sing-box-python 1.13.18__tar.gz → 1.13.20__tar.gz

sing_box_python-1.13.20/.go-version

@@ -0,0 +1 @@
+1.25.12

{sing_box_python-1.13.18 → sing_box_python-1.13.20}/MANIFEST.in

@@ -7,3 +7,6 @@ include LICENSE
 include README.md
 include pyproject.toml
 include setup.py
+include .go-version
+include UPSTREAM_COMMIT
+include UPSTREAM_VERSION

{sing_box_python-1.13.18/sing_box_python.egg-info → sing_box_python-1.13.20}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sing-box-python
-Version: 1.13.18
+Version: 1.13.20
 Summary: Python binding for sing-box
 License: GPL-3.0-or-later
 Project-URL: Source, https://github.com/LorenEteval/sing-box-python
@@ -47,7 +47,8 @@ Binary wheels are published for Linux x86-64 and ARM64, Windows x86-64 and ARM64
 A source distribution is also published as a fallback. If pip cannot find a compatible wheel, it may build the native
 binding from source. A source build requires:
 
-* [Go 1.24.7](https://go.dev/doc/install) in `PATH`.
+* The [Go toolchain version recorded in `.go-version`](https://go.dev/doc/install), or a newer compatible release, in
+  `PATH`. The pinned version matches the compiler used by the synchronized upstream release workflow.
 * A working C and C++ compiler toolchain.
 * MinGW-w64 on Windows x86-64, or LLVM-MinGW on Windows ARM64, with `gcc` and `g++` available in `PATH`.
 
@@ -157,19 +158,50 @@ DATA
     __all__ = ['SingBox', 'SingBoxError', '__version__', 'startFromJSON']
 
 VERSION
-    v1.13.18
+    vX.Y.Z
 ```
 
-## Source Code Modification
+## Vendored Upstream Source
 
-This repository, including the package that distributes to pypi,
-contains [sing-box](https://github.com/SagerNet/sing-box) source code and the additional binding code required to build
-the Python extension and its API.
+This repository and its PyPI source distribution contain a vendored copy of
+[sing-box](https://github.com/SagerNet/sing-box). Vendoring keeps source installs independent of Git submodule support.
+All regular files under `singbox-go` come directly from the upstream release except these explicit additions:
 
-To make installation of this package easier, the original [sing-box](https://github.com/SagerNet/sing-box) source code
-is embedded instead of being added as a submodule. The official source files are unchanged. The binding is implemented
-by the added `singbox-go/binding` package and the C++/Python packaging files in this repository. To track the difference,
-compare `singbox-go` with the upstream commit while excluding the added `binding` directory.
+* `singbox-go/binding/main.go`
+* `singbox-go/binding/cronet_purego.go`
+
+Upstream's `clients/android` and `clients/apple` Git submodule links are intentionally not vendored because they are not
+used to build the Python package. The initial Windows import normalized executable bits on upstream shell scripts; file
+paths and blob contents remain identical to upstream. Synchronization runs on Linux and preserves upstream modes.
+
+### Upstream Release Synchronization
+
+`.github/workflows/sync-upstream.yml` checks the latest stable upstream release daily and can also be started manually
+from the Actions page. Drafts and prereleases are rejected. `UPSTREAM_VERSION` is the single version source for both the
+Python distribution version and the sing-box version embedded in the native library, while `UPSTREAM_COMMIT` pins the
+commit to which that release tag resolved during import. The root `.go-version` pins the exact Go compiler used by
+upstream's release workflow; this is intentionally independent of the minimum language version in `singbox-go/go.mod`.
+
+The synchronization script checks the current vendor tree against its exact upstream tag, fetches the requested tag,
+replaces only upstream-owned files, restores the two binding additions, updates `UPSTREAM_VERSION`, `UPSTREAM_COMMIT`,
+and `.go-version`, and verifies every vendored upstream path and Git blob. The Go pin is extracted from exact
+`go-version` entries in upstream's build workflow; synchronization fails instead of guessing if no single exact version
+can be identified. Repeated checks are no-ops when the stable release is already synchronized.
+
+Run the same operations locally from the repository root:
+
+```shell
+python scripts/sync-sing-box.py check
+python scripts/sync-sing-box.py verify --tag v1.13.18
+python scripts/sync-sing-box.py sync --tag vX.Y.Z
+```
+
+For an automated update, the sync workflow installs the synchronized `.go-version` toolchain and compiles the Go
+binding before committing `chore: sync sing-box vX.Y.Z` to `main`. It then explicitly dispatches the existing
+build-and-publish workflow at that commit. The latter uses the same exact Go version for every wheel platform, builds
+and tests every distribution, then creates the `vX.Y.Z` tag, publishes `X.Y.Z` to PyPI through Trusted Publishing, and
+creates the GitHub Release. Explicit dispatch is required because pushes made with GitHub's `GITHUB_TOKEN` do not
+trigger new push workflows.
 
 ## Binary Wheel Platforms
 
@@ -186,7 +218,7 @@ The distributions are built and tested in [GitHub Actions](https://github.com/Lo
 
 Naive outbound is included on all wheel platforms in the table. Cronet is bundled as an isolated shared runtime on
 macOS, Linux, and Windows. The macOS runtime is produced from the pinned static archive during the wheel build. The
-Cronet artifact comes from the platform module and exact version already pinned by sing-box v1.13.18's `go.mod` and
+Cronet artifact comes from the platform module and exact version already pinned by the vendored sing-box `go.mod` and
 verified by `go.sum`; the workflow does not build an unrelated Cronet revision.
 Custom source builds can override the complete sing-box tag list with the `SINGBOX_BUILD_TAGS` environment variable.
 

{sing_box_python-1.13.18 → sing_box_python-1.13.20}/README.md

@@ -20,7 +20,8 @@ Binary wheels are published for Linux x86-64 and ARM64, Windows x86-64 and ARM64
 A source distribution is also published as a fallback. If pip cannot find a compatible wheel, it may build the native
 binding from source. A source build requires:
 
-* [Go 1.24.7](https://go.dev/doc/install) in `PATH`.
+* The [Go toolchain version recorded in `.go-version`](https://go.dev/doc/install), or a newer compatible release, in
+  `PATH`. The pinned version matches the compiler used by the synchronized upstream release workflow.
 * A working C and C++ compiler toolchain.
 * MinGW-w64 on Windows x86-64, or LLVM-MinGW on Windows ARM64, with `gcc` and `g++` available in `PATH`.
 
@@ -130,19 +131,50 @@ DATA
     __all__ = ['SingBox', 'SingBoxError', '__version__', 'startFromJSON']
 
 VERSION
-    v1.13.18
+    vX.Y.Z
 ```
 
-## Source Code Modification
+## Vendored Upstream Source
 
-This repository, including the package that distributes to pypi,
-contains [sing-box](https://github.com/SagerNet/sing-box) source code and the additional binding code required to build
-the Python extension and its API.
+This repository and its PyPI source distribution contain a vendored copy of
+[sing-box](https://github.com/SagerNet/sing-box). Vendoring keeps source installs independent of Git submodule support.
+All regular files under `singbox-go` come directly from the upstream release except these explicit additions:
 
-To make installation of this package easier, the original [sing-box](https://github.com/SagerNet/sing-box) source code
-is embedded instead of being added as a submodule. The official source files are unchanged. The binding is implemented
-by the added `singbox-go/binding` package and the C++/Python packaging files in this repository. To track the difference,
-compare `singbox-go` with the upstream commit while excluding the added `binding` directory.
+* `singbox-go/binding/main.go`
+* `singbox-go/binding/cronet_purego.go`
+
+Upstream's `clients/android` and `clients/apple` Git submodule links are intentionally not vendored because they are not
+used to build the Python package. The initial Windows import normalized executable bits on upstream shell scripts; file
+paths and blob contents remain identical to upstream. Synchronization runs on Linux and preserves upstream modes.
+
+### Upstream Release Synchronization
+
+`.github/workflows/sync-upstream.yml` checks the latest stable upstream release daily and can also be started manually
+from the Actions page. Drafts and prereleases are rejected. `UPSTREAM_VERSION` is the single version source for both the
+Python distribution version and the sing-box version embedded in the native library, while `UPSTREAM_COMMIT` pins the
+commit to which that release tag resolved during import. The root `.go-version` pins the exact Go compiler used by
+upstream's release workflow; this is intentionally independent of the minimum language version in `singbox-go/go.mod`.
+
+The synchronization script checks the current vendor tree against its exact upstream tag, fetches the requested tag,
+replaces only upstream-owned files, restores the two binding additions, updates `UPSTREAM_VERSION`, `UPSTREAM_COMMIT`,
+and `.go-version`, and verifies every vendored upstream path and Git blob. The Go pin is extracted from exact
+`go-version` entries in upstream's build workflow; synchronization fails instead of guessing if no single exact version
+can be identified. Repeated checks are no-ops when the stable release is already synchronized.
+
+Run the same operations locally from the repository root:
+
+```shell
+python scripts/sync-sing-box.py check
+python scripts/sync-sing-box.py verify --tag v1.13.18
+python scripts/sync-sing-box.py sync --tag vX.Y.Z
+```
+
+For an automated update, the sync workflow installs the synchronized `.go-version` toolchain and compiles the Go
+binding before committing `chore: sync sing-box vX.Y.Z` to `main`. It then explicitly dispatches the existing
+build-and-publish workflow at that commit. The latter uses the same exact Go version for every wheel platform, builds
+and tests every distribution, then creates the `vX.Y.Z` tag, publishes `X.Y.Z` to PyPI through Trusted Publishing, and
+creates the GitHub Release. Explicit dispatch is required because pushes made with GitHub's `GITHUB_TOKEN` do not
+trigger new push workflows.
 
 ## Binary Wheel Platforms
 
@@ -159,7 +191,7 @@ The distributions are built and tested in [GitHub Actions](https://github.com/Lo
 
 Naive outbound is included on all wheel platforms in the table. Cronet is bundled as an isolated shared runtime on
 macOS, Linux, and Windows. The macOS runtime is produced from the pinned static archive during the wheel build. The
-Cronet artifact comes from the platform module and exact version already pinned by sing-box v1.13.18's `go.mod` and
+Cronet artifact comes from the platform module and exact version already pinned by the vendored sing-box `go.mod` and
 verified by `go.sum`; the workflow does not build an unrelated Cronet revision.
 Custom source builds can override the complete sing-box tag list with the `SINGBOX_BUILD_TAGS` environment variable.
 

sing_box_python-1.13.20/UPSTREAM_COMMIT

@@ -0,0 +1 @@
+56f91dfeabd6f4edbd437dfcc1e5b0ebc856b778

sing_box_python-1.13.20/UPSTREAM_VERSION

@@ -0,0 +1 @@
+v1.13.20

{sing_box_python-1.13.18 → sing_box_python-1.13.20}/pyproject.toml

@@ -10,17 +10,14 @@ build-backend = "setuptools.build_meta"
 
 [tool.cibuildwheel]
 build = [
-    "cp38-*",
     "cp39-*",
     "cp310-*",
     "cp311-*",
     "cp312-*",
     "cp313-*",
-    "cp313t-*",
     "cp314-*",
     "cp314t-*",
 ]
-enable = ["cpython-freethreading"]
 skip = "*-musllinux_*"
 build-verbosity = 1
 test-requires = ["pytest>=8"]
@@ -33,27 +30,38 @@ test-command = [
 ]
 
 [tool.cibuildwheel.linux]
-before-all = """
+manylinux-x86_64-image = "manylinux2014"
+manylinux-aarch64-image = "manylinux2014"
+before-all = '''
+go_version="$(
+    tr -d '\r\n' < "{project}/.go-version"
+)"
+if ! printf '%s\n' "${go_version}" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+    echo "Invalid Go version in .go-version: ${go_version}" >&2
+    exit 1
+fi
 case "$(uname -m)" in
     x86_64)
         go_arch='amd64'
-        go_sha256='da18191ddb7db8a9339816f3e2b54bdded8047cdc2a5d67059478f8d1595c43f'
         ;;
     aarch64|arm64)
         go_arch='arm64'
-        go_sha256='fd2bccce882e29369f56c86487663bb78ba7ea9e02188a5b0269303a0c3d33ab'
         ;;
     *)
         echo "Unsupported Linux architecture: $(uname -m)" >&2
         exit 1
         ;;
 esac
-go_archive="/tmp/go1.24.7.linux-${go_arch}.tar.gz"
-curl -fsSLo "${go_archive}" "https://go.dev/dl/go1.24.7.linux-${go_arch}.tar.gz"
+go_archive="/tmp/go${go_version}.linux-${go_arch}.tar.gz"
+go_checksum="${go_archive}.sha256"
+go_url="https://dl.google.com/go/go${go_version}.linux-${go_arch}.tar.gz"
+curl -fsSLo "${go_archive}" "${go_url}"
+curl -fsSLo "${go_checksum}" "${go_url}.sha256"
+go_sha256="$(tr -d '\r\n' < "${go_checksum}")"
 echo "${go_sha256}  ${go_archive}" | sha256sum -c -
 tar -C /usr/local -xzf "${go_archive}"
 /usr/local/go/bin/go version
-"""
+'''
 environment = { PATH = "/usr/local/go/bin:$PATH", GOTOOLCHAIN = "local" }
 
 [tool.cibuildwheel.macos]

{sing_box_python-1.13.18 → sing_box_python-1.13.20}/setup.py

@@ -2,6 +2,7 @@ import json
 import os
 import pathlib
 import platform
+import re
 import shlex
 import shutil
 import subprocess
@@ -13,8 +14,12 @@ from setuptools.command.build_ext import build_ext
 
 ROOT_DIR = pathlib.Path(__file__).parent.resolve()
 GO_SOURCE_DIR = ROOT_DIR / 'singbox-go'
-PACKAGE_VERSION = '1.13.18'
-UPSTREAM_VERSION = 'v1.13.18'
+UPSTREAM_VERSION = (ROOT_DIR / 'UPSTREAM_VERSION').read_text(encoding='utf-8').strip()
+
+if not re.fullmatch(r'v\d+\.\d+\.\d+', UPSTREAM_VERSION):
+    raise RuntimeError(f'Invalid upstream version: {UPSTREAM_VERSION!r}')
+
+PACKAGE_VERSION = UPSTREAM_VERSION[1:]
 
 
 class CMakeExtension(Extension):

{sing_box_python-1.13.18 → sing_box_python-1.13.20/sing_box_python.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sing-box-python
-Version: 1.13.18
+Version: 1.13.20
 Summary: Python binding for sing-box
 License: GPL-3.0-or-later
 Project-URL: Source, https://github.com/LorenEteval/sing-box-python
@@ -47,7 +47,8 @@ Binary wheels are published for Linux x86-64 and ARM64, Windows x86-64 and ARM64
 A source distribution is also published as a fallback. If pip cannot find a compatible wheel, it may build the native
 binding from source. A source build requires:
 
-* [Go 1.24.7](https://go.dev/doc/install) in `PATH`.
+* The [Go toolchain version recorded in `.go-version`](https://go.dev/doc/install), or a newer compatible release, in
+  `PATH`. The pinned version matches the compiler used by the synchronized upstream release workflow.
 * A working C and C++ compiler toolchain.
 * MinGW-w64 on Windows x86-64, or LLVM-MinGW on Windows ARM64, with `gcc` and `g++` available in `PATH`.
 
@@ -157,19 +158,50 @@ DATA
     __all__ = ['SingBox', 'SingBoxError', '__version__', 'startFromJSON']
 
 VERSION
-    v1.13.18
+    vX.Y.Z
 ```
 
-## Source Code Modification
+## Vendored Upstream Source
 
-This repository, including the package that distributes to pypi,
-contains [sing-box](https://github.com/SagerNet/sing-box) source code and the additional binding code required to build
-the Python extension and its API.
+This repository and its PyPI source distribution contain a vendored copy of
+[sing-box](https://github.com/SagerNet/sing-box). Vendoring keeps source installs independent of Git submodule support.
+All regular files under `singbox-go` come directly from the upstream release except these explicit additions:
 
-To make installation of this package easier, the original [sing-box](https://github.com/SagerNet/sing-box) source code
-is embedded instead of being added as a submodule. The official source files are unchanged. The binding is implemented
-by the added `singbox-go/binding` package and the C++/Python packaging files in this repository. To track the difference,
-compare `singbox-go` with the upstream commit while excluding the added `binding` directory.
+* `singbox-go/binding/main.go`
+* `singbox-go/binding/cronet_purego.go`
+
+Upstream's `clients/android` and `clients/apple` Git submodule links are intentionally not vendored because they are not
+used to build the Python package. The initial Windows import normalized executable bits on upstream shell scripts; file
+paths and blob contents remain identical to upstream. Synchronization runs on Linux and preserves upstream modes.
+
+### Upstream Release Synchronization
+
+`.github/workflows/sync-upstream.yml` checks the latest stable upstream release daily and can also be started manually
+from the Actions page. Drafts and prereleases are rejected. `UPSTREAM_VERSION` is the single version source for both the
+Python distribution version and the sing-box version embedded in the native library, while `UPSTREAM_COMMIT` pins the
+commit to which that release tag resolved during import. The root `.go-version` pins the exact Go compiler used by
+upstream's release workflow; this is intentionally independent of the minimum language version in `singbox-go/go.mod`.
+
+The synchronization script checks the current vendor tree against its exact upstream tag, fetches the requested tag,
+replaces only upstream-owned files, restores the two binding additions, updates `UPSTREAM_VERSION`, `UPSTREAM_COMMIT`,
+and `.go-version`, and verifies every vendored upstream path and Git blob. The Go pin is extracted from exact
+`go-version` entries in upstream's build workflow; synchronization fails instead of guessing if no single exact version
+can be identified. Repeated checks are no-ops when the stable release is already synchronized.
+
+Run the same operations locally from the repository root:
+
+```shell
+python scripts/sync-sing-box.py check
+python scripts/sync-sing-box.py verify --tag v1.13.18
+python scripts/sync-sing-box.py sync --tag vX.Y.Z
+```
+
+For an automated update, the sync workflow installs the synchronized `.go-version` toolchain and compiles the Go
+binding before committing `chore: sync sing-box vX.Y.Z` to `main`. It then explicitly dispatches the existing
+build-and-publish workflow at that commit. The latter uses the same exact Go version for every wheel platform, builds
+and tests every distribution, then creates the `vX.Y.Z` tag, publishes `X.Y.Z` to PyPI through Trusted Publishing, and
+creates the GitHub Release. Explicit dispatch is required because pushes made with GitHub's `GITHUB_TOKEN` do not
+trigger new push workflows.
 
 ## Binary Wheel Platforms
 
@@ -186,7 +218,7 @@ The distributions are built and tested in [GitHub Actions](https://github.com/Lo
 
 Naive outbound is included on all wheel platforms in the table. Cronet is bundled as an isolated shared runtime on
 macOS, Linux, and Windows. The macOS runtime is produced from the pinned static archive during the wheel build. The
-Cronet artifact comes from the platform module and exact version already pinned by sing-box v1.13.18's `go.mod` and
+Cronet artifact comes from the platform module and exact version already pinned by the vendored sing-box `go.mod` and
 verified by `go.sum`; the workflow does not build an unrelated Cronet revision.
 Custom source builds can override the complete sing-box tag list with the `SINGBOX_BUILD_TAGS` environment variable.
 

{sing_box_python-1.13.18 → sing_box_python-1.13.20}/sing_box_python.egg-info/SOURCES.txt

@@ -1,7 +1,10 @@
+.go-version
 CMakeLists.txt
 LICENSE
 MANIFEST.in
 README.md
+UPSTREAM_COMMIT
+UPSTREAM_VERSION
 pyproject.toml
 setup.py
 sing_box_python.egg-info/PKG-INFO
@@ -252,6 +255,7 @@ singbox-go/common/srs/binary.go
 singbox-go/common/srs/compat_test.go
 singbox-go/common/srs/ip_cidr.go
 singbox-go/common/srs/ip_set.go
+singbox-go/common/srs/malformed_test.go
 singbox-go/common/taskmonitor/monitor.go
 singbox-go/common/tls/acme.go
 singbox-go/common/tls/acme_contstant.go
@@ -847,6 +851,7 @@ singbox-go/route/rule/rule_action.go
 singbox-go/route/rule/rule_default.go
 singbox-go/route/rule/rule_default_interface_address.go
 singbox-go/route/rule/rule_dns.go
+singbox-go/route/rule/rule_dns_address_filter_test.go
 singbox-go/route/rule/rule_headless.go
 singbox-go/route/rule/rule_interface_address.go
 singbox-go/route/rule/rule_item_adguard.go

{sing_box_python-1.13.18 → sing_box_python-1.13.20}/singbox-go/.github/workflows/build.yml

@@ -1098,35 +1098,36 @@ jobs:
           echo "ASC_KEY_ID=$ASC_KEY_ID" >> "$GITHUB_ENV"
           echo "ASC_KEY_ISSUER_ID=$ASC_KEY_ISSUER_ID" >> "$GITHUB_ENV"
         env:
-          ASC_KEY: ${{ secrets.ASC_KEY }}
-          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
-          ASC_KEY_ISSUER_ID: ${{ secrets.ASC_KEY_ISSUER_ID }}
+          ASC_KEY: ${{ secrets.LEGACY_ASC_KEY }}
+          ASC_KEY_ID: ${{ secrets.LEGACY_ASC_KEY_ID }}
+          ASC_KEY_ISSUER_ID: ${{ secrets.LEGACY_ASC_KEY_ISSUER_ID }}
       - name: Install Apple provisioning profiles
         if: matrix.if && matrix.type != 'jailbreak'
         run: |-
           PROFILES_ZIP_PATH=$RUNNER_TEMP/AppleProvisioningProfiles.zip
-          printf '%s%s%s%s%s%s%s%s' \
-            "$PROVISIONING_PROFILES_1" \
-            "$PROVISIONING_PROFILES_2" \
-            "$PROVISIONING_PROFILES_3" \
-            "$PROVISIONING_PROFILES_4" \
-            "$PROVISIONING_PROFILES_5" \
-            "$PROVISIONING_PROFILES_6" \
-            "$PROVISIONING_PROFILES_7" \
-            "$PROVISIONING_PROFILES_8" \
-            | base64 --decode -o $PROFILES_ZIP_PATH
+          for variable in $(compgen -v | grep -E '^PROVISIONING_PROFILES_[0-9]+$' | sort -t_ -k3 -n); do
+            printf '%s' "${!variable}"
+          done | base64 --decode -o $PROFILES_ZIP_PATH
           PROFILES_PATH="$HOME/Library/Developer/Xcode/UserData/Provisioning Profiles"
           mkdir -p "$PROFILES_PATH"
           unzip -q $PROFILES_ZIP_PATH -d "$PROFILES_PATH"
         env:
-          PROVISIONING_PROFILES_1: ${{ secrets.APPLE_PROVISIONING_PROFILES_1 }}
-          PROVISIONING_PROFILES_2: ${{ secrets.APPLE_PROVISIONING_PROFILES_2 }}
-          PROVISIONING_PROFILES_3: ${{ secrets.APPLE_PROVISIONING_PROFILES_3 }}
-          PROVISIONING_PROFILES_4: ${{ secrets.APPLE_PROVISIONING_PROFILES_4 }}
-          PROVISIONING_PROFILES_5: ${{ secrets.APPLE_PROVISIONING_PROFILES_5 }}
-          PROVISIONING_PROFILES_6: ${{ secrets.APPLE_PROVISIONING_PROFILES_6 }}
-          PROVISIONING_PROFILES_7: ${{ secrets.APPLE_PROVISIONING_PROFILES_7 }}
-          PROVISIONING_PROFILES_8: ${{ secrets.APPLE_PROVISIONING_PROFILES_8 }}
+          PROVISIONING_PROFILES_1: ${{ secrets.LEGACY_APPLE_PROVISIONING_PROFILES_1 }}
+          PROVISIONING_PROFILES_2: ${{ secrets.LEGACY_APPLE_PROVISIONING_PROFILES_2 }}
+          PROVISIONING_PROFILES_3: ${{ secrets.LEGACY_APPLE_PROVISIONING_PROFILES_3 }}
+          PROVISIONING_PROFILES_4: ${{ secrets.LEGACY_APPLE_PROVISIONING_PROFILES_4 }}
+          PROVISIONING_PROFILES_5: ${{ secrets.LEGACY_APPLE_PROVISIONING_PROFILES_5 }}
+          PROVISIONING_PROFILES_6: ${{ secrets.LEGACY_APPLE_PROVISIONING_PROFILES_6 }}
+          PROVISIONING_PROFILES_7: ${{ secrets.LEGACY_APPLE_PROVISIONING_PROFILES_7 }}
+          PROVISIONING_PROFILES_8: ${{ secrets.LEGACY_APPLE_PROVISIONING_PROFILES_8 }}
+          PROVISIONING_PROFILES_9: ${{ secrets.LEGACY_APPLE_PROVISIONING_PROFILES_9 }}
+          PROVISIONING_PROFILES_10: ${{ secrets.LEGACY_APPLE_PROVISIONING_PROFILES_10 }}
+          PROVISIONING_PROFILES_11: ${{ secrets.LEGACY_APPLE_PROVISIONING_PROFILES_11 }}
+          PROVISIONING_PROFILES_12: ${{ secrets.LEGACY_APPLE_PROVISIONING_PROFILES_12 }}
+          PROVISIONING_PROFILES_13: ${{ secrets.LEGACY_APPLE_PROVISIONING_PROFILES_13 }}
+          PROVISIONING_PROFILES_14: ${{ secrets.LEGACY_APPLE_PROVISIONING_PROFILES_14 }}
+          PROVISIONING_PROFILES_15: ${{ secrets.LEGACY_APPLE_PROVISIONING_PROFILES_15 }}
+          PROVISIONING_PROFILES_16: ${{ secrets.LEGACY_APPLE_PROVISIONING_PROFILES_16 }}
       - name: Setup Apple Development certificate
         if: matrix.if && matrix.type != 'jailbreak'
         run: |-
@@ -1143,8 +1144,8 @@ jobs:
           security find-identity -v -p codesigning $KEYCHAIN_PATH
           echo "APPLE_DEVELOPMENT_KEYCHAIN_PATH=$KEYCHAIN_PATH" >> "$GITHUB_ENV"
         env:
-          APPLE_DEVELOPMENT_CERTIFICATES_P12: ${{ secrets.APPLE_DEVELOPMENT_CERTIFICATES_P12 }}
-          P12_PASSWORD: ${{ secrets.APPLE_DEVELOPMENT_P12_PASSWORD }}
+          APPLE_DEVELOPMENT_CERTIFICATES_P12: ${{ secrets.LEGACY_APPLE_DEVELOPMENT_CERTIFICATES_P12 }}
+          P12_PASSWORD: ${{ secrets.LEGACY_APPLE_DEVELOPMENT_P12_PASSWORD }}
           KEYCHAIN_PASSWORD: ${{ secrets.APPLE_KEYCHAIN_PASSWORD }}
       - name: Setup Developer ID certificates
         if: matrix.if && matrix.type == 'standalone'
@@ -1162,8 +1163,8 @@ jobs:
           security find-identity -v -p codesigning $KEYCHAIN_PATH
           echo "SIGNING_KEYCHAIN_PATH=$KEYCHAIN_PATH" >> "$GITHUB_ENV"
         env:
-          DEVELOPER_ID_CERTIFICATES_P12: ${{ secrets.DEVELOPER_ID_CERTIFICATES_P12 }}
-          P12_PASSWORD: ${{ secrets.DEVELOPER_ID_P12_PASSWORD }}
+          DEVELOPER_ID_CERTIFICATES_P12: ${{ secrets.LEGACY_DEVELOPER_ID_CERTIFICATES_P12 }}
+          P12_PASSWORD: ${{ secrets.LEGACY_DEVELOPER_ID_P12_PASSWORD }}
           KEYCHAIN_PASSWORD: ${{ secrets.APPLE_KEYCHAIN_PASSWORD }}
       - name: Setup notarization credentials
         if: matrix.if && matrix.type == 'standalone' && github.event_name == 'workflow_dispatch'

{sing_box_python-1.13.18 → sing_box_python-1.13.20}/singbox-go/adapter/experimental.go

@@ -7,6 +7,7 @@ import (
 	"io"
 	"time"
 
+	E "github.com/sagernet/sing/common/exceptions"
 	"github.com/sagernet/sing/common/observable"
 	"github.com/sagernet/sing/common/varbin"
 )
@@ -103,6 +104,9 @@ func (s *SavedBinary) UnmarshalBinary(data []byte) error {
 	if err != nil {
 		return err
 	}
+	if contentLength > uint64(reader.Len()) {
+		return E.New("invalid content length: ", contentLength)
+	}
 	s.Content = make([]byte, contentLength)
 	_, err = io.ReadFull(reader, s.Content)
 	if err != nil {
@@ -118,6 +122,9 @@ func (s *SavedBinary) UnmarshalBinary(data []byte) error {
 	if err != nil {
 		return err
 	}
+	if etagLength > uint64(reader.Len()) {
+		return E.New("invalid etag length: ", etagLength)
+	}
 	etagBytes := make([]byte, etagLength)
 	_, err = io.ReadFull(reader, etagBytes)
 	if err != nil {
@@ -136,6 +143,7 @@ type OutboundGroup interface {
 type URLTestGroup interface {
 	OutboundGroup
 	URLTest(ctx context.Context) (map[string]uint16, error)
+	PerformUpdateCheck()
 }
 
 func OutboundTag(detour Outbound) string {

{sing_box_python-1.13.18 → sing_box_python-1.13.20}/singbox-go/adapter/inbound.go

@@ -94,7 +94,7 @@ type InboundContext struct {
 	SourcePortMatch              bool
 	DestinationAddressMatch      bool
 	DestinationPortMatch         bool
-	DidMatch                     bool
+	DefinitiveMatchStates        uint16
 	IgnoreDestinationIPCIDRMatch bool
 }
 
@@ -109,7 +109,7 @@ func (c *InboundContext) ResetRuleMatchCache() {
 	c.SourcePortMatch = false
 	c.DestinationAddressMatch = false
 	c.DestinationPortMatch = false
-	c.DidMatch = false
+	c.DefinitiveMatchStates = 0
 }
 
 type inboundContextKey struct{}

{sing_box_python-1.13.18 → sing_box_python-1.13.20}/singbox-go/cmd/internal/update_apple_version/main.go

@@ -8,6 +8,7 @@ import (
 	"strings"
 
 	"github.com/sagernet/sing-box/cmd/internal/build_shared"
+	"github.com/sagernet/sing-box/common/badversion"
 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing/common"
 
@@ -76,11 +77,20 @@ func findAndReplace(objectsMap map[string]any, projectContent string, bundleIDLi
 			continue
 		}
 		updated = true
-		projectContent = projectContent[:versionStart] + "\"" + newVersion + "\"" + projectContent[versionEnd:]
+		projectContent = projectContent[:versionStart] + formatProjectVersion(newVersion) + projectContent[versionEnd:]
 	}
 	return projectContent, updated
 }
 
+// Xcode serializes a version without quotes unless it contains a pre-release
+// part; always quoting makes Xcode rewrite the value on the next save.
+func formatProjectVersion(version string) string {
+	if badversion.Parse(version).PreReleaseIdentifier == "" {
+		return version
+	}
+	return "\"" + version + "\""
+}
+
 func findAndReplaceProjectVersion(objectsMap map[string]any, projectContent string, directoryList []string, newVersion string) (string, bool) {
 	objectKeyList := findObjectKeyByDirectory(objectsMap, directoryList)
 	var updated bool

{sing_box_python-1.13.18 → sing_box_python-1.13.20}/singbox-go/cmd/sing-box/cmd.go

@@ -10,6 +10,7 @@ import (
 	"github.com/sagernet/sing-box/experimental/deprecated"
 	"github.com/sagernet/sing-box/include"
 	"github.com/sagernet/sing-box/log"
+	"github.com/sagernet/sing/common"
 	"github.com/sagernet/sing/service"
 	"github.com/sagernet/sing/service/filemanager"
 
@@ -52,7 +53,9 @@ func preRun(cmd *cobra.Command, args []string) {
 		globalCtx = filemanager.WithDefault(globalCtx, "", "", sudoUID, sudoGID)
 	}
 	if disableColor {
-		log.SetStdLogger(log.NewDefaultFactory(context.Background(), log.Formatter{BaseTime: time.Now(), DisableColors: true}, os.Stderr, "", nil, false).Logger())
+		logFactory := log.NewDefaultFactory(context.Background(), log.Formatter{BaseTime: time.Now(), DisableColors: true}, os.Stderr, "", nil, false)
+		common.Must(logFactory.Start())
+		log.SetStdLogger(logFactory.Logger())
 	}
 	if workingDir != "" {
 		_, err := os.Stat(workingDir)

{sing_box_python-1.13.18 → sing_box_python-1.13.20}/singbox-go/common/geosite/compat_test.go

@@ -211,7 +211,11 @@ func TestGeositeWriteReadCompat(t *testing.T) {
 			for code, expectedItems := range tc.input {
 				items, err := reader.Read(code)
 				require.NoError(t, err)
-				require.Equal(t, expectedItems, items, "items mismatch for code: %s", code)
+				if len(expectedItems) == 0 {
+					require.Empty(t, items, "items mismatch for code: %s", code)
+				} else {
+					require.Equal(t, expectedItems, items, "items mismatch for code: %s", code)
+				}
 			}
 		})
 	}