xavierk/voculinux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 3 Wiki Activity

docs: publish Void xbps as the only install channel (upstream reference cleanup) #38

Merged
xavierk merged 6 commits from docs/upstream-reference-cleanup into main 2026-11-06 16:17:05 +00:00
Conversation 0 Commits 6 Files Changed 77
+1419 -5344
xavierk commented 2026-11-06 15:56:07 +00:00
Owner
Copy Link
Copy Source

Description

Release-readiness cleanup for the Void release (spec #16). Voculinux publishes one channel, the signed Void xbps repository, and the fork's own host for source, issues and releases. This PR removes the upstream references and the unpublished channels from every user-visible surface in scope:

  • Docs: README, SECURITY, SUPPORT, CONTRIBUTING, and docs/INSTALL, UPDATE, TROUBLESHOOTING, DISTRO_COMPATIBILITY are Void-first. AUR, AppImage, .deb/.rpm, Flatpak, Snap, Nix, PyPI and the upstream install script are no longer offered. Issue and discussion links point at the fork.
  • About page (settings_about.py, settings_dialog.py): the fork's website, source and issues links. The Voca family tiles and the Discord, X and mail links are gone. A single Origin row credits upstream Vocalinux. The project URL in version.py points at the fork host.
  • Void install message: sudo xbps-install -Su voculinux (not -Syu), and a PipeWire capture note.
  • Website (web/): install, home and FAQ describe the Void repo only. Flatpak, NixOS, the seven distro guides, changelog and local-gateway pages became notices outside navigation and the sitemap. The JSON-LD author is the fork maintainer. The @vocahq Twitter handle and VocaHQ links are removed. The unused src/lib/api/util.ts and unused brand SVGs are deleted.
  • Tests: tests/test_rename_sweep.py gains a fork-surface rule. Upstream hosts, handles and URLs are forbidden on those surfaces except each file's recorded credit, matched as an exact line. The web rebrand test allow-lists exact lines. Packaging tests read only the surfaces that still exist.

Credit: one upstream line per surface. README and CONTRIBUTING carry the exact line "Voculinux is a hard fork of Vocalinux by VocaHQ: https://github.com/VocaHQ/vocalinux". The About Origin row uses the same text as UPSTREAM_CREDIT_LINE. The web footer is the labelled link "Vocalinux (upstream, by VocaHQ)" pointing at UPSTREAM_REPO_URL. A case-sensitive grep for VocaHQ|vocahq|vocalinux\.com|@vocahq over the in-scope files returns only those lines.

Related issue

Refs #16 (release-readiness spec)

Type of change

  • Documentation
  • Tests
  • Bug fix
  • New feature
  • Breaking change
  • Refactor
  • Packaging / CI

Checklist

  • Code follows project style (Black, isort, flake8): black --check, isort --check, and flake8 E9/F63/F7/F82 are clean on src/, tests/ and snap/local/
  • Documentation updated for the install and update steps
  • Tests added or updated for the change
  • Touched tests pass when run alone (see below)
  • Conventional commit message style

Gates:

  • tests/test_rename_sweep.py (all 6 pass), and the touched files run alone: native_packaging, snap_packaging, void_app_template, void_signed_repo, version, app_identity, python_version_policy, installer_python_selection, cross_distro_compatibility, check_build_deps, update_checker, packaged_install, xbps_release_workflow, recommendation_is_actionable all pass.
  • tests/test_settings_dialog.py: one failure, TestPasteLongTextPreference::test_switch_loads_and_saves, which also fails on main when the file runs alone. Not touched here.
  • web npm test: 141/141 pass (12 suites). npm run typecheck clean. npm run build passes (50 pages).
  • jscpd (.jscpd.json, the CI lint job): 3.93% of lines, down from 4.33% on main.

Screenshots (if applicable)

Not applicable: no UI layout change beyond removing the About family tiles and social rows.

Notes for reviewers

Decisions to confirm

  1. The security contact moved from the upstream author's personal address to xavier@bongbetic.com, the maintainer address in the Void template. The GitHub advisory fallback was removed, since Gitea has no equivalent.
  2. The About page keeps its "Talk to us" group, now with the fork issue tracker only.
  3. The Local VocaGateway section in settings_dialog.py is kept as a feature. Its runtime clones github.com/VocaHQ/vocagateway.git and uses the vocagateway:v0.1.0 image (src/vocalinux/gateway_embed/paths_embed.py, runner.py). That is an upstream dependency the fork still ships. Removing it is a feature decision, not part of this cleanup.
  4. Web notice pages (Flatpak, NixOS, distro guides, changelog, local-gateway) keep their URLs but leave navigation and the sitemap. Sitemap: 47 to 36 entries.
  5. The web install commands fetch releases/download/latest. They fail until the first fork release publishes that asset, as the README already says.

Left deliberately (out of scope)

  • .github/workflows/*: upstream-only, inert on Gitea. Not edited.
  • .gitea/workflows/ci.yml lint job: only jscpd runs; the language lint steps are still a placeholder.
  • packaging/flatpak, packaging/aur, packaging/nix, snap/, uv.lock, CHANGELOG.md, install.sh internals (the script still clones github.com/VocaHQ/vocalinux and queries the upstream API when run remotely; the README source path runs ./install.sh --dev from the fork checkout).
  • docs/AUR.md, docs/FLATPAK_REMOTE.md, docs/SNAP.md, docs/INSTALL_MANUAL.md, docs/GATEWAY_EMBED.md, docs/README.md index, docs/NIRI.md: not in scope. They still describe the unpublished channels, and the docs index still links them.
  • src/vocalinux/version.py: __author__, __email__ and the copyright line are upstream metadata. The copyright line is kept for AGPL attribution.
  • Unused brand marks in resources/icons/scalable/ (discord, x, mail, github, platform-*): still shipped and still hash-checked by a test. Pruning them is a follow-up.
  • Release-history text in docs/UPDATE.md and the web changelog keeps the upstream history.

Commits

  • docs: publish Void xbps as the only install channel
  • fix(ui): point About and update links at the fork
  • fix(void): name the -Su update command and PipeWire capture
  • fix(web): remove upstream links and unpublished channels from the site
  • test: fence upstream references on the fork surfaces
  • test(web): avoid path.join on a parameter in the rebrand scan (fixes the Semgrep path-traversal finding on the first CI run)
## Description Release-readiness cleanup for the Void release (spec #16). Voculinux publishes one channel, the signed Void xbps repository, and the fork's own host for source, issues and releases. This PR removes the upstream references and the unpublished channels from every user-visible surface in scope: - **Docs:** README, SECURITY, SUPPORT, CONTRIBUTING, and docs/INSTALL, UPDATE, TROUBLESHOOTING, DISTRO_COMPATIBILITY are Void-first. AUR, AppImage, .deb/.rpm, Flatpak, Snap, Nix, PyPI and the upstream install script are no longer offered. Issue and discussion links point at the fork. - **About page (settings_about.py, settings_dialog.py):** the fork's website, source and issues links. The Voca family tiles and the Discord, X and mail links are gone. A single Origin row credits upstream Vocalinux. The project URL in version.py points at the fork host. - **Void install message:** `sudo xbps-install -Su voculinux` (not -Syu), and a PipeWire capture note. - **Website (web/):** install, home and FAQ describe the Void repo only. Flatpak, NixOS, the seven distro guides, changelog and local-gateway pages became notices outside navigation and the sitemap. The JSON-LD author is the fork maintainer. The `@vocahq` Twitter handle and VocaHQ links are removed. The unused `src/lib/api/util.ts` and unused brand SVGs are deleted. - **Tests:** `tests/test_rename_sweep.py` gains a fork-surface rule. Upstream hosts, handles and URLs are forbidden on those surfaces except each file's recorded credit, matched as an exact line. The web rebrand test allow-lists exact lines. Packaging tests read only the surfaces that still exist. Credit: one upstream line per surface. README and CONTRIBUTING carry the exact line "Voculinux is a hard fork of Vocalinux by VocaHQ: https://github.com/VocaHQ/vocalinux". The About Origin row uses the same text as `UPSTREAM_CREDIT_LINE`. The web footer is the labelled link "Vocalinux (upstream, by VocaHQ)" pointing at `UPSTREAM_REPO_URL`. A case-sensitive grep for `VocaHQ|vocahq|vocalinux\.com|@vocahq` over the in-scope files returns only those lines. ## Related issue Refs #16 (release-readiness spec) ## Type of change - [x] Documentation - [x] Tests - [ ] Bug fix - [ ] New feature - [ ] Breaking change - [ ] Refactor - [ ] Packaging / CI ## Checklist - [x] Code follows project style (Black, isort, flake8): `black --check`, `isort --check`, and flake8 E9/F63/F7/F82 are clean on src/, tests/ and snap/local/ - [x] Documentation updated for the install and update steps - [x] Tests added or updated for the change - [x] Touched tests pass when run alone (see below) - [x] Conventional commit message style Gates: - `tests/test_rename_sweep.py` (all 6 pass), and the touched files run alone: native_packaging, snap_packaging, void_app_template, void_signed_repo, version, app_identity, python_version_policy, installer_python_selection, cross_distro_compatibility, check_build_deps, update_checker, packaged_install, xbps_release_workflow, recommendation_is_actionable all pass. - `tests/test_settings_dialog.py`: one failure, `TestPasteLongTextPreference::test_switch_loads_and_saves`, which also fails on main when the file runs alone. Not touched here. - web `npm test`: 141/141 pass (12 suites). `npm run typecheck` clean. `npm run build` passes (50 pages). - jscpd (`.jscpd.json`, the CI lint job): 3.93% of lines, down from 4.33% on main. ## Screenshots (if applicable) Not applicable: no UI layout change beyond removing the About family tiles and social rows. ## Notes for reviewers **Decisions to confirm** 1. The security contact moved from the upstream author's personal address to `xavier@bongbetic.com`, the maintainer address in the Void template. The GitHub advisory fallback was removed, since Gitea has no equivalent. 2. The About page keeps its "Talk to us" group, now with the fork issue tracker only. 3. The Local VocaGateway section in settings_dialog.py is kept as a feature. Its runtime clones `github.com/VocaHQ/vocagateway.git` and uses the `vocagateway:v0.1.0` image (`src/vocalinux/gateway_embed/paths_embed.py`, `runner.py`). That is an upstream dependency the fork still ships. Removing it is a feature decision, not part of this cleanup. 4. Web notice pages (Flatpak, NixOS, distro guides, changelog, local-gateway) keep their URLs but leave navigation and the sitemap. Sitemap: 47 to 36 entries. 5. The web install commands fetch `releases/download/latest`. They fail until the first fork release publishes that asset, as the README already says. **Left deliberately (out of scope)** - `.github/workflows/*`: upstream-only, inert on Gitea. Not edited. - `.gitea/workflows/ci.yml` lint job: only jscpd runs; the language lint steps are still a placeholder. - `packaging/flatpak`, `packaging/aur`, `packaging/nix`, `snap/`, `uv.lock`, `CHANGELOG.md`, `install.sh` internals (the script still clones `github.com/VocaHQ/vocalinux` and queries the upstream API when run remotely; the README source path runs `./install.sh --dev` from the fork checkout). - `docs/AUR.md`, `docs/FLATPAK_REMOTE.md`, `docs/SNAP.md`, `docs/INSTALL_MANUAL.md`, `docs/GATEWAY_EMBED.md`, `docs/README.md` index, `docs/NIRI.md`: not in scope. They still describe the unpublished channels, and the docs index still links them. - `src/vocalinux/version.py`: `__author__`, `__email__` and the copyright line are upstream metadata. The copyright line is kept for AGPL attribution. - Unused brand marks in `resources/icons/scalable/` (discord, x, mail, github, platform-*): still shipped and still hash-checked by a test. Pruning them is a follow-up. - Release-history text in `docs/UPDATE.md` and the web changelog keeps the upstream history. **Commits** - `docs: publish Void xbps as the only install channel` - `fix(ui): point About and update links at the fork` - `fix(void): name the -Su update command and PipeWire capture` - `fix(web): remove upstream links and unpublished channels from the site` - `test: fence upstream references on the fork surfaces` - `test(web): avoid path.join on a parameter in the rebrand scan` (fixes the Semgrep path-traversal finding on the first CI run)
xavierk added 5 commits 2026-11-06 15:56:07 +00:00
docs: publish Void xbps as the only install channel 91708fdf4a 
Install, update and support docs now name the signed Void xbps repository
as the one published channel and the fork's own host for source, issues
and releases. AUR, AppImage, .deb/.rpm, Flatpak, Snap, Nix, PyPI and the
upstream install script are no longer offered. The one upstream credit
line is kept in the README and CONTRIBUTING.
fix(ui): point About and update links at the fork bc47ffecf6 
The About page links the fork's website, source and issue tracker. The
Voca family tiles and Discord, X and mail links are gone. A single
Origin row credits upstream Vocalinux. The model-selection doc link and
the project URL now point at the fork host.
fix(void): name the -Su update command and PipeWire capture b26a12d6d7 
The install message updates with sudo xbps-install -Su, and it states the
PipeWire capture dependency the package already declares.
fix(web): remove upstream links and unpublished channels from the site 4edccb6caa 
Install, home and FAQ describe the signed Void xbps repository only. Pages
for Flatpak, NixOS, the distro guides, changelog and local gateway are
notices outside navigation and the sitemap. The JSON-LD author is the fork
maintainer. The Twitter handle, Discord, X and VocaHQ links are removed,
and the one footer credit stays. The web rebrand test allow-lists the
exact upstream lines.
test: fence upstream references on the fork surfaces
CI / security (pull_request) Failing after 1m14s
Details
CI / lint (pull_request) Successful in 22s
Details
CI / ai-review (pull_request) Successful in 7s
Details
c166a67822 
The naming sweep forbids upstream hosts, handles and URLs on the fork
surfaces except each file's recorded credit line, matched exactly. Packaging
tests read the surfaces that still exist: the Wayland hotkey section and the
Snap recipe.
xavierk added 1 commit 2026-11-06 16:06:58 +00:00
test(web): avoid path.join on a parameter in the rebrand scan
CI / security (pull_request) Successful in 1m10s
Details
CI / lint (pull_request) Successful in 22s
Details
CI / ai-review (pull_request) Successful in 7s
Details
33c7c940a0 
Semgrep flagged the directory walker as a possible path traversal. The walk
now runs from an absolute src root and builds child paths from directory
entries only.
xavierk merged commit 4171567fd7 into main 2026-11-06 16:17:05 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
needs-info
Waiting on reporter for more information
 needs-triage
Maintainer needs to evaluate this issue
 ready-for-agent
Fully specified, ready for an AFK agent
 ready-for-human
Requires human implementation
 wayfinder:grilling
wayfinder:map
wayfinder:prototype
wayfinder:research
wayfinder:task
wontfix
Will not be actioned
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
xavierk (Xavier Karma)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: xavierk/voculinux#38