xavierk
91708fdf4a
Install, update and support docs now name the signed Void xbps repository as the one published channel and the fork's own host for source, issues and releases. AUR, AppImage, .deb/.rpm, Flatpak, Snap, Nix, PyPI and the upstream install script are no longer offered. The one upstream credit line is kept in the README and CONTRIBUTING.
88 lines
2.8 KiB
Markdown
88 lines
2.8 KiB
Markdown
# Security policy
|
|
|
|
## Supported versions
|
|
|
|
Only the current stable minor line receives security fixes:
|
|
|
|
| Version | Supported |
|
|
| ------- | --------- |
|
|
| 0.18.x | Yes |
|
|
| 0.17.x | No |
|
|
| 0.16.x | No |
|
|
| 0.15.x | No |
|
|
| older | No |
|
|
|
|
Upgrade to the latest release for security and reliability fixes. See [docs/UPDATE.md](docs/UPDATE.md).
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Do not open a public GitHub issue for security vulnerabilities.
|
|
|
|
Email the maintainer at **xavier@bongbetic.com** with subject:
|
|
|
|
`Voculinux Security Vulnerability Report`
|
|
|
|
Include:
|
|
|
|
- Clear description of the issue
|
|
- Steps to reproduce
|
|
- Potential impact
|
|
- Suggested fix (optional)
|
|
|
|
You should receive acknowledgment within 48 hours. We will assess severity, share an expected timeline, coordinate disclosure, and credit you in release notes if you want credit.
|
|
|
|
## Privacy design
|
|
|
|
Voculinux is built for local-first dictation:
|
|
|
|
- Local engines process audio on-device after you download a model
|
|
- No account is required for local engines
|
|
- No usage telemetry in the installed application
|
|
- Models download once and stay in local cache
|
|
- Downloads are checked against pinned checksums before install
|
|
|
|
### Remote API (optional)
|
|
|
|
When the user enables **Remote API**, audio is uploaded to the configured server over HTTP(S). That path is off by default. Operators should use TLS and authentication for any network outside a trusted LAN. See [docs/HTTP_REMOTE.md](docs/HTTP_REMOTE.md).
|
|
|
|
### Engines
|
|
|
|
| Engine | Processing | Notes |
|
|
|--------|------------|--------|
|
|
| whisper.cpp (default) | Local | Vulkan GPU optional; models cached under XDG data |
|
|
| OpenAI Whisper | Local | PyTorch; NVIDIA/CUDA common |
|
|
| Faster Whisper | Local | CTranslate2 / INT8 Whisper on CPU; optional extra |
|
|
| VOSK | Local | Lightweight CPU path |
|
|
| Parakeet | Local | NVIDIA NeMo ASR via sherpa-onnx; CPU |
|
|
| Remote API | User-configured server | Opt-in only |
|
|
|
|
### File locations
|
|
|
|
| Path | Purpose | Permissions (typical) |
|
|
|------|---------|------------------------|
|
|
| `~/.config/voculinux/` | Configuration | User-only (mode 700) |
|
|
| `~/.local/share/voculinux/` | Data and models | User-only (mode 700) |
|
|
|
|
### Known limitations
|
|
|
|
1. **Text injection** uses tools such as xdotool, wtype, ydotool, or IBus; desktop input APIs have their own privilege model
|
|
2. **Global shortcuts** need access to input devices (e.g. evdev on some setups)
|
|
3. **Virtual environments** isolate Python packages but do not sandbox the desktop session
|
|
|
|
## Keeping installs current
|
|
|
|
On Void Linux, update through the signed xbps repository:
|
|
|
|
```bash
|
|
sudo xbps-install -Su voculinux
|
|
```
|
|
|
|
Source checkouts and other paths are in [docs/UPDATE.md](docs/UPDATE.md).
|
|
|
|
## Contact
|
|
|
|
| Topic | Contact |
|
|
|-------|---------|
|
|
| Security | xavier@bongbetic.com |
|
|
| General bugs | https://git.bongbetic.com/xavierk/voculinux/issues |
|