Skip to content

AikoBox v0.1.0-beta.3 (UNSIGNED beta)

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 27 Jul 09:38
v0.1.0-beta.3
43d91bc

AikoBox v0.1.0-beta.3

AikoBox v0.1.0-beta.3 是首个同时提供 Windows x64 与 Android ARM64 的公开预发行版。本版重点修复 Windows 核心、系统代理、路由转换和备份恢复的高风险问题，并首次提供由固定发布密钥签名的 Android VPN 客户端。它仍是 Beta；升级或首次安装前，请保留可用的联网方案和配置备份。

AikoBox v0.1.0-beta.3 is the first public prerelease for both Windows x64 and Android ARM64. It focuses on high-risk fixes in Windows core lifecycle, system proxy handling, route conversion, and backup recovery, and introduces an Android VPN client signed with a fixed release key. This is still a beta; keep a working connectivity fallback and configuration backup before installing or upgrading.

下载 / Downloads

  • aikobox-windows-0.1.0-beta.3-x64-setup.exe：Windows 10/11 x64 安装版；TUN 需要管理员授权。

  • aikobox-windows-0.1.0-beta.3-x64-portable.exe：Windows 10/11 x64 便携版；建议首次试用。

  • aikobox-android-0.1.0-beta.3-arm64-v8a.apk：仅适用于 ARM64-v8a、Android 7.0（API 24）或更高版本。

  • 每个二进制文件均有同名 .sha256，并提供统一的 SHA256SUMS.txt、RELEASE-MANIFEST.txt 和第三方许可审计。

  • Release 同时附带 Android libbox、Windows sing-box 核心与 Windows sysproxy 的完整对应源码包、依赖许可证包、机器可读证据报告、独立 Notice 和组件校验和。统一 SHA256SUMS.txt 覆盖除其自身外的全部公开资产。

  • aikobox-windows-0.1.0-beta.3-x64-setup.exe: installer for Windows 10/11 x64; TUN requires elevation.

  • aikobox-windows-0.1.0-beta.3-x64-portable.exe: portable Windows 10/11 x64 build; recommended for first-time testing.

  • aikobox-android-0.1.0-beta.3-arm64-v8a.apk: for ARM64-v8a devices running Android 7.0 (API 24) or newer only.

  • Every binary has a matching .sha256; the release also includes SHA256SUMS.txt, RELEASE-MANIFEST.txt, and the third-party license audit.

  • The Release also carries complete corresponding source, dependency-license bundles, machine-readable evidence reports, standalone Notices, and component checksums for Android libbox, the Windows sing-box core, and Windows sysproxy. The unified SHA256SUMS.txt covers every public asset except itself.

Windows 修复 / Windows fixes

  • 串行化首次启动、重启和后台保活，避免并发启动两个核心；系统代理写入失败不再重复重启健康核心。

  • 改进退出流程：只有系统代理恢复和核心停止明确成功后才允许退出；超时或失败会保留应用以便恢复。

  • 修复 PAC 崩溃恢复和企业代理配置恢复；原 PAC 端口不可用时明确失败并保留恢复记录，不再静默监听错误端口。

  • 保存系统代理设置时保持原有启用状态，不再意外开启代理。

  • 修复 DNS detour、fake-IP 优先级、无 sniffer 时的 DNS 劫持、WireGuard 多 peer、进程名正则、Provider override 和代理组标签冲突等转换问题。

  • 备份恢复改为事务式操作；失败时回滚，配置写入与恢复互斥。WebDAV 脱敏备份不再上传 Profile、订阅凭据或 Age 私钥。

  • 修复订阅默认端口、IPv6 地址、Provider include-all、渲染层 IPC 监听器清理及 Gateway 可信代理与内存上限。

  • Serialized initial start, restart, and background keepalive to prevent two core processes from starting concurrently. A system-proxy write failure no longer restarts an already healthy core.

  • Exit is authorized only after proxy restoration and core shutdown explicitly succeed; timeout or failure keeps the application alive for recovery.

  • Fixed PAC crash recovery and restoration of enterprise proxy settings. If the original PAC port cannot be rebound, recovery now fails clearly and preserves its recovery record instead of silently listening on the wrong port.

  • Saving system-proxy settings preserves the previous enabled state instead of unexpectedly enabling the proxy.

  • Fixed DNS detours, fake-IP precedence, DNS interception without sniffing, multi-peer WireGuard, process-name regex handling, provider overrides, and outbound tag conflicts.

  • Backup restore is transactional and mutually exclusive with profile writes. Redacted WebDAV backups no longer upload profiles, subscription credentials, or Age private keys.

  • Fixed subscription default ports and IPv6 endpoints, provider include-all, renderer IPC listener cleanup, and Gateway trusted-proxy and memory-boundary handling.

Android ARM64 首发 / Android ARM64 debut

  • 首版 Android 客户端采用 Material 3 界面，通过系统 VpnService 和锁定的 sing-box libbox 核心运行 VPN。

  • 支持从本地文件、HTTPS URL 或粘贴内容导入原生 sing-box JSON，并提供配置校验、连接/停止和状态显示。

  • 发布 APK 只包含 arm64-v8a 原生库。工作流验证应用 ID、版本名、版本号、libbox.so、ABI 集合、APK 签名证书和 SHA-256。

  • Android APK 使用固定的正式发布密钥签名；缺少完整密钥或证书指纹时，发布会直接失败，不会回退到调试签名。

  • The first Android client uses a Material 3 interface and runs the VPN through Android VpnService with a locked sing-box libbox core.

  • It imports native sing-box JSON from a local file, HTTPS URL, or pasted content, with configuration validation, connect/stop controls, and status display.

  • The release APK contains only arm64-v8a native libraries. The workflow verifies application ID, version name, version code, libbox.so, ABI set, signing certificate, and SHA-256.

  • The Android APK is signed with a fixed production release key. Publication fails if the complete signing identity is unavailable and never falls back to a debug signature.

签名与校验 / Signing and verification

Android APK 必须通过固定证书签名验证。Windows Authenticode 状态取决于仓库是否配置了完整的 Windows 签名身份：若未配置，本预发行版可以作为“未签名 Beta”发布，发布页会由工作流追加醒目标识。无论签名状态如何，都只应从本仓库 Releases 下载并核对 SHA-256。

The Android APK must pass verification against the fixed release certificate. Windows Authenticode status depends on whether the repository has a complete Windows signing identity. If it is unavailable, this prerelease may be published as an explicitly marked “unsigned beta,” and the workflow appends a prominent notice. Regardless of signing status, download only from this repository's Releases and verify SHA-256.

所有二进制发行版（包括 Beta）都必须通过“零未解决阻断项”的第三方再分发审计；预发行状态不再允许绕过许可门禁。

Every binary release, including a beta, must pass the third-party redistribution audit with zero unresolved blockers. Prerelease status no longer bypasses the license gate.

已知限制 / Known limitations

  • Android 仅支持 ARM64-v8a；不提供 x86、x86_64 或 armeabi-v7a APK。

  • Android 首版仅承诺导入原生 sing-box JSON，不承诺完整支持 Clash YAML、订阅 URI、应用分流、快捷设置磁贴、开机自启或 Google Play 发布。

  • Android 需要用户明确授予系统 VPN 权限；拒绝或撤销权限会停止连接。

  • Windows 便携版仍不支持 TUN；安装版 TUN 需要管理员授权。

  • Clash YAML 到 sing-box 的转换不是逐字段等价；无法安全转换的关键配置会被拒绝。

  • 这是 Beta，不建议在没有备用联网方案的设备上作为唯一代理客户端。

  • Android supports ARM64-v8a only; no x86, x86_64, or armeabi-v7a APK is provided.

  • The first Android release guarantees native sing-box JSON import only. Full Clash YAML, subscription URI support, per-app routing, Quick Settings tiles, start-at-boot, and Google Play distribution are not claimed.

  • Android requires explicit system VPN permission; denying or revoking it stops the connection.

  • The Windows portable build still does not support TUN; TUN in the installed build requires elevation.

  • Clash YAML to sing-box conversion is not field-for-field; critical configurations that cannot be converted safely are rejected.

  • This is a beta and should not be the only proxy client on a device without a recovery path.

⚠ 未签名 Beta / UNSIGNED BETA

仓库尚未配置受信任的 Windows 代码签名证书。发布工作流已确认安装包、便携版和内部主程序均为未签名，并已对最终文件执行静态内容与 SHA-256 校验。Windows 可能显示“未知发布者”或 Microsoft Defender SmartScreen 提示；只应从本仓库 Release 下载并先核对 SHA-256。此说明不代表文件获得了 Windows 信任签名。

A trusted Windows code-signing certificate is not configured. The workflow confirmed that the installer, portable executable, and packaged application are unsigned, then performed static payload and SHA-256 verification. Windows may show Unknown publisher or Microsoft Defender SmartScreen. Download only from this repository's Releases and verify SHA-256 first. This notice does not claim that the files are trusted or signed.

Android 签名状态 / Android signing status

Android ARM64 APK 使用仓库固定发布密钥签名。发布工作流已验证 APK 签名、配置的证书 SHA-256、版本名、应用 ID、SHA-256，并确认原生库仅包含 arm64-v8a 且存在 libbox.so。

The Android ARM64 APK is signed with the repository's fixed release key. The workflow verified the APK signature, configured certificate SHA-256, version name, application ID, SHA-256, arm64-v8a-only native payload, and the required libbox.so.

第三方许可审计 / Third-party license audit

本次构建的完整审计输出作为 THIRD_PARTY-LICENSE-AUDIT.txt 随 Release 发布。发布门禁要求所有运行时资源的再分发证据均已验证，不允许 Beta 绕过已知缺口。

The complete audit output is attached as THIRD_PARTY-LICENSE-AUDIT.txt. Every binary release, including a beta, must pass the fail-closed redistribution audit with zero unresolved runtime-resource blockers.

Assets 26
Loading