fix(installer): install hash-pinned dependencies and build tools (#856)

* fix(installer): install hash-pinned dependencies and build tools

* fix(installer): add cairo-devel for the pinned pycairo build

* fix(installer): reject missing or empty bootstrap exports

* fix(installer): preserve remote behavior for older tags

---------

Co-authored-by: Jatin K Malik <jatinkrmalik@gmail.com>
This commit is contained in:
Sergey Silaev
2026-09-23 00:09:48 -07:00
committed by GitHub
co-authored by Jatin K Malik
parent 4df612dd7a
commit acd90fdd05
12 changed files with 1183 additions and 170 deletions
+10
View File
@@ -32,6 +32,16 @@ The installer:
- Downloads the default whisper.cpp tiny model (~74MB), verified against pinned checksums
- Sets up desktop integration and launch wrappers
The source installer uses committed, hash-verified Python dependency exports,
including its pip and source-build tools. GTK/PyGObject still comes from your
distribution, and the venv retains access to system packages. A missing export
or unavailable pinned package causes that installation step to fail; the
existing optional-engine and VAD fallbacks still apply.
Remote installs run the installer from the selected release tag. Older tags
therefore retain their original dependency-install behavior; downloading a new
bootstrap script does not change an older release's pins.
### Installer modes
```bash