way, the path arrives as the first CLI argument — pending_file — and is loaded after the keyring dialog is dismissed.