# Distribution status

Where each channel sits relative to the **goal of "free + fast + on every
computer"**. Updated 2026-05-15 (v0.3.0).

## v0.3.0 release (2026-05-15)

GitHub release live: https://github.com/novafabric/novavoice/releases/tag/v0.3.0  
Tag pushed. Distribution channels below still carry v0.2.x; they need a separate publish action per channel.

## Live now

| Channel | Install | Setup state |
|---|---|---|
| **PyPI** | `pip install novavoice` (or `pipx install novavoice`) | ✅ 0.2.0 published |
| **Homebrew** (macOS) | `brew tap novafabric/novavoice && brew install --cask novavoice` | ✅ Tap live at [`novafabric/homebrew-novavoice`](https://github.com/novafabric/homebrew-novavoice) |
| **GitHub Release** | Download `.deb` / `.dmg` / `.exe` from [v0.2.0](https://github.com/novafabric/novavoice/releases/tag/v0.2.0) | ✅ All three platform installers attached |
| **APT repo (apt.novafabric.io)** | per `README.md` snippet | ✅ Live (existing pipeline) |

## In flight (PR / queue)

| Channel | Status |
|---|---|
| **winget** (Windows) | ⏳ PR submitted: [microsoft/winget-pkgs#371427](https://github.com/microsoft/winget-pkgs/pull/371427). After merge: `winget install NovaFabric.NovaVoice`. Validation typically 1–3 days; expect a CLA-sign nudge from the bot. |

## Ready to publish — needs your hands

| Channel | What's needed | ETA after action |
|---|---|---|
| **Snap Store** | Set `SNAPCRAFT_STORE_CREDENTIALS` repo secret (run `snapcraft export-login`, paste output as the secret value). The build itself now works — a `.snap` artefact is uploaded on every workflow run; you can already `sudo snap install --dangerous novavoice_*.snap` from a downloaded artefact. | Within minutes of secret + workflow re-run. |
| **AUR** (Arch Linux) | Create AUR account at https://aur.archlinux.org, push `packaging/arch/PKGBUILD` to `ssh://aur@aur.archlinux.org/novavoice.git`. Full steps in `packaging/arch/README.md`. | Visible to AUR helpers within minutes of push. |
| **Launchpad PPA** (Ubuntu) | Set `PPA_GPG_PRIVATE_KEY` (full ASCII-armored secret key) + `PPA_GPG_KEY_ID` repo secrets. Re-run the `Launchpad PPA` workflow on the v0.2.0 tag. | Within minutes once secrets are valid. |
| **Custom APT repo** | Same root cause — set `APT_REPO_GPG_PRIVATE_KEY` + `APT_REPO_GPG_KEY_ID`. | Within minutes. |

## Trust improvements (eliminate Gatekeeper / SmartScreen warnings)

| Channel | Cost | What's needed |
|---|---|---|
| **macOS code signing + notarisation** | $99/yr Apple Developer Program | Enroll, generate Developer ID cert, add as `MACOS_CERTIFICATE` (base64-encoded `.p12`) + `MACOS_CERTIFICATE_PWD` + Apple ID notarisation creds (`AC_USERNAME`, `AC_PASSWORD`, `AC_PROVIDER`) in repo secrets. Then the build-macos workflow signs + notarises automatically. |
| **Windows code signing** | Free for OSS via [SignPath.io](https://about.signpath.io/foundation) (or paid OV/EV cert) | Apply at https://about.signpath.io/foundation; once approved, integrate via `SignPath/GitHub-Action`. EV cert (~$200+/yr) gets instant SmartScreen reputation; SignPath OV needs a few hundred installs to build trust. |

## Future Linux channels (deferred)

- **AppImage** — universal `.AppImage` portable binary. Useful as a fallback for distros without snap/apt. Daemon model fits awkwardly (closing the AppImage closes the daemon) but works for "launch on demand" use.
- **RPM / copr** — Fedora / RHEL / openSUSE users. Moderate effort: `.spec` file + a Fedora copr build target.
- **Flatpak** — sandbox blocks direct `/dev/input` access; would need a `--device=input` permission grant and is awkward UX. Low priority.

## Recommended next steps — priority order

Six items remain to take NovaVoice from "v0.2.0 shipped" to "free + fast + on every computer". Ordered by impact-per-minute.

### Tomorrow morning — fastest wins (10–30 min each)

1. **winget CLA + PR feedback** — sign Microsoft's CLA when the bot pings on
   [microsoft/winget-pkgs#371427](https://github.com/microsoft/winget-pkgs/pull/371427)
   and respond to any validation comments. After merge, every Windows user
   gets `winget install NovaFabric.NovaVoice`. Highest impact-per-minute on
   this list.
2. **Snap Store credentials** — `snapcraft export-login` locally; paste the
   output as the `SNAPCRAFT_STORE_CREDENTIALS` repo secret; re-dispatch the
   `Snap` workflow. Unlocks `sudo snap install novavoice` across most Linux
   desktops.
3. **AUR push** — follow `packaging/arch/README.md`: AUR account → SSH key →
   `git push` to `aur@aur.archlinux.org/novavoice.git`. Unlocks
   `yay -S novavoice` on Arch / Manjaro / EndeavourOS.

### This week — eliminate first-launch warnings

4. **SignPath OSS application** ([about.signpath.io/foundation](https://about.signpath.io/foundation))
   — free for OSS, ~1–3 day approval. Eliminates Windows SmartScreen warning
   on first launch. Walkthrough in `docs/windows-signing.md`.
5. **Apple Developer Program** ($99/yr, instant) + Developer ID cert + six
   GitHub secrets. Eliminates macOS Gatekeeper warning permanently.
   Walkthrough in `docs/macos-signing.md`.

### One-time fix (10 min)

6. **PPA + apt-repo GPG secrets** — set `PPA_GPG_PRIVATE_KEY` /
   `PPA_GPG_KEY_ID` and `APT_REPO_GPG_PRIVATE_KEY` / `APT_REPO_GPG_KEY_ID` to
   the full `gpg --export-secret-keys --armor` output (not the key ID).
   Restores two Linux channels.

### Solo work Claude can pick up next session (in priority order)

- **Pre-bundle `tiny.en` in the installers** — first dictation goes from
  ~10s to instant; +80 MB installer size. Biggest UX win still available.
- **Hero GIF demo for the README** — recording script + screenshot
  guidance. Drives GitHub stars / discoverability.
- **`install.sh` rewrite to detect OS** — single `curl | bash` one-liner
  that picks the right install path per OS.
- **Model pre-warm in tray's poll thread** — first-hold latency drops to
  near zero.
- **RPM `.spec` + Fedora copr workflow** — covers Fedora / RHEL / openSUSE.

### If you can only do one thing tomorrow

**Item #1 (winget).** It's already half-shipped (PR open, manifests valid,
SHA pinned). It needs ~10 min of your attention to land in front of every
Windows user globally.

---

## What CI verifies on every push

| Check | Where it runs |
|---|---|
| Unit tests (64) | `ubuntu-latest`, `macos-latest`, `windows-latest` × Python 3.11 + 3.12 |
| `.deb` build | `ubuntu-latest` (only on tag pushes via Release workflow) |
| `.dmg` build | `macos-latest` (tag pushes, mac-touching PRs, manual dispatch) |
| `.exe` build | `windows-latest` (tag pushes, win-touching PRs, manual dispatch) |
| `.snap` build | `ubuntu-latest` (tag pushes, manual dispatch) |
| Release attach | `softprops/action-gh-release@v2` — auto-attaches to GH Release on tag pushes |