sing-box-python 1.13.18__tar.gz → 1.13.19__tar.gz

{sing_box_python-1.13.18 → sing_box_python-1.13.19}/MANIFEST.in

@@ -7,3 +7,5 @@ include LICENSE
 include README.md
 include pyproject.toml
 include setup.py
+include UPSTREAM_COMMIT
+include UPSTREAM_VERSION

{sing_box_python-1.13.18/sing_box_python.egg-info → sing_box_python-1.13.19}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sing-box-python
-Version: 1.13.18
+Version: 1.13.19
 Summary: Python binding for sing-box
 License: GPL-3.0-or-later
 Project-URL: Source, https://github.com/LorenEteval/sing-box-python
@@ -157,19 +157,45 @@ DATA
     __all__ = ['SingBox', 'SingBoxError', '__version__', 'startFromJSON']
 
 VERSION
-    v1.13.18
+    vX.Y.Z
 ```
 
-## Source Code Modification
+## Vendored Upstream Source
 
-This repository, including the package that distributes to pypi,
-contains [sing-box](https://github.com/SagerNet/sing-box) source code and the additional binding code required to build
-the Python extension and its API.
+This repository and its PyPI source distribution contain a vendored copy of
+[sing-box](https://github.com/SagerNet/sing-box). Vendoring keeps source installs independent of Git submodule support.
+All regular files under `singbox-go` come directly from the upstream release except these explicit additions:
 
-To make installation of this package easier, the original [sing-box](https://github.com/SagerNet/sing-box) source code
-is embedded instead of being added as a submodule. The official source files are unchanged. The binding is implemented
-by the added `singbox-go/binding` package and the C++/Python packaging files in this repository. To track the difference,
-compare `singbox-go` with the upstream commit while excluding the added `binding` directory.
+* `singbox-go/binding/main.go`
+* `singbox-go/binding/cronet_purego.go`
+
+Upstream's `clients/android` and `clients/apple` Git submodule links are intentionally not vendored because they are not
+used to build the Python package. The initial Windows import normalized executable bits on upstream shell scripts; file
+paths and blob contents remain identical to upstream. Synchronization runs on Linux and preserves upstream modes.
+
+### Upstream Release Synchronization
+
+`.github/workflows/sync-upstream.yml` checks the latest stable upstream release daily and can also be started manually
+from the Actions page. Drafts and prereleases are rejected. `UPSTREAM_VERSION` is the single version source for both the
+Python distribution version and the sing-box version embedded in the native library, while `UPSTREAM_COMMIT` pins the
+commit to which that release tag resolved during import.
+
+The synchronization script checks the current vendor tree against its exact upstream tag, fetches the requested tag,
+replaces only upstream-owned files, restores the two binding additions, updates `UPSTREAM_VERSION`, and verifies every
+vendored upstream path and Git blob. Repeated checks are no-ops when the stable release is already synchronized.
+
+Run the same operations locally from the repository root:
+
+```shell
+python scripts/sync-sing-box.py check
+python scripts/sync-sing-box.py verify --tag v1.13.18
+python scripts/sync-sing-box.py sync --tag vX.Y.Z
+```
+
+For an automated update, the sync workflow commits `chore: sync sing-box vX.Y.Z` to `main`, then explicitly dispatches
+the existing build-and-publish workflow at that commit. The latter builds and tests every distribution before creating
+the `vX.Y.Z` tag, publishing `X.Y.Z` to PyPI through Trusted Publishing, and creating the GitHub Release. Explicit
+dispatch is required because pushes made with GitHub's `GITHUB_TOKEN` do not trigger new push workflows.
 
 ## Binary Wheel Platforms
 
@@ -186,7 +212,7 @@ The distributions are built and tested in [GitHub Actions](https://github.com/Lo
 
 Naive outbound is included on all wheel platforms in the table. Cronet is bundled as an isolated shared runtime on
 macOS, Linux, and Windows. The macOS runtime is produced from the pinned static archive during the wheel build. The
-Cronet artifact comes from the platform module and exact version already pinned by sing-box v1.13.18's `go.mod` and
+Cronet artifact comes from the platform module and exact version already pinned by the vendored sing-box `go.mod` and
 verified by `go.sum`; the workflow does not build an unrelated Cronet revision.
 Custom source builds can override the complete sing-box tag list with the `SINGBOX_BUILD_TAGS` environment variable.
 

{sing_box_python-1.13.18 → sing_box_python-1.13.19}/README.md

@@ -130,19 +130,45 @@ DATA
     __all__ = ['SingBox', 'SingBoxError', '__version__', 'startFromJSON']
 
 VERSION
-    v1.13.18
+    vX.Y.Z
 ```
 
-## Source Code Modification
+## Vendored Upstream Source
 
-This repository, including the package that distributes to pypi,
-contains [sing-box](https://github.com/SagerNet/sing-box) source code and the additional binding code required to build
-the Python extension and its API.
+This repository and its PyPI source distribution contain a vendored copy of
+[sing-box](https://github.com/SagerNet/sing-box). Vendoring keeps source installs independent of Git submodule support.
+All regular files under `singbox-go` come directly from the upstream release except these explicit additions:
 
-To make installation of this package easier, the original [sing-box](https://github.com/SagerNet/sing-box) source code
-is embedded instead of being added as a submodule. The official source files are unchanged. The binding is implemented
-by the added `singbox-go/binding` package and the C++/Python packaging files in this repository. To track the difference,
-compare `singbox-go` with the upstream commit while excluding the added `binding` directory.
+* `singbox-go/binding/main.go`
+* `singbox-go/binding/cronet_purego.go`
+
+Upstream's `clients/android` and `clients/apple` Git submodule links are intentionally not vendored because they are not
+used to build the Python package. The initial Windows import normalized executable bits on upstream shell scripts; file
+paths and blob contents remain identical to upstream. Synchronization runs on Linux and preserves upstream modes.
+
+### Upstream Release Synchronization
+
+`.github/workflows/sync-upstream.yml` checks the latest stable upstream release daily and can also be started manually
+from the Actions page. Drafts and prereleases are rejected. `UPSTREAM_VERSION` is the single version source for both the
+Python distribution version and the sing-box version embedded in the native library, while `UPSTREAM_COMMIT` pins the
+commit to which that release tag resolved during import.
+
+The synchronization script checks the current vendor tree against its exact upstream tag, fetches the requested tag,
+replaces only upstream-owned files, restores the two binding additions, updates `UPSTREAM_VERSION`, and verifies every
+vendored upstream path and Git blob. Repeated checks are no-ops when the stable release is already synchronized.
+
+Run the same operations locally from the repository root:
+
+```shell
+python scripts/sync-sing-box.py check
+python scripts/sync-sing-box.py verify --tag v1.13.18
+python scripts/sync-sing-box.py sync --tag vX.Y.Z
+```
+
+For an automated update, the sync workflow commits `chore: sync sing-box vX.Y.Z` to `main`, then explicitly dispatches
+the existing build-and-publish workflow at that commit. The latter builds and tests every distribution before creating
+the `vX.Y.Z` tag, publishing `X.Y.Z` to PyPI through Trusted Publishing, and creating the GitHub Release. Explicit
+dispatch is required because pushes made with GitHub's `GITHUB_TOKEN` do not trigger new push workflows.
 
 ## Binary Wheel Platforms
 
@@ -159,7 +185,7 @@ The distributions are built and tested in [GitHub Actions](https://github.com/Lo
 
 Naive outbound is included on all wheel platforms in the table. Cronet is bundled as an isolated shared runtime on
 macOS, Linux, and Windows. The macOS runtime is produced from the pinned static archive during the wheel build. The
-Cronet artifact comes from the platform module and exact version already pinned by sing-box v1.13.18's `go.mod` and
+Cronet artifact comes from the platform module and exact version already pinned by the vendored sing-box `go.mod` and
 verified by `go.sum`; the workflow does not build an unrelated Cronet revision.
 Custom source builds can override the complete sing-box tag list with the `SINGBOX_BUILD_TAGS` environment variable.
 

sing_box_python-1.13.19/UPSTREAM_COMMIT

@@ -0,0 +1 @@
+b5ebaa1fc0f2b94256180b95468e73ef53caa27d

sing_box_python-1.13.19/UPSTREAM_VERSION

@@ -0,0 +1 @@
+v1.13.19

{sing_box_python-1.13.18 → sing_box_python-1.13.19}/pyproject.toml

@@ -10,17 +10,14 @@ build-backend = "setuptools.build_meta"
 
 [tool.cibuildwheel]
 build = [
-    "cp38-*",
     "cp39-*",
     "cp310-*",
     "cp311-*",
     "cp312-*",
     "cp313-*",
-    "cp313t-*",
     "cp314-*",
     "cp314t-*",
 ]
-enable = ["cpython-freethreading"]
 skip = "*-musllinux_*"
 build-verbosity = 1
 test-requires = ["pytest>=8"]

{sing_box_python-1.13.18 → sing_box_python-1.13.19}/setup.py

@@ -2,6 +2,7 @@ import json
 import os
 import pathlib
 import platform
+import re
 import shlex
 import shutil
 import subprocess
@@ -13,8 +14,12 @@ from setuptools.command.build_ext import build_ext
 
 ROOT_DIR = pathlib.Path(__file__).parent.resolve()
 GO_SOURCE_DIR = ROOT_DIR / 'singbox-go'
-PACKAGE_VERSION = '1.13.18'
-UPSTREAM_VERSION = 'v1.13.18'
+UPSTREAM_VERSION = (ROOT_DIR / 'UPSTREAM_VERSION').read_text(encoding='utf-8').strip()
+
+if not re.fullmatch(r'v\d+\.\d+\.\d+', UPSTREAM_VERSION):
+    raise RuntimeError(f'Invalid upstream version: {UPSTREAM_VERSION!r}')
+
+PACKAGE_VERSION = UPSTREAM_VERSION[1:]
 
 
 class CMakeExtension(Extension):

{sing_box_python-1.13.18 → sing_box_python-1.13.19/sing_box_python.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sing-box-python
-Version: 1.13.18
+Version: 1.13.19
 Summary: Python binding for sing-box
 License: GPL-3.0-or-later
 Project-URL: Source, https://github.com/LorenEteval/sing-box-python
@@ -157,19 +157,45 @@ DATA
     __all__ = ['SingBox', 'SingBoxError', '__version__', 'startFromJSON']
 
 VERSION
-    v1.13.18
+    vX.Y.Z
 ```
 
-## Source Code Modification
+## Vendored Upstream Source
 
-This repository, including the package that distributes to pypi,
-contains [sing-box](https://github.com/SagerNet/sing-box) source code and the additional binding code required to build
-the Python extension and its API.
+This repository and its PyPI source distribution contain a vendored copy of
+[sing-box](https://github.com/SagerNet/sing-box). Vendoring keeps source installs independent of Git submodule support.
+All regular files under `singbox-go` come directly from the upstream release except these explicit additions:
 
-To make installation of this package easier, the original [sing-box](https://github.com/SagerNet/sing-box) source code
-is embedded instead of being added as a submodule. The official source files are unchanged. The binding is implemented
-by the added `singbox-go/binding` package and the C++/Python packaging files in this repository. To track the difference,
-compare `singbox-go` with the upstream commit while excluding the added `binding` directory.
+* `singbox-go/binding/main.go`
+* `singbox-go/binding/cronet_purego.go`
+
+Upstream's `clients/android` and `clients/apple` Git submodule links are intentionally not vendored because they are not
+used to build the Python package. The initial Windows import normalized executable bits on upstream shell scripts; file
+paths and blob contents remain identical to upstream. Synchronization runs on Linux and preserves upstream modes.
+
+### Upstream Release Synchronization
+
+`.github/workflows/sync-upstream.yml` checks the latest stable upstream release daily and can also be started manually
+from the Actions page. Drafts and prereleases are rejected. `UPSTREAM_VERSION` is the single version source for both the
+Python distribution version and the sing-box version embedded in the native library, while `UPSTREAM_COMMIT` pins the
+commit to which that release tag resolved during import.
+
+The synchronization script checks the current vendor tree against its exact upstream tag, fetches the requested tag,
+replaces only upstream-owned files, restores the two binding additions, updates `UPSTREAM_VERSION`, and verifies every
+vendored upstream path and Git blob. Repeated checks are no-ops when the stable release is already synchronized.
+
+Run the same operations locally from the repository root:
+
+```shell
+python scripts/sync-sing-box.py check
+python scripts/sync-sing-box.py verify --tag v1.13.18
+python scripts/sync-sing-box.py sync --tag vX.Y.Z
+```
+
+For an automated update, the sync workflow commits `chore: sync sing-box vX.Y.Z` to `main`, then explicitly dispatches
+the existing build-and-publish workflow at that commit. The latter builds and tests every distribution before creating
+the `vX.Y.Z` tag, publishing `X.Y.Z` to PyPI through Trusted Publishing, and creating the GitHub Release. Explicit
+dispatch is required because pushes made with GitHub's `GITHUB_TOKEN` do not trigger new push workflows.
 
 ## Binary Wheel Platforms
 
@@ -186,7 +212,7 @@ The distributions are built and tested in [GitHub Actions](https://github.com/Lo
 
 Naive outbound is included on all wheel platforms in the table. Cronet is bundled as an isolated shared runtime on
 macOS, Linux, and Windows. The macOS runtime is produced from the pinned static archive during the wheel build. The
-Cronet artifact comes from the platform module and exact version already pinned by sing-box v1.13.18's `go.mod` and
+Cronet artifact comes from the platform module and exact version already pinned by the vendored sing-box `go.mod` and
 verified by `go.sum`; the workflow does not build an unrelated Cronet revision.
 Custom source builds can override the complete sing-box tag list with the `SINGBOX_BUILD_TAGS` environment variable.
 

{sing_box_python-1.13.18 → sing_box_python-1.13.19}/sing_box_python.egg-info/SOURCES.txt

@@ -2,6 +2,8 @@ CMakeLists.txt
 LICENSE
 MANIFEST.in
 README.md
+UPSTREAM_COMMIT
+UPSTREAM_VERSION
 pyproject.toml
 setup.py
 sing_box_python.egg-info/PKG-INFO
@@ -252,6 +254,7 @@ singbox-go/common/srs/binary.go
 singbox-go/common/srs/compat_test.go
 singbox-go/common/srs/ip_cidr.go
 singbox-go/common/srs/ip_set.go
+singbox-go/common/srs/malformed_test.go
 singbox-go/common/taskmonitor/monitor.go
 singbox-go/common/tls/acme.go
 singbox-go/common/tls/acme_contstant.go

{sing_box_python-1.13.18 → sing_box_python-1.13.19}/singbox-go/.github/workflows/build.yml

@@ -1105,16 +1105,10 @@ jobs:
         if: matrix.if && matrix.type != 'jailbreak'
         run: |-
           PROFILES_ZIP_PATH=$RUNNER_TEMP/AppleProvisioningProfiles.zip
-          printf '%s%s%s%s%s%s%s%s' \
-            "$PROVISIONING_PROFILES_1" \
-            "$PROVISIONING_PROFILES_2" \
-            "$PROVISIONING_PROFILES_3" \
-            "$PROVISIONING_PROFILES_4" \
-            "$PROVISIONING_PROFILES_5" \
-            "$PROVISIONING_PROFILES_6" \
-            "$PROVISIONING_PROFILES_7" \
-            "$PROVISIONING_PROFILES_8" \
-            | base64 --decode -o $PROFILES_ZIP_PATH
+          for index in $(seq 1 16); do
+            variable="PROVISIONING_PROFILES_$index"
+            printf '%s' "${!variable}"
+          done | base64 --decode -o $PROFILES_ZIP_PATH
           PROFILES_PATH="$HOME/Library/Developer/Xcode/UserData/Provisioning Profiles"
           mkdir -p "$PROFILES_PATH"
           unzip -q $PROFILES_ZIP_PATH -d "$PROFILES_PATH"
@@ -1127,6 +1121,14 @@ jobs:
           PROVISIONING_PROFILES_6: ${{ secrets.APPLE_PROVISIONING_PROFILES_6 }}
           PROVISIONING_PROFILES_7: ${{ secrets.APPLE_PROVISIONING_PROFILES_7 }}
           PROVISIONING_PROFILES_8: ${{ secrets.APPLE_PROVISIONING_PROFILES_8 }}
+          PROVISIONING_PROFILES_9: ${{ secrets.APPLE_PROVISIONING_PROFILES_9 }}
+          PROVISIONING_PROFILES_10: ${{ secrets.APPLE_PROVISIONING_PROFILES_10 }}
+          PROVISIONING_PROFILES_11: ${{ secrets.APPLE_PROVISIONING_PROFILES_11 }}
+          PROVISIONING_PROFILES_12: ${{ secrets.APPLE_PROVISIONING_PROFILES_12 }}
+          PROVISIONING_PROFILES_13: ${{ secrets.APPLE_PROVISIONING_PROFILES_13 }}
+          PROVISIONING_PROFILES_14: ${{ secrets.APPLE_PROVISIONING_PROFILES_14 }}
+          PROVISIONING_PROFILES_15: ${{ secrets.APPLE_PROVISIONING_PROFILES_15 }}
+          PROVISIONING_PROFILES_16: ${{ secrets.APPLE_PROVISIONING_PROFILES_16 }}
       - name: Setup Apple Development certificate
         if: matrix.if && matrix.type != 'jailbreak'
         run: |-

{sing_box_python-1.13.18 → sing_box_python-1.13.19}/singbox-go/adapter/experimental.go

@@ -7,6 +7,7 @@ import (
 	"io"
 	"time"
 
+	E "github.com/sagernet/sing/common/exceptions"
 	"github.com/sagernet/sing/common/observable"
 	"github.com/sagernet/sing/common/varbin"
 )
@@ -103,6 +104,9 @@ func (s *SavedBinary) UnmarshalBinary(data []byte) error {
 	if err != nil {
 		return err
 	}
+	if contentLength > uint64(reader.Len()) {
+		return E.New("invalid content length: ", contentLength)
+	}
 	s.Content = make([]byte, contentLength)
 	_, err = io.ReadFull(reader, s.Content)
 	if err != nil {
@@ -118,6 +122,9 @@ func (s *SavedBinary) UnmarshalBinary(data []byte) error {
 	if err != nil {
 		return err
 	}
+	if etagLength > uint64(reader.Len()) {
+		return E.New("invalid etag length: ", etagLength)
+	}
 	etagBytes := make([]byte, etagLength)
 	_, err = io.ReadFull(reader, etagBytes)
 	if err != nil {

{sing_box_python-1.13.18 → sing_box_python-1.13.19}/singbox-go/cmd/internal/update_apple_version/main.go

@@ -8,6 +8,7 @@ import (
 	"strings"
 
 	"github.com/sagernet/sing-box/cmd/internal/build_shared"
+	"github.com/sagernet/sing-box/common/badversion"
 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing/common"
 
@@ -76,11 +77,20 @@ func findAndReplace(objectsMap map[string]any, projectContent string, bundleIDLi
 			continue
 		}
 		updated = true
-		projectContent = projectContent[:versionStart] + "\"" + newVersion + "\"" + projectContent[versionEnd:]
+		projectContent = projectContent[:versionStart] + formatProjectVersion(newVersion) + projectContent[versionEnd:]
 	}
 	return projectContent, updated
 }
 
+// Xcode serializes a version without quotes unless it contains a pre-release
+// part; always quoting makes Xcode rewrite the value on the next save.
+func formatProjectVersion(version string) string {
+	if badversion.Parse(version).PreReleaseIdentifier == "" {
+		return version
+	}
+	return "\"" + version + "\""
+}
+
 func findAndReplaceProjectVersion(objectsMap map[string]any, projectContent string, directoryList []string, newVersion string) (string, bool) {
 	objectKeyList := findObjectKeyByDirectory(objectsMap, directoryList)
 	var updated bool

{sing_box_python-1.13.18 → sing_box_python-1.13.19}/singbox-go/common/geosite/compat_test.go

@@ -211,7 +211,11 @@ func TestGeositeWriteReadCompat(t *testing.T) {
 			for code, expectedItems := range tc.input {
 				items, err := reader.Read(code)
 				require.NoError(t, err)
-				require.Equal(t, expectedItems, items, "items mismatch for code: %s", code)
+				if len(expectedItems) == 0 {
+					require.Empty(t, items, "items mismatch for code: %s", code)
+				} else {
+					require.Equal(t, expectedItems, items, "items mismatch for code: %s", code)
+				}
 			}
 		})
 	}

{sing_box_python-1.13.18 → sing_box_python-1.13.19}/singbox-go/common/geosite/reader.go

@@ -4,6 +4,7 @@ import (
 	"bufio"
 	"encoding/binary"
 	"io"
+	"math"
 	"os"
 	"sync"
 	"sync/atomic"
@@ -62,10 +63,9 @@ func (r *Reader) readMetadata() error {
 	if err != nil {
 		return err
 	}
-	keys := make([]string, entryLength)
 	domainIndex := make(map[string]int)
 	domainLength := make(map[string]int)
-	for i := 0; i < int(entryLength); i++ {
+	for range entryLength {
 		var (
 			code       string
 			codeIndex  uint64
@@ -75,7 +75,6 @@ func (r *Reader) readMetadata() error {
 		if err != nil {
 			return err
 		}
-		keys[i] = code
 		codeIndex, err = binary.ReadUvarint(reader)
 		if err != nil {
 			return err
@@ -84,6 +83,9 @@ func (r *Reader) readMetadata() error {
 		if err != nil {
 			return err
 		}
+		if codeIndex > math.MaxInt32 || codeLength > math.MaxInt32 {
+			return E.New("invalid metadata entry: ", code)
+		}
 		domainIndex[code] = int(codeIndex)
 		domainLength[code] = int(codeLength)
 	}
@@ -107,17 +109,22 @@ func (r *Reader) Read(code string) ([]Item, error) {
 		return nil, err
 	}
 	r.bufferedReader.Reset(r.reader)
-	itemList := make([]Item, r.domainLength[code])
-	for i := range itemList {
-		typeByte, err := r.bufferedReader.ReadByte()
+	length := r.domainLength[code]
+	var itemList []Item
+	for range length {
+		var (
+			typeByte byte
+			value    string
+		)
+		typeByte, err = r.bufferedReader.ReadByte()
 		if err != nil {
 			return nil, err
 		}
-		itemList[i].Type = ItemType(typeByte)
-		itemList[i].Value, err = readString(r.bufferedReader)
+		value, err = readString(r.bufferedReader)
 		if err != nil {
 			return nil, err
 		}
+		itemList = append(itemList, Item{Type: ItemType(typeByte), Value: value})
 	}
 	return itemList, nil
 }
@@ -144,12 +151,14 @@ func readString(reader io.ByteReader) (string, error) {
 	if err != nil {
 		return "", err
 	}
-	bytes := make([]byte, length)
-	for i := range bytes {
-		bytes[i], err = reader.ReadByte()
+	var result []byte
+	for range length {
+		var value byte
+		value, err = reader.ReadByte()
 		if err != nil {
 			return "", err
 		}
+		result = append(result, value)
 	}
-	return string(bytes), nil
+	return string(result), nil
 }