Jatin K MalikandGitHub
1dc1d44665
* feat: prepare for v0.2.0-alpha release * feat: prepare for v0.2.0-alpha release * chore: remove CHANGELOG.md, use GitHub Releases instead * refactor: use existing About dialog instead of Settings section * style: enhance About dialog UI readability * style: fix formatting with black and isort * feat: show VAD and silence timeout settings for Whisper engine - Renamed 'VOSK Settings' to 'Recognition Settings' - VAD Sensitivity and Silence Timeout now apply to both engines - Added tooltips explaining each setting - VOSK-specific model info only shown when VOSK selected * fix: resolve overlapping UI elements in settings dialog * fix: save VAD and silence timeout settings for both engines Previously these settings were only saved when VOSK was selected. Now they persist correctly for Whisper as well. * fix: show download progress when selecting undownloaded model Previously when auto-applying settings, models would download silently in the background without showing the progress dialog. Now: - Download progress dialog appears for undownloaded models - Model icons update correctly after download completes * feat: add download progress, speed, ETA and cancel button - Show real download progress percentage for VOSK models - Display download speed (MB/s) and estimated time remaining - Add Cancel button to abort downloads - Update status during extraction phase - Whisper downloads still pulse (uses internal downloader) * fix: defer model download until needed, don't block startup - App now starts instantly even if models aren't downloaded - Models are downloaded on-demand when selected in Settings - If user tries to dictate without a model, plays error sound - Added model_ready property to check if engine is usable * fix: improve first-run UX without downloaded models - Settings dialog now defaults to smallest available model, not saved config - Only show saved model if it's actually downloaded - Add desktop notification when trying to dictate without a model - Prevents auto-downloading large models on first launch * feat: add download progress tracking for Whisper models - Implement custom Whisper model download with progress/speed/ETA - Uses OpenAI's CDN URLs directly instead of whisper.load_model() - Progress callback works the same as VOSK downloads - Supports cancellation during download * fix: enable download progress callback for Whisper models Progress callback was only being set for VOSK downloads, not Whisper. Now both engines show real-time progress, speed, and ETA. * fix: update tests for defer_download and config manager mocking - test_main: Mock ConfigManager to prevent saved config from overriding test values - test_settings_dialog: Mock ModelDownloadDialog to prevent GTK init errors - test_speech_recognition: Use proper MockVoskModule class instead of MagicMock, pass defer_download=False for download test - test_whisper_support: Pass defer_download=False to trigger model loading in test * fix: resolve test failures for CI - test_main: Fix ConfigManager patch path to use source module - test_settings_dialog: Mock _is_vosk_model_downloaded and _is_whisper_model_downloaded to skip download flow, add missing dialog attributes - test_speech_recognition: Replace recognizer with properly configured mock that returns valid JSON, fixing test isolation issues when running all tests together * fix: mock _download_whisper_model in whisper test to avoid requests exception handling issue * fix: add gir1.2-girepository-2.0 dep for PyGObject on Ubuntu 24.04 - Add missing girepository-2.0 package for newer Ubuntu runners - Use --no-build-isolation for PyGObject to use system packages * fix: skip PyGObject pip install, use system python3-gi package - Use --no-deps for editable install to skip PyGObject - Install other deps explicitly without PyGObject - Add python3-gi-cairo for complete GTK support - Removes problematic girepository-2.0 build requirement * fix: install PyGObject via pip with proper build deps - Remove python3-gi/python3-gi-cairo (doesn't work with setup-python) - Install PyGObject from pip after installing build dependencies - Simplify venv setup without --system-site-packages hack * Fix GObject * fix: set GI_TYPELIB_PATH for pip-installed PyGObject to find AppIndicator3
84 lines
2.3 KiB
Markdown
84 lines
2.3 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
| Version | Supported |
|
|
| ------- | ------------------ |
|
|
| 0.2.x | :white_check_mark: |
|
|
| < 0.2 | :x: |
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
We take security seriously. If you discover a security vulnerability within Vocalinux, please follow these steps:
|
|
|
|
### Do NOT
|
|
|
|
- Open a public GitHub issue for security vulnerabilities
|
|
- Disclose the vulnerability publicly before it's fixed
|
|
|
|
### Do
|
|
|
|
1. **Email the maintainer directly**: Send an email to jatinkrmalik@gmail.com with:
|
|
- A clear description of the vulnerability
|
|
- Steps to reproduce the issue
|
|
- Potential impact assessment
|
|
- Any suggested fixes (optional)
|
|
|
|
2. **Use the subject line**: "Vocalinux Security Vulnerability Report"
|
|
|
|
3. **Wait for acknowledgment**: You should receive a response within 48 hours
|
|
|
|
### What to Expect
|
|
|
|
1. **Acknowledgment**: We'll confirm receipt within 48 hours
|
|
2. **Assessment**: We'll evaluate the severity and impact
|
|
3. **Timeline**: We'll provide an estimated fix timeline
|
|
4. **Fix**: We'll work on a fix and coordinate disclosure
|
|
5. **Credit**: If desired, we'll credit you in the release notes
|
|
|
|
## Security Considerations
|
|
|
|
### Privacy
|
|
|
|
Vocalinux is designed with privacy in mind:
|
|
|
|
- **Offline by default**: The VOSK engine works completely offline
|
|
- **Local processing**: All speech recognition happens on your device
|
|
- **No data collection**: We don't collect or transmit your voice data
|
|
- **No telemetry**: We don't track usage or behavior
|
|
|
|
### Whisper AI
|
|
|
|
When using Whisper, be aware:
|
|
- Whisper processes locally on your machine
|
|
- Models are downloaded once and cached locally
|
|
- No audio data is sent to external servers
|
|
|
|
### File Permissions
|
|
|
|
The application stores data in:
|
|
- `~/.config/vocalinux/` - Configuration (mode 700)
|
|
- `~/.local/share/vocalinux/` - Data and models (mode 700)
|
|
|
|
### Known Limitations
|
|
|
|
1. **Text injection**: Uses xdotool/wtype which may have implications for input monitoring
|
|
2. **Keyboard shortcuts**: Global keyboard hooks require appropriate permissions
|
|
3. **Virtual environments**: Running in a venv provides some isolation
|
|
|
|
## Updates
|
|
|
|
Keep your installation updated to receive security fixes:
|
|
|
|
```bash
|
|
cd vocalinux
|
|
git pull origin main
|
|
pip install --upgrade -e .
|
|
```
|
|
|
|
## Contact
|
|
|
|
For security concerns: jatinkrmalik@gmail.com
|
|
|
|
For general issues: https://github.com/jatinkrmalik/vocalinux/issues
|