jake/Lumotia
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(hardening): tighten security and footprint defaults

Browse Source
This commit is contained in:
Jake
2026-04-24 19:03:57 +01:00
parent 55b34d8ffc
commit b333c6229e
36 changed files with 8702 additions and 254 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
crates/core/src/lib.rs
View File

@@ -2,6 +2,7 @@ pub mod constants;
pub mod error;
pub mod hardware;
pub mod model_registry;
pub mod paths;
pub mod process_watch;
pub mod recommendation;
pub mod types;

76
crates/core/src/model_registry.rs
View File

@@ -40,8 +40,8 @@ pub struct ModelFile {
pub filename: &'static str,
pub url: &'static str,
pub size: Megabytes,
/// SHA256 hex digest for integrity verification. None to skip check.
pub sha256: Option<&'static str>,
/// SHA256 hex digest for integrity verification.
pub sha256: &'static str,
}
/// All metadata for a single downloadable model.
@@ -74,27 +74,27 @@ static ALL_MODELS: LazyLock<Vec<ModelEntry>> = LazyLock::new(|| {
files: vec![
ModelFile {
filename: "encoder-model.int8.onnx",
url: "https://huggingface.co/istupakov/parakeet-tdt-0.6b-v2-onnx/resolve/main/encoder-model.int8.onnx",
url: "https://huggingface.co/istupakov/parakeet-tdt-0.6b-v2-onnx/resolve/0bbb45a3365852604aef28b538a8f066f4ccaa85/encoder-model.int8.onnx",
size: Megabytes(620),
sha256: None,
sha256: "3e0581fda6ab843888b51e56d7ee78b6d5bc3237ec113af1f732d1d5286aa155",
},
ModelFile {
filename: "decoder_joint-model.int8.onnx",
url: "https://huggingface.co/istupakov/parakeet-tdt-0.6b-v2-onnx/resolve/main/decoder_joint-model.int8.onnx",
url: "https://huggingface.co/istupakov/parakeet-tdt-0.6b-v2-onnx/resolve/0bbb45a3365852604aef28b538a8f066f4ccaa85/decoder_joint-model.int8.onnx",
size: Megabytes(3),
sha256: None,
sha256: "a449f49acd68979d418651dd2dcb737cc0f1bf0225e009e29ee326354edbf7d3",
},
ModelFile {
filename: "nemo128.onnx",
url: "https://huggingface.co/istupakov/parakeet-tdt-0.6b-v2-onnx/resolve/main/nemo128.onnx",
url: "https://huggingface.co/istupakov/parakeet-tdt-0.6b-v2-onnx/resolve/0bbb45a3365852604aef28b538a8f066f4ccaa85/nemo128.onnx",
size: Megabytes(1),
sha256: None,
sha256: "a9fde1486ebfcc08f328d75ad4610c67835fea58c73ba57e3209a6f6cf019e9f",
},
ModelFile {
filename: "vocab.txt",
url: "https://huggingface.co/istupakov/parakeet-tdt-0.6b-v2-onnx/resolve/main/vocab.txt",
url: "https://huggingface.co/istupakov/parakeet-tdt-0.6b-v2-onnx/resolve/0bbb45a3365852604aef28b538a8f066f4ccaa85/vocab.txt",
size: Megabytes(1),
sha256: None,
sha256: "ec182b70dd42113aff6c5372c75cac58c952443eb22322f57bbd7f53977d497d",
},
],
description: "Fastest local model — near-instant transcription",
@@ -110,9 +110,9 @@ static ALL_MODELS: LazyLock<Vec<ModelEntry>> = LazyLock::new(|| {
languages: LanguageSupport::EnglishOnly,
files: vec![ModelFile {
filename: "ggml-tiny.en.bin",
url: "https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-tiny.en.bin",
url: "https://huggingface.co/ggerganov/whisper.cpp/resolve/5359861c739e955e79d9a303bcbc70fb988958b1/ggml-tiny.en.bin",
size: Megabytes(75),
sha256: None,
sha256: "921e4cf8686fdd993dcd081a5da5b6c365bfde1162e72b08d75ac75289920b1f",
}],
description: "Bundled with app — works instantly",
},
@@ -127,9 +127,9 @@ static ALL_MODELS: LazyLock<Vec<ModelEntry>> = LazyLock::new(|| {
languages: LanguageSupport::EnglishOnly,
files: vec![ModelFile {
filename: "ggml-base.en.bin",
url: "https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-base.en.bin",
url: "https://huggingface.co/ggerganov/whisper.cpp/resolve/5359861c739e955e79d9a303bcbc70fb988958b1/ggml-base.en.bin",
size: Megabytes(142),
sha256: None,
sha256: "a03779c86df3323075f5e796cb2ce5029f00ec8869eee3fdfb897afe36c6d002",
}],
description: "Good balance of speed and accuracy",
},
@@ -144,9 +144,9 @@ static ALL_MODELS: LazyLock<Vec<ModelEntry>> = LazyLock::new(|| {
languages: LanguageSupport::EnglishOnly,
files: vec![ModelFile {
filename: "ggml-small.en.bin",
url: "https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-small.en.bin",
url: "https://huggingface.co/ggerganov/whisper.cpp/resolve/5359861c739e955e79d9a303bcbc70fb988958b1/ggml-small.en.bin",
size: Megabytes(466),
sha256: None,
sha256: "c6138d6d58ecc8322097e0f987c32f1be8bb0a18532a3f88f734d1bbf9c41e5d",
}],
description: "Accuracy-first English transcription",
},
@@ -161,9 +161,9 @@ static ALL_MODELS: LazyLock<Vec<ModelEntry>> = LazyLock::new(|| {
languages: LanguageSupport::EnglishOnly,
files: vec![ModelFile {
filename: "ggml-distil-small.en.bin",
url: "https://huggingface.co/distil-whisper/distil-small.en/resolve/main/ggml-distil-small.en.bin",
url: "https://huggingface.co/distil-whisper/distil-small.en/resolve/9e4a67ca4569c30be43a3fe7fba1621e504f0093/ggml-distil-small.en.bin",
size: Megabytes(336),
sha256: None,
sha256: "7691eb11167ab7aaf6b3e05d8266f2fd9ad89c550e433f86ac266ebdee6c970a",
}],
description: "Small accuracy, ~6\u{00d7} faster — distilled variant",
},
@@ -178,9 +178,9 @@ static ALL_MODELS: LazyLock<Vec<ModelEntry>> = LazyLock::new(|| {
languages: LanguageSupport::EnglishOnly,
files: vec![ModelFile {
filename: "ggml-medium.en.bin",
url: "https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-medium.en.bin",
url: "https://huggingface.co/ggerganov/whisper.cpp/resolve/5359861c739e955e79d9a303bcbc70fb988958b1/ggml-medium.en.bin",
size: Megabytes(1500),
sha256: None,
sha256: "cc37e93478338ec7700281a7ac30a10128929eb8f427dda2e865faa8f6da4356",
}],
description: "Best Whisper accuracy — needs 4+ GB RAM",
},
@@ -195,9 +195,9 @@ static ALL_MODELS: LazyLock<Vec<ModelEntry>> = LazyLock::new(|| {
languages: LanguageSupport::EnglishOnly,
files: vec![ModelFile {
filename: "ggml-distil-large-v3.bin",
url: "https://huggingface.co/distil-whisper/distil-large-v3-ggml/resolve/main/ggml-distil-large-v3.bin",
url: "https://huggingface.co/distil-whisper/distil-large-v3-ggml/resolve/0d78dd96ed9fc152325f63b53788fec3b43de031/ggml-distil-large-v3.bin",
size: Megabytes(1550),
sha256: None,
sha256: "2883a11b90fb10ed592d826edeaee7d2929bf1ab985109fe9e1e7b4d2b69a298",
}],
description: "Near large-v3 accuracy at ~6\u{00d7} the speed",
},
@@ -213,3 +213,35 @@ pub fn all_models() -> &'static [ModelEntry] {
pub fn find_model(id: &ModelId) -> Option<&'static ModelEntry> {
ALL_MODELS.iter().find(|m| &m.id == id)
}
#[cfg(test)]
mod tests {
use super::all_models;
#[test]
fn every_model_file_has_sha256_and_pinned_url() {
for model in all_models() {
for file in &model.files {
assert_eq!(
file.sha256.len(),
64,
"{} / {} must carry a SHA256 digest",
model.id,
file.filename
);
assert!(
file.sha256.chars().all(|c| c.is_ascii_hexdigit()),
"{} / {} SHA256 must be hex",
model.id,
file.filename
);
assert!(
!file.url.contains("/resolve/main/"),
"{} / {} must pin a Hugging Face revision",
model.id,
file.filename
);
}
}
}
}

125
crates/core/src/paths.rs Normal file
View File

@@ -0,0 +1,125 @@
use std::path::PathBuf;
use crate::types::ModelId;
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct AppPaths {
app_data_dir: PathBuf,
}
impl AppPaths {
pub fn current() -> Self {
Self {
app_data_dir: resolve_app_data_dir(),
}
}
pub fn app_data_dir(&self) -> PathBuf {
self.app_data_dir.clone()
}
pub fn database_path(&self) -> PathBuf {
self.app_data_dir.join("kon.db")
}
pub fn recordings_dir(&self) -> PathBuf {
self.app_data_dir.join("recordings")
}
pub fn crashes_dir(&self) -> PathBuf {
self.app_data_dir.join("crashes")
}
pub fn logs_dir(&self) -> PathBuf {
self.app_data_dir.join("logs")
}
pub fn diagnostic_reports_dir(&self) -> PathBuf {
self.app_data_dir.join("diagnostic-reports")
}
pub fn models_dir(&self) -> PathBuf {
self.app_data_dir.join("models")
}
pub fn speech_model_dir(&self, id: &ModelId) -> PathBuf {
self.models_dir().join(id.as_str())
}
pub fn llm_models_dir(&self) -> PathBuf {
self.models_dir().join("llm")
}
pub fn migration_sentinel(&self, name: &str) -> PathBuf {
self.app_data_dir.join(format!(".{name}.sentinel"))
}
}
pub fn app_paths() -> AppPaths {
AppPaths::current()
}
pub fn app_data_dir() -> PathBuf {
app_paths().app_data_dir()
}
fn resolve_app_data_dir() -> PathBuf {
#[cfg(target_os = "windows")]
{
let local_app_data = std::env::var("LOCALAPPDATA").unwrap_or_else(|_| ".".to_string());
return PathBuf::from(local_app_data).join("kon");
}
#[cfg(target_os = "macos")]
{
let home = std::env::var("HOME").unwrap_or_else(|_| "/tmp".to_string());
return PathBuf::from(home)
.join("Library")
.join("Application Support")
.join("Kon");
}
#[cfg(target_os = "linux")]
{
let home = std::env::var("HOME").unwrap_or_else(|_| "/tmp".to_string());
let legacy = PathBuf::from(&home).join(".kon");
if legacy.exists() {
return legacy;
}
if let Ok(xdg) = std::env::var("XDG_DATA_HOME") {
if !xdg.is_empty() {
return PathBuf::from(xdg).join("kon");
}
}
PathBuf::from(home).join(".local").join("share").join("kon")
}
#[cfg(not(any(target_os = "windows", target_os = "macos", target_os = "linux")))]
{
let home = std::env::var("HOME").unwrap_or_else(|_| "/tmp".to_string());
PathBuf::from(home).join(".kon")
}
}
#[cfg(test)]
mod tests {
use super::AppPaths;
use crate::types::ModelId;
use std::path::PathBuf;
#[test]
fn derives_all_paths_from_one_base() {
let paths = AppPaths {
app_data_dir: PathBuf::from("/tmp/kon-test"),
};
assert_eq!(paths.database_path(), PathBuf::from("/tmp/kon-test/kon.db"));
assert_eq!(
paths.speech_model_dir(&ModelId::new("whisper-base-en")),
PathBuf::from("/tmp/kon-test/models/whisper-base-en")
);
assert_eq!(
paths.llm_models_dir(),
PathBuf::from("/tmp/kon-test/models/llm")
);
}
}