fix(security): honour cancel during hash verify and failed apply

Failed downloads no longer report success: the settings worker re-raises so
the dialog can show the error. Cancel aborts SHA256 hashing and skips
install/extract. The installer now refuses symlink zip members, Whisper pin
refresh tolerates a missing Content-Length, and Portuguese VOSK keeps the
published Facebook zip because vosk-model-pt-0.4 404s on Alphacephei.

Co-authored-by: jatinkrmalik <jatinkrmalik@gmail.com>

Author: jatinkrmalik

install.sh

@@ -3408,6 +3408,27 @@ verify_zip_members_safe() {
         return 1
     fi
 
+    # Match the runtime extractor: refuse symlink members (unzip -Z1 only lists
+    # names, so a link to /etc/passwd would otherwise pass the path check).
+    if ! command -v python3 >/dev/null 2>&1; then
+        print_error "python3 is required to inspect archive members"
+        return 1
+    fi
+    python3 -c '
+import sys, zipfile
+with zipfile.ZipFile(sys.argv[1]) as archive:
+    for member in archive.infolist():
+        if (member.external_attr >> 16) & 0xF000 == 0xA000:
+            sys.exit(2)
+' "$zip_file" || {
+        status=$?
+        if [ "$status" -eq 2 ]; then
+            print_error "Archive $(basename "$zip_file") contains a symlink; refusing to extract"
+            return 1
+        fi
+        print_error "Could not inspect archive $(basename "$zip_file")"
+        return 1
+    }
     return 0
 }
 

scripts/update_model_hashes.py

@@ -99,9 +99,25 @@ def collect_whisper() -> Dict[str, dict]:
         logger.info("HEAD %s", url)
         response = requests.head(url, timeout=HTTP_TIMEOUT, allow_redirects=True)
         response.raise_for_status()
+        content_length = response.headers.get("content-length")
+        if not content_length:
+            logger.warning(
+                "HEAD for Whisper %s omitted Content-Length; leaving any existing pin untouched",
+                size,
+            )
+            continue
+        try:
+            size_bytes = int(content_length)
+        except ValueError:
+            logger.warning(
+                "HEAD for Whisper %s had invalid Content-Length %r; leaving existing pin",
+                size,
+                content_length,
+            )
+            continue
         digests[f"{size}.pt"] = {
             "sha256": sha256,
-            "size": int(response.headers["content-length"]),
+            "size": size_bytes,
         }
     logger.info("Pinned %d Whisper models", len(digests))
     return digests

src/vocalinux/speech_recognition/recognition_manager.py

@@ -1889,6 +1889,14 @@ def _report_download_status(self, status: str, fraction: float = 0.0) -> None:
         if self._download_progress_callback:
             self._download_progress_callback(fraction, 0.0, status)
 
+    def _raise_if_download_cancelled(self) -> None:
+        """Abort the current download if the user has already hit Cancel."""
+        if self._download_cancelled:
+            raise RuntimeError("Download cancelled")
+
+    def _download_was_cancelled(self) -> bool:
+        return self._download_cancelled
+
     def _interruptible_pause(self, seconds: float) -> None:
         """Sleep in short slices so Cancel can abort between UI stages.
 
@@ -1897,8 +1905,7 @@ def _interruptible_pause(self, seconds: float) -> None:
         """
         deadline = time.time() + seconds
         while True:
-            if self._download_cancelled:
-                raise RuntimeError("Download cancelled")
+            self._raise_if_download_cancelled()
             remaining = deadline - time.time()
             if remaining <= 0:
                 return
@@ -1929,12 +1936,15 @@ def _verify_download_with_status(self, filepath: str, model_type: str, filename:
         out. Unpinned models (non-strict mode) get an honest "skipping" status
         so the UI never claims a verification that did not happen.
         """
+        self._raise_if_download_cancelled()
         watching = self._download_progress_callback is not None
         pinned = get_pinned_digest(model_type, filename)
+        abort = self._download_was_cancelled
 
         if pinned is None:
             # verify_downloaded_model will warn (or raise in strict mode).
-            verify_downloaded_model(filepath, model_type, filename)
+            verify_downloaded_model(filepath, model_type, filename, should_abort=abort)
+            self._raise_if_download_cancelled()
             self._report_download_status("No pinned digest — skipping hash check", 1.0)
             if watching:
                 self._interruptible_pause(0.35)
@@ -1945,7 +1955,8 @@ def _verify_download_with_status(self, filepath: str, model_type: str, filename:
         # we burn CPU hashing; large models take long enough on their own.
         if watching:
             self._interruptible_pause(0.3)
-        verify_downloaded_model(filepath, model_type, filename)
+        verify_downloaded_model(filepath, model_type, filename, should_abort=abort)
+        self._raise_if_download_cancelled()
         self._report_download_status("Hash matches — integrity verified", 1.0)
         if watching:
             self._interruptible_pause(0.5)
@@ -2071,6 +2082,7 @@ def _download_whispercpp_model(self):
             self._announce_secured_download("whispercpp", os.path.basename(model_path))
             self._stream_model_download(url, temp_file)
             self._verify_download_with_status(temp_file, "whispercpp", os.path.basename(model_path))
+            self._raise_if_download_cancelled()
             os.rename(temp_file, model_path)
             logger.info("whisper.cpp model downloaded successfully")
 
@@ -2249,6 +2261,7 @@ def _download_vosk_model(self):
                         logger.info(f"Download progress: {progress * 100:.1f}% - {status}")
 
             self._verify_download_with_status(zip_path, "vosk", os.path.basename(zip_path))
+            self._raise_if_download_cancelled()
 
             # Update status for extraction phase
             if self._download_progress_callback:
@@ -2366,6 +2379,7 @@ def _download_whisper_model(self, cache_dir: str):
                         logger.info(f"Download progress: {progress * 100:.1f}% - {status}")
 
             self._verify_download_with_status(temp_file, "whisper", f"{self.model_size}.pt")
+            self._raise_if_download_cancelled()
 
             # Rename temp file to final
             os.rename(temp_file, model_file)

src/vocalinux/ui/settings_dialog.py

@@ -4967,7 +4967,7 @@ def check_cancelled():
                         cancel_check_id = GLib.timeout_add(100, check_cancelled)
 
                         try:
-                            self._apply_settings_internal(settings)
+                            self._apply_settings_internal(settings, show_errors=False)
                             GLib.idle_add(download_dialog.set_complete, True, "")
                             GLib.idle_add(self._populate_model_options)
                         finally:
@@ -5257,7 +5257,7 @@ def check_cancelled():
                     cancel_check_id = GLib.timeout_add(100, check_cancelled)
 
                     try:
-                        self._apply_settings_internal(settings)
+                        self._apply_settings_internal(settings, show_errors=False)
                         GLib.idle_add(download_dialog.set_complete, True, "")
                     finally:
                         GLib.source_remove(cancel_check_id)
@@ -5282,8 +5282,13 @@ def check_cancelled():
 
         return self._apply_settings_internal(settings)
 
-    def _apply_settings_internal(self, settings: dict) -> bool:
-        """Internal method to apply settings."""
+    def _apply_settings_internal(self, settings: dict, *, show_errors: bool = True) -> bool:
+        """Internal method to apply settings.
+
+        When ``show_errors`` is False (the secured-download worker), failures
+        propagate so the download dialog can show them. GTK dialogs must not be
+        created from that background thread.
+        """
         try:
             self._save_selected_settings(settings)
 
@@ -5298,6 +5303,8 @@ def _apply_settings_internal(self, settings: dict) -> bool:
             return True
         except Exception as e:
             logger.error(f"Failed to apply settings: {e}", exc_info=True)
+            if not show_errors:
+                raise
 
             if "whisper" in str(e).lower() and "no module named" in str(e).lower():
                 self._show_whisper_install_dialog()

src/vocalinux/utils/model_integrity.py

@@ -30,7 +30,7 @@
 import os
 import zipfile
 from pathlib import Path
-from typing import Optional
+from typing import Callable, Optional
 from urllib.parse import urlparse
 
 logger = logging.getLogger(__name__)
@@ -102,11 +102,20 @@ def get_pinned_digest(model_type: str, filename: str) -> Optional[dict]:
     return None
 
 
-def sha256_file(filepath: str) -> str:
-    """Compute the SHA256 digest of a file."""
+def sha256_file(
+    filepath: str,
+    should_abort: Optional[Callable[[], bool]] = None,
+) -> str:
+    """Compute the SHA256 digest of a file.
+
+    ``should_abort`` is checked between chunks so a UI Cancel during a large
+    model hash can stop before the file is installed.
+    """
     digest = hashlib.sha256()
     with open(filepath, "rb") as handle:
         for chunk in iter(lambda: handle.read(_HASH_CHUNK_BYTES), b""):
+            if should_abort is not None and should_abort():
+                raise RuntimeError("Download cancelled")
             digest.update(chunk)
     return digest.hexdigest()
 
@@ -116,6 +125,7 @@ def verify_downloaded_model(
     model_type: str,
     filename: str,
     strict: Optional[bool] = None,
+    should_abort: Optional[Callable[[], bool]] = None,
 ) -> None:
     """
     Check a downloaded model against its pinned digest.
@@ -126,10 +136,13 @@ def verify_downloaded_model(
         filename: Registry key for the model, e.g. "ggml-tiny.bin".
         strict: Refuse unpinned models. Defaults to the value of
             VOCALINUX_STRICT_MODEL_VERIFICATION.
+        should_abort: Optional callback checked between hash chunks. When it
+            returns True, raises RuntimeError("Download cancelled").
 
     Raises:
         ModelIntegrityError: If the size or digest does not match the pin, or if
             the model is unpinned and strict verification is enabled.
+        RuntimeError: If ``should_abort`` returns True while hashing.
     """
     if strict is None:
         strict = strict_mode_enabled()
@@ -154,7 +167,7 @@ def verify_downloaded_model(
             f"The download is incomplete or the file was replaced upstream."
         )
 
-    actual_sha256 = sha256_file(filepath)
+    actual_sha256 = sha256_file(filepath, should_abort=should_abort)
     if actual_sha256 != pinned["sha256"]:
         raise ModelIntegrityError(
             f"SHA256 mismatch for {filename}: expected {pinned['sha256']}, "

src/vocalinux/utils/vosk_model_info.py

@@ -251,7 +251,9 @@ def vosk_model_url(model_name: str) -> str:
             "ko": "vosk-model-small-ko-0.22",
             "fa": "vosk-model-fa-0.42",
             "pl": "vosk-model-small-pl-0.22",
-            "pt": "vosk-model-pt-0.4",
+            # Alphacephei never shipped vosk-model-pt-0.4 (404). The published
+            # medium/large Portuguese archive is the Facebook-trained zip.
+            "pt": "vosk-model-pt-fb-v0.1.1-20220516_2113",
             "ru": "vosk-model-ru-0.22",
             "es": "vosk-model-es-0.42",
             "sv": "vosk-model-small-sv-rhasspy-0.15",
@@ -279,7 +281,9 @@ def vosk_model_url(model_name: str) -> str:
             "ko": "vosk-model-small-ko-0.22",
             "fa": "vosk-model-fa-0.42",
             "pl": "vosk-model-small-pl-0.22",
-            "pt": "vosk-model-pt-0.4",
+            # Alphacephei never shipped vosk-model-pt-0.4 (404). The published
+            # medium/large Portuguese archive is the Facebook-trained zip.
+            "pt": "vosk-model-pt-fb-v0.1.1-20220516_2113",
             "ru": "vosk-model-ru-0.22",
             "es": "vosk-model-es-0.42",
             "sv": "vosk-model-small-sv-rhasspy-0.15",

tests/test_installer_model_verification.py

@@ -148,3 +148,18 @@ def test_absolute_path_is_refused(self, tmp_path):
 
         assert "FAIL" in result.stdout
         assert "unsafe paths" in result.stdout
+
+    def test_symlink_member_is_refused(self, tmp_path):
+        archive = tmp_path / "link.zip"
+        with zipfile.ZipFile(archive, "w") as zf:
+            info = zipfile.ZipInfo("model/link")
+            info.external_attr = (0xA000 | 0o777) << 16
+            zf.writestr(info, "/etc/passwd")
+
+        result = _run(
+            f'{_PRELUDE}\n{_source("verify_zip_members_safe")}\n'
+            f'verify_zip_members_safe "{archive}" && echo PASS || echo FAIL'
+        )
+
+        assert "FAIL" in result.stdout
+        assert "symlink" in result.stdout

tests/test_model_integrity.py

@@ -20,7 +20,7 @@
     strict_mode_enabled,
     verify_downloaded_model,
 )
-from vocalinux.utils.vosk_model_info import VOSK_MODEL_INFO
+from vocalinux.utils.vosk_model_info import VOSK_MODEL_INFO, vosk_model_url
 from vocalinux.utils.whisper_model_info import WHISPER_MODEL_URLS
 from vocalinux.utils.whispercpp_model_info import WHISPERCPP_MODEL_INFO
 
@@ -74,6 +74,13 @@ def test_whisper_digests_match_the_digest_embedded_in_the_url(self):
             url_digest = url.strip("/").split("/")[-2]
             assert get_pinned_digest("whisper", f"{size}.pt")["sha256"] == url_digest
 
+    def test_portuguese_medium_model_is_the_published_archive(self):
+        """vosk-model-pt-0.4 404s; Alphacephei ships the Facebook-trained zip."""
+        assert VOSK_MODEL_INFO["medium"]["languages"]["pt"] == (
+            "vosk-model-pt-fb-v0.1.1-20220516_2113"
+        )
+        assert get_pinned_digest("vosk", "vosk-model-pt-fb-v0.1.1-20220516_2113.zip")
+
     def test_entries_are_well_formed(self):
         registry = load_registry()
         for section in ("whispercpp", "whisper", "vosk"):
@@ -107,6 +114,19 @@ def test_matching_file_passes(self, pinned_file):
     def test_sha256_file_matches_hashlib(self, pinned_file):
         assert sha256_file(str(pinned_file)) == hashlib.sha256(pinned_file.read_bytes()).hexdigest()
 
+    def test_sha256_file_can_be_aborted(self, pinned_file):
+        with pytest.raises(RuntimeError, match="cancelled"):
+            sha256_file(str(pinned_file), should_abort=lambda: True)
+
+    def test_verify_can_be_aborted_while_hashing(self, pinned_file):
+        with pytest.raises(RuntimeError, match="cancelled"):
+            verify_downloaded_model(
+                str(pinned_file),
+                "whispercpp",
+                "ggml-test.bin",
+                should_abort=lambda: True,
+            )
+
     def test_tampered_contents_are_rejected(self, pinned_file):
         pinned_file.write_bytes(b"pretend model weight5")  # same length, different bytes
         with pytest.raises(ModelIntegrityError, match="SHA256 mismatch"):
@@ -175,6 +195,9 @@ def test_every_shipped_model_url_is_trusted(self):
             ensure_trusted_model_url(info["url"])
         for url in WHISPER_MODEL_URLS.values():
             ensure_trusted_model_url(url)
+        for tier in VOSK_MODEL_INFO.values():
+            for name in tier["languages"].values():
+                ensure_trusted_model_url(vosk_model_url(name))
 
 
 class TestSafeExtractZip:

tests/test_recognition_manager_downloads.py

@@ -446,6 +446,33 @@ def test_interruptible_pause_honours_cancel(self):
         with pytest.raises(RuntimeError, match="cancelled"):
             manager._interruptible_pause(1.0)
 
+    def test_verify_honours_cancel_before_hashing(self, tmp_path):
+        manager = _make_manager(engine="whisper_cpp")
+        manager._download_cancelled = True
+        model = tmp_path / "ggml-tiny.bin"
+        model.write_bytes(b"weights")
+        with pytest.raises(RuntimeError, match="cancelled"):
+            manager._verify_download_with_status(str(model), "whispercpp", "ggml-tiny.bin")
+
+    def test_verify_honours_cancel_during_hash(self, tmp_path):
+        manager = _make_manager(engine="whisper_cpp")
+        model = tmp_path / "ggml-tiny.bin"
+        model.write_bytes(b"weights")
+
+        def cancel_mid_hash(*_args, **_kwargs):
+            manager._download_cancelled = True
+            raise RuntimeError("Download cancelled")
+
+        with (
+            patch("time.sleep"),
+            patch(
+                "vocalinux.speech_recognition.recognition_manager.verify_downloaded_model",
+                side_effect=cancel_mid_hash,
+            ),
+        ):
+            with pytest.raises(RuntimeError, match="cancelled"):
+                manager._verify_download_with_status(str(model), "whispercpp", "ggml-tiny.bin")
+
 
 class TestDownloadIntegrityEnforcement:
     """The download paths must refuse artifacts that fail an integrity check."""
@@ -533,6 +560,30 @@ def test_vosk_download_refuses_archive_that_escapes_models_dir(self, tmp_path):
         assert not (tmp_path / "pwned.txt").exists()
         assert list(models_dir.iterdir()) == [], "the archive must be cleaned up"
 
+    def test_whispercpp_cancel_after_verify_does_not_install(self, tmp_path):
+        """Cancel during SHA256 verify must not rename the temp file into place."""
+        manager = _make_manager(engine="whisper_cpp")
+        manager.model_size = "tiny"
+        model_file = str(tmp_path / "ggml-tiny.bin")
+
+        def verify_then_cancel(*_args, **_kwargs):
+            manager._download_cancelled = True
+
+        with patch.dict("sys.modules", {"requests": self._mock_requests([b"payload"])}):
+            with patch(
+                "vocalinux.speech_recognition.recognition_manager.get_model_path",
+                return_value=model_file,
+            ):
+                with patch(
+                    "vocalinux.speech_recognition.recognition_manager.verify_downloaded_model",
+                    side_effect=verify_then_cancel,
+                ):
+                    with pytest.raises(RuntimeError, match="cancelled"):
+                        manager._download_whispercpp_model()
+
+        assert not os.path.exists(model_file)
+        assert not os.path.exists(model_file + ".tmp")
+
 
 class TestAudioReconnection:
     """Test audio reconnection logic."""