Prepare v1.5.2 release candidate

.github/workflows/snap.yml

@@ -114,7 +114,7 @@ jobs:
           fi
 
           if [[ ! "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
-            echo "::error::release_tag must be an existing version tag such as v1.5.1."
+            echo "::error::release_tag must be an existing version tag such as v1.5.2."
             exit 1
           fi
 

CHANGELOG.md

@@ -2,7 +2,15 @@
 
 ## Unreleased
 
-- **Cumulative App Contributor Credits** - The About window now credits John Maingi (`@JohnMaingi-IXP`), Jon Fuller (`@perfectra1n`), Cédric Prezelin (`@Tenshock`), and Cenkay Çoban (`@pastor0711`) from one packaged registry. Pull-request validation requires every accepted external human contributor in that registry before merge, and release smoke verifies the credits ship in every future version.
+## v1.5.2 - Camera Recovery and First Public v1.5 Release
+
+- **First Public v1.5 Build** - v1.5.2 supersedes the withdrawn v1.5.0 build and unpublished v1.5.1 candidate. It carries forward the tested native-upgrade helper, deterministic runtime ownership, device recovery, dependency floors, and artifact-provenance controls without requiring users to install an intermediate release.
+- **Exact-Mode Camera Recovery** - Linux cameras that advertise an unusable preferred MJPEG mode now retry another advertised encoding at the same resolution and frame rate before startup fails. Recovery ignores delayed errors from retired pipelines and remembers a format only after a valid frame arrives ([PR #76](https://github.com/Hkshoonya/nvidia-broadcast-linux/pull/76), contributed by Cédric Prezelin [`@Tenshock`](https://github.com/Tenshock)).
+- **Supported Source Python Selection** - Source installers select a compatible Python 3.11-3.13 interpreter, verify matching GTK, Libadwaita, and GStreamer bindings, recreate only an incompatible project environment, and provide package-manager-specific recovery guidance ([PR #80](https://github.com/Hkshoonya/nvidia-broadcast-linux/pull/80)).
+- **Tag-Pinned Snap Store Dispatches** - Every Store review, candidate, and stable action validates its release tag, source commit, and workflow ref before any build or upload; branch and mismatched-tag dispatches fail closed ([PR #79](https://github.com/Hkshoonya/nvidia-broadcast-linux/pull/79)).
+- **Cumulative App Contributor Credits** - The About window now credits John Maingi (`@JohnMaingi-IXP`), Jon Fuller (`@perfectra1n`), Cédric Prezelin (`@Tenshock`), and Cenkay Çoban (`@pastor0711`) from one packaged registry. Pull-request validation requires every accepted external human contributor in that registry before merge, and release smoke verifies the credits ship in every future version ([PR #81](https://github.com/Hkshoonya/nvidia-broadcast-linux/pull/81)).
+
+> Native-package users on `v1.4.0` or older must use the checksum-verified v1.5.2 release helper instead of invoking `apt`, `dpkg`, `dnf`, or `rpm` directly. Snap users update normally through the Store.
 
 ## v1.5.1 - Native Upgrade and Release Gate Hotfix
 
@@ -11,7 +19,7 @@
 - **Draft Release Isolation** - Tagged Snap review and candidate dispatches can no longer enter the GitHub release attachment job, and Snap attachment always preserves draft state. This closes the condition that briefly finalized the v1.5.0 draft during Store review.
 - **v1.5 Runtime and Recovery Work Included** - Deterministic CPU/CUDA ownership, fresh-process provider execution, microphone persistence, no-camera startup recovery, profile auto-start safety, Linux arm64 MediaPipe, and stricter artifact provenance remain included from v1.5.0.
 
-> Native-package users on `v1.4.0` or older must follow the v1.5.1 release-note upgrade procedure instead of invoking `apt`, `dpkg`, `dnf`, or `rpm` directly. Snap stable remains on v1.4.0 until the v1.5.1 candidate completes validation and soak.
+> v1.5.1 remained an unpublished GitHub draft and Snap candidate. Its tested changes are preserved in v1.5.2; native-package users on public v1.4.0 or older must follow the v1.5.2 upgrade procedure.
 
 ## v1.5.0 - Verified Runtimes, Safer Packaging, and Startup Recovery
 
@@ -24,7 +32,7 @@
 - **No-Camera Startup Recovery** - GUI and headless starts now stop cleanly with a useful status when no physical camera is available, instead of constructing a broken pipeline or virtual-camera session ([PR #70](https://github.com/Hkshoonya/nvidia-broadcast-linux/pull/70))
 - **Profile Auto-Start Opt-In** - Selecting a saved profile now starts the broadcast only when that profile's explicit opt-in ("Start broadcast when this profile is selected") is enabled, which defaults off and is set with a visible checkbox when saving the profile; profiles saved before this change never auto-start on selection. Launch-time auto-start remains governed solely by the application-level Auto Start setting, and a failed start (busy or missing camera) now leaves the window state aligned with the app instead of showing a phantom "Stop Broadcast" state.
 
-> v1.5.0 was withdrawn before Snap stable rollout after native-package lifecycle testing found a legacy upgrade blocker and incomplete uninstall cleanup. Use v1.5.1 after it is published.
+> v1.5.0 was withdrawn before Snap stable rollout after native-package lifecycle testing found a legacy upgrade blocker and incomplete uninstall cleanup. Its corrected work was carried through the unpublished v1.5.1 candidate and into v1.5.2.
 
 ## v1.4.0 - Global Controls, Gaze Lock, and Live Video Reliability Update
 

README.md

@@ -288,7 +288,7 @@ cd nvidia-broadcast-linux
 ```
 
 Requires an Apple Silicon Mac with macOS 13+, Homebrew, Python 3.11-3.13, and OBS Studio for virtual-camera output. The installer provisions GStreamer and GTK4 and can install OBS. After installing OBS, open it once, start and stop **Virtual Camera**, then close OBS so its camera backend is registered for NV Broadcast.
-CPU modes use CoreML acceleration. Intel macOS is not included in v1.5.1 because no secure current MediaPipe wheel is available for that architecture. GPU modes (Killer/Zeus/DocZeus/CUDA) are Linux-only and require an NVIDIA GPU.
+CPU modes use CoreML acceleration. Intel macOS is not included in v1.5.2 because no secure current MediaPipe wheel is available for that architecture. GPU modes (Killer/Zeus/DocZeus/CUDA) are Linux-only and require an NVIDIA GPU.
 
 ### Linux — Snap Package
 
@@ -301,7 +301,7 @@ Snap users typically receive background refreshes from `snapd`. When the app see
 The amd64 Snap build includes the CUDA mode runtime for NVIDIA systems. The arm64 Snap build stays CPU-safe because the required ONNX Runtime GPU wheels are not available for Linux arm64 yet. Background effects, virtual camera and microphone output, recording, and local meeting tools remain available. If CUDA modes are still unavailable on amd64 Snap, use the source installer, `.deb`, or `.rpm` release package as the fallback.
 
 Native `.deb` or `.rpm` users upgrading from v1.4.0 or older must use the
-`nvbroadcast-native-upgrade` asset shipped with v1.5.1 and later. Verify the
+`nvbroadcast-native-upgrade` asset shipped with v1.5.2 and later. Verify the
 helper and package against `SHA256SUMS.packages`, then follow
 [Verifying Release Artifacts](docs/RELEASE_VERIFICATION.md). The old package's
 pre-removal script runs before a newer package can replace it, so a direct
@@ -570,7 +570,7 @@ v4l2-ctl -d /dev/video0 --list-formats-ext   # Check supported resolutions
 ```
 nvidia-broadcast-linux/
 ├── src/nvbroadcast/
-│   ├── __init__.py              # Package version (1.5.1)
+│   ├── __init__.py              # Package version (1.5.2)
 │   ├── app.py                   # GTK4 app: modes, effects, pipeline management
 │   ├── vcam_service.py          # Headless virtual camera service
 │   ├── __main__.py              # CLI entry point
@@ -642,7 +642,7 @@ nvidia-broadcast-linux/
 ├── install_macos.sh             # macOS installer
 ├── uninstall.sh                 # Clean removal
 ├── build-packages.sh            # Debian/RPM/macOS package builder
-├── pyproject.toml               # Package config (v1.5.1)
+├── pyproject.toml               # Package config (v1.5.2)
 └── README.md
 ```
 

build-packages.sh

@@ -305,7 +305,7 @@ INSTALL_DIR="/opt/nvbroadcast"
 echo "[NV Broadcast] Setting up Python environment..."
 
 if [ "$(uname -m)" != "arm64" ]; then
-    echo "[NV Broadcast] ERROR: v1.5.1 supports Apple Silicon Macs only."
+    echo "[NV Broadcast] ERROR: v1.5.2 supports Apple Silicon Macs only."
     exit 1
 fi
 

data/com.doczeus.NVBroadcast.metainfo.xml

@@ -62,6 +62,18 @@
   <content_rating type="oars-1.1" />
 
   <releases>
+    <release version="1.5.2" date="2026-09-04">
+      <description>
+        <p>Camera recovery and first public v1.5 release</p>
+        <ul>
+          <li>Retried advertised camera encodings at the same resolution and frame rate when the preferred mode failed before producing a frame</li>
+          <li>Selected a supported Python 3.11-3.13 interpreter and validated matching desktop bindings for source installs</li>
+          <li>Required every Snap Store action to resolve to a validated release tag and source commit before build or upload</li>
+          <li>Added cumulative in-app contributor credits and a pull-request credit check</li>
+          <li>Carried forward the v1.5.1 safe native-upgrade helper, clean uninstall, verified runtimes, device recovery, and release provenance</li>
+        </ul>
+      </description>
+    </release>
     <release version="1.5.1" date="2026-08-28">
       <description>
         <p>Native upgrade and release gate hotfix</p>

docs/MACOS_VIRTUAL_CAMERA.md

@@ -4,7 +4,7 @@
 
 This directory contains a prototype CoreMediaIO Camera Extension. It is
 compile-checked in CI, but it is not distribution-signed, notarized, activated
-by the `.pkg`, or published as a release asset. NV Broadcast v1.5.1 uses
+by the `.pkg`, or published as a release asset. NV Broadcast v1.5.2 uses
 pyvirtualcam with OBS Virtual Camera as its supported macOS output path.
 
 A production extension can replace that backend after frame delivery, dynamic

docs/RELEASE_NOTES_1.5.2.md

@@ -0,0 +1,129 @@
+# NV Broadcast v1.5.2
+
+NV Broadcast v1.5.2 is the first public release in the v1.5 series. v1.5.0
+was withdrawn before stable rollout, and v1.5.1 remained a GitHub draft and
+Snap candidate while its native-upgrade, runtime, and packaging corrections
+were validated. v1.5.2 preserves all of that work and adds the reviewed changes
+merged afterward, so users do not need to install either intermediate build.
+
+## Camera startup recovery
+
+Some V4L2 cameras advertise an MJPEG mode that fails only when GStreamer asks
+the driver to allocate capture buffers. Earlier builds stopped the camera
+pipeline at that point even when the same camera advertised a working raw mode
+at the requested geometry.
+
+v1.5.2 now:
+
+- builds an ordered list of advertised formats for the exact requested
+  resolution and frame rate;
+- retries the next advertised encoding when the physical source fails before
+  producing its first valid frame;
+- preserves the requested frame rate, resolution, and output geometry;
+- ignores delayed errors from retired pipeline generations;
+- remembers a format only after a valid frame arrives, using a bounded
+  process-local cache; and
+- retains the complete GStreamer diagnostic when every advertised candidate
+  fails.
+
+This recovery was contributed by Cédric Prezelin
+([`@Tenshock`](https://github.com/Tenshock)) in
+[PR #76](https://github.com/Hkshoonya/nvidia-broadcast-linux/pull/76).
+
+## Source installation reliability
+
+The source installer now discovers supported CPython interpreters in the order
+3.13, 3.12, then 3.11, or accepts an explicit `--python` path. It verifies
+`venv` and `ensurepip`, then checks that GTK4, Libadwaita, and GStreamer Python
+bindings match the selected interpreter after distro packages are installed.
+
+Only the project-owned `.venv` is recreated when its base interpreter or
+CPU/CUDA runtime owner is incompatible. The installer does not replace the
+system Python or add a third-party package repository, and unsupported setups
+stop with package-manager-specific recovery guidance instead of reporting a
+partially working installation.
+
+## Included v1.5 improvements
+
+v1.5.2 includes the complete v1.5.1 candidate and its corrected v1.5 runtime:
+
+- one managed CPU or CUDA ONNX Runtime distribution owner per environment;
+- pinned fresh-process CPU, CUDA, and TensorRT execution probes that reject
+  silent CPU fallback where GPU execution is required;
+- saved microphone restoration and live audio-pipeline rebuilding;
+- clean GUI and headless handling when no physical camera is available;
+- explicit per-profile auto-start with failure-safe visible controls;
+- MediaPipe 1.0.0 face effects on Linux arm64;
+- enforced OpenCV, Protobuf, Pillow, and development dependency security
+  floors;
+- clean final DEB and RPM removal of installer-generated runtime and build
+  files; and
+- package checksums plus GitHub provenance attestations for tag-built release
+  artifacts.
+
+## Required native-package upgrade path
+
+Public DEB and RPM releases through v1.4.0 contain legacy pre-removal scripts
+that can terminate their own package transaction. Those scripts run before a
+new package can replace them. For that reason, users upgrading an existing
+native v1.4.0 or older installation must use the release asset named
+`nvbroadcast-native-upgrade`.
+
+1. Download the v1.5.2 DEB or RPM, `nvbroadcast-native-upgrade`, and
+   `SHA256SUMS.packages` from the same GitHub Release.
+2. Verify both downloaded files against `SHA256SUMS.packages` and, where the
+   GitHub CLI is available, verify their build attestations as described in
+   [Verifying Release Artifacts](RELEASE_VERIFICATION.md).
+3. Make the helper executable and pass it the downloaded package:
+
+   ```bash
+   chmod 755 ./nvbroadcast-native-upgrade
+   sudo ./nvbroadcast-native-upgrade ./nvbroadcast_1.5.2-1_all.deb
+   ```
+
+   Fedora users pass the RPM instead:
+
+   ```bash
+   chmod 755 ./nvbroadcast-native-upgrade
+   sudo ./nvbroadcast-native-upgrade ./nvbroadcast-1.5.2-1.noarch.rpm
+   ```
+
+Do not invoke `apt`, `dpkg`, `dnf`, or `rpm` directly for an upgrade from an
+affected native v1.4.0 or older installation. Do not mix a helper and package
+from different releases. The v1.5.2 helper is generated from the exact release
+artifacts, embeds their SHA-256 hashes, copies the selected package into a
+root-owned temporary directory, and validates its identity, version, release,
+and architecture before invoking the package manager.
+
+Clean native v1.5.2 installations may use the normal package-manager command.
+Snap users update normally through the Store and do not use this helper.
+
+## Release and contributor safeguards
+
+- Every Snap Store review, candidate, and stable action must resolve to an
+  existing release tag and matching source commit before any build or upload.
+  Branch, mismatched-tag, and mismatched-source dispatches fail closed.
+- Tag workflows preserve the GitHub Release as a draft. Publishing the GitHub
+  Release and moving both Snap architectures to stable remain explicit actions
+  after artifact inspection and candidate testing.
+- Contributor credits are cumulative and packaged in the application. The
+  About window credits John Maingi (`@JohnMaingi-IXP`), Jon Fuller
+  (`@perfectra1n`), Cédric Prezelin (`@Tenshock`), and Cenkay Çoban
+  (`@pastor0711`), and pull-request validation prevents a future release from
+  silently dropping an accepted external contributor.
+
+## Validation and remaining boundary
+
+The unpublished v1.5.1 Snap candidate completed more than seven days of soak.
+Because v1.5.2 changes physical-camera startup, the exact v1.5.2 Snap revisions
+must complete a fresh 72-hour candidate soak, including no-camera and
+busy-camera recovery, live source changes, processing-mode changes, auto
+framing, difficult lighting, and hair-edge behavior, before stable promotion.
+
+This release does not close the broader supply-chain work in
+[Issue #60](https://github.com/Hkshoonya/nvidia-broadcast-linux/issues/60).
+Native installers still resolve part of their Python environment online,
+native artifacts are not independently reproducible, a complete SBOM is not
+yet published, and RPM signing plus macOS signing/notarization remain open.
+Intel macOS is also not included because a secure current MediaPipe wheel is
+not available for that architecture; the macOS package supports Apple Silicon.

docs/index.html

@@ -1418,7 +1418,7 @@ <h2 class="section-title reveal">One command, any distro</h2>
             <div class="terminal-line"><span class="comment"># v1.4.0 and older: use the verified release helper for future upgrades</span></div>
           </div>
         </div>
-        <p class="install-note">For Ubuntu, Debian, Pop!_OS, Linux Mint, and derivatives. Native v1.4.0 and older installations must use the checksum-verified upgrade helper included with v1.5.1 and later releases. <a href="https://github.com/Hkshoonya/nvidia-broadcast-linux/blob/main/docs/RELEASE_VERIFICATION.md" target="_blank" rel="noopener">Read the verified upgrade steps</a></p>
+        <p class="install-note">For Ubuntu, Debian, Pop!_OS, Linux Mint, and derivatives. Native v1.4.0 and older installations must use the checksum-verified upgrade helper included with v1.5.2 and later releases. <a href="https://github.com/Hkshoonya/nvidia-broadcast-linux/blob/main/docs/RELEASE_VERIFICATION.md" target="_blank" rel="noopener">Read the verified upgrade steps</a></p>
       </div>
 
       <!-- RPM -->
@@ -1438,7 +1438,7 @@ <h2 class="section-title reveal">One command, any distro</h2>
             <div class="terminal-line"><span class="comment"># v1.4.0 and older: use the verified release helper for future upgrades</span></div>
           </div>
         </div>
-        <p class="install-note">For Fedora, RHEL, CentOS, and Rocky. Native v1.4.0 and older installations must use the checksum-verified upgrade helper included with v1.5.1 and later releases. <a href="https://github.com/Hkshoonya/nvidia-broadcast-linux/blob/main/docs/RELEASE_VERIFICATION.md" target="_blank" rel="noopener">Read the verified upgrade steps</a></p>
+        <p class="install-note">For Fedora, RHEL, CentOS, and Rocky. Native v1.4.0 and older installations must use the checksum-verified upgrade helper included with v1.5.2 and later releases. <a href="https://github.com/Hkshoonya/nvidia-broadcast-linux/blob/main/docs/RELEASE_VERIFICATION.md" target="_blank" rel="noopener">Read the verified upgrade steps</a></p>
       </div>
 
       <!-- Snap -->

install_macos.sh

@@ -32,7 +32,7 @@ fi
 
 MACOS_ARCH=$(uname -m)
 if [[ "$MACOS_ARCH" != "arm64" ]]; then
-    echo -e "${RED}Error: v1.5.1 supports Apple Silicon Macs only.${NC}"
+    echo -e "${RED}Error: v1.5.2 supports Apple Silicon Macs only.${NC}"
     echo "A secure current MediaPipe wheel is not available for Intel macOS."
     exit 1
 fi

packaging/debian/changelog

@@ -1,3 +1,15 @@
+nvbroadcast (1.5.2-1) unstable; urgency=high
+
+  * Retry exact camera modes with another advertised encoding when the
+    preferred format fails before its first frame.
+  * Select and validate a fully supported Python for source installations.
+  * Pin Snap Store actions to a validated release tag and source commit.
+  * Add cumulative in-app contributor credits and merge validation.
+  * Carry forward safe native upgrades, clean uninstall, verified runtimes,
+    device recovery, and artifact provenance from the v1.5.1 candidate.
+
+ -- DocZeus <harshit@kshoonya.com>  Fri, 04 Sep 2026 12:00:00 -0400
+
 nvbroadcast (1.5.1-1) unstable; urgency=high
 
   * Add a hash-bound helper for upgrades from affected legacy DEB and RPM