up 7.23.0

https://github.com/2dust/v2rayN/issues/9562

.github/ISSUE_TEMPLATE/01_bug_report.yml

@@ -18,8 +18,8 @@ body:
   - type: input
     id: "os-version"
     attributes:
-      label: "操作系统和版本"
-      description: "操作系统和版本"
+      label: "操作系统 / v2rayN / Core 版本"
+      description: "操作系统 / v2rayN / Core 版本"
     validations:
       required: true
 

.github/workflows/build-all.yml

@@ -70,3 +70,17 @@ jobs:
                 \"release_tag\": \"${{ inputs.release_tag }}\"
               }
             }"
+            
+      - name: Trigger build windows x86
+        if: inputs.release_tag != ''
+        run: |
+          curl -X POST \
+            -H "Accept: application/vnd.github.v3+json" \
+            -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+            https://api.github.com/repos/${{ github.repository }}/actions/workflows/build-windows-x86.yml/dispatches \
+            -d "{
+              \"ref\": \"master\",
+              \"inputs\": {
+                \"release_tag\": \"${{ inputs.release_tag }}\"
+              }
+            }"

.github/workflows/build-linux.yml

@@ -29,14 +29,10 @@ jobs:
 
   deb:
     name: build and release deb x64 & arm64
-    if: |
-      (github.event_name == 'workflow_dispatch' && inputs.release_tag != '') ||
-      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
-    runs-on: ubuntu-24.04
+    if: (github.event_name == 'workflow_dispatch' && inputs.release_tag != '') || (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
+    runs-on: ubuntu-26.04
     container: debian:13
-    env:
-      RELEASE_TAG: ${{ case(inputs.release_tag != '', inputs.release_tag, github.ref_name) }}
-
+    env: { RELEASE_TAG: "${{ case(inputs.release_tag != '', inputs.release_tag, github.ref_name) }}" }
     steps:
     - name: Prepare tools (Debian)
       shell: bash
@@ -44,124 +40,73 @@ jobs:
         set -euo pipefail
         export DEBIAN_FRONTEND=noninteractive
         apt-get update
-        apt-get install -y sudo git rsync findutils tar gzip unzip which curl jq wget file \
-                           ca-certificates desktop-file-utils xdg-utils fakeroot dpkg-dev \
-                           libc6 libgcc-s1 libstdc++6 zlib1g libicu-dev libssl-dev
-
+        apt-get install -y sudo git rsync findutils tar gzip unzip which curl jq wget file ca-certificates desktop-file-utils xdg-utils fakeroot dpkg-dev libc6 libgcc-s1 libstdc++6 zlib1g libicu-dev libssl-dev
     - name: Checkout repo (for scripts)
-      uses: actions/checkout@v6
-      with:
-        submodules: 'recursive'
-        fetch-depth: '0'
-
+      uses: actions/checkout@v7
+      with: { submodules: 'recursive', fetch-depth: '0' }
     - name: Ensure script permissions
       run: chmod 755 package-debian.sh
-
     - name: Package DEB (Debian-family)
       run: ./package-debian.sh "${RELEASE_TAG}" --arch all
-
     - name: Collect DEBs into workspace
       run: |
         mkdir -p "$GITHUB_WORKSPACE/dist/deb"
         rsync -av "$HOME/debbuild/" "$GITHUB_WORKSPACE/dist/deb/" || true
-        find "$GITHUB_WORKSPACE/dist/deb" -name "v2rayn_*_amd64.deb" \
-          -exec mv {} "$GITHUB_WORKSPACE/dist/deb/v2rayN-linux-64.deb" \; || true
-        find "$GITHUB_WORKSPACE/dist/deb" -name "v2rayn_*_arm64.deb" \
-          -exec mv {} "$GITHUB_WORKSPACE/dist/deb/v2rayN-linux-arm64.deb" \; || true
+        find "$GITHUB_WORKSPACE/dist/deb" -name "v2rayn_*_amd64.deb" -exec mv {} "$GITHUB_WORKSPACE/dist/deb/v2rayN-linux-64.deb" \; || true
+        find "$GITHUB_WORKSPACE/dist/deb" -name "v2rayn_*_arm64.deb" -exec mv {} "$GITHUB_WORKSPACE/dist/deb/v2rayN-linux-arm64.deb" \; || true
         echo "==== Dist tree ===="
         ls -R "$GITHUB_WORKSPACE/dist/deb" || true
-
     - name: Upload DEBs to release
       uses: svenstaro/upload-release-action@v2
-      with:
-        file: dist/deb/**/*.deb
-        tag: ${{ env.RELEASE_TAG }}
-        file_glob: true
-        prerelease: true
+      with: { file: "dist/deb/**/*.deb", tag: "${{ env.RELEASE_TAG }}", file_glob: true, prerelease: true }
 
   rpm:
     name: build and release rpm x64 & arm64
-    if: |
-      (github.event_name == 'workflow_dispatch' && inputs.release_tag != '') ||
-      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
-    runs-on: ubuntu-24.04
+    if: (github.event_name == 'workflow_dispatch' && inputs.release_tag != '') || (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
+    runs-on: ubuntu-26.04
     container: registry.access.redhat.com/ubi10/ubi
-    env:
-      RELEASE_TAG: ${{ case(inputs.release_tag != '', inputs.release_tag, github.ref_name) }}
-
+    env: { RELEASE_TAG: "${{ case(inputs.release_tag != '', inputs.release_tag, github.ref_name) }}" }
     steps:
     - name: Prepare tools (Red Hat)
       shell: bash
       run: |
         set -euo pipefail
-
         . /etc/os-release
         EL_MAJOR="${VERSION_ID%%.*}"
         echo "EL_MAJOR=${EL_MAJOR}"
-
         dnf -y makecache || true
         command -v curl >/dev/null || dnf -y install curl ca-certificates
-
         ARCH="$(uname -m)"
         case "$ARCH" in x86_64|aarch64) ;; *) echo "Unsupported arch: $ARCH"; exit 1 ;; esac
 
         install_epel_from_dir() {
           local base="$1" rpm
           echo "Try: $base"
-
-          rpm="$(
-            {
-              curl -fsSL "$base/Packages/"   2>/dev/null
-              curl -fsSL "$base/Packages/e/" 2>/dev/null | sed 's|href="|href="e/|'
-            } |
-            sed -n 's/.*href="\([^"]*epel-release-[^"]*\.noarch\.rpm\)".*/\1/p' |
-            sort -V | tail -n1
-          )" || true
-
-          if [[ -n "$rpm" ]]; then
-            dnf -y install "$base/Packages/$rpm"
-            return 0
-          fi
-          return 1
+          rpm="$({ curl -fsSL "$base/Packages/" 2>/dev/null; curl -fsSL "$base/Packages/e/" 2>/dev/null | sed 's|href="|href="e/|'; } |
+            sed -n 's/.*href="\([^"]*epel-release-[^"]*\.noarch\.rpm\)".*/\1/p' | sort -V | tail -n1)" || true
+          [[ -n "$rpm" ]] || return 1
+          dnf -y install "$base/Packages/$rpm"
         }
 
         FEDORA="https://dl.fedoraproject.org/pub/epel/epel-release-latest-${EL_MAJOR}.noarch.rpm"
+        ROCKY="https://dl.rockylinux.org/pub/rocky/${EL_MAJOR}/extras/${ARCH}/os"
+        ALMA="https://repo.almalinux.org/almalinux/${EL_MAJOR}/extras/${ARCH}/os"
+
         echo "Try Fedora: $FEDORA"
+        curl -fsSLI "$FEDORA" >/dev/null && dnf -y install "$FEDORA" ||
+          install_epel_from_dir "$ROCKY" ||
+          install_epel_from_dir "$ALMA" ||
+          { echo "EPEL bootstrap failed (Fedora/Rocky/Alma)"; exit 1; }
 
-        if curl -fsSLI "$FEDORA" >/dev/null; then
-          dnf -y install "$FEDORA"
-        else
-          ROCKY="https://dl.rockylinux.org/pub/rocky/${EL_MAJOR}/extras/${ARCH}/os"
-          if install_epel_from_dir "$ROCKY"; then
-            :
-          else
-            ALMA="https://repo.almalinux.org/almalinux/${EL_MAJOR}/extras/${ARCH}/os"
-            if install_epel_from_dir "$ALMA"; then
-              :
-            else
-              echo "EPEL bootstrap failed (Fedora/Rocky/Alma)"
-              exit 1
-            fi
-          fi
-        fi
-
-        dnf -y install sudo git rpm-build rpmdevtools dnf-plugins-core \
-                       rsync findutils tar gzip unzip which
-
+        dnf -y install sudo git rpm-build rpmdevtools dnf-plugins-core rsync findutils tar gzip unzip which
         dnf repolist | grep -i epel || true
-
     - name: Checkout repo (for scripts)
-      uses: actions/checkout@v6
-      with:
-        submodules: 'recursive'
-        fetch-depth: '0'
-
+      uses: actions/checkout@v7
+      with: { submodules: 'recursive', fetch-depth: '0' }
     - name: Ensure script permissions
       run: chmod 755 package-rhel.sh
-
     - name: Package RPM (RHEL-family)
       run: ./package-rhel.sh "${RELEASE_TAG}" --arch all
-
     - name: Collect RPMs into workspace
       run: |
         mkdir -p "$GITHUB_WORKSPACE/dist/rpm"
@@ -170,39 +115,26 @@ jobs:
         find "$GITHUB_WORKSPACE/dist/rpm" -name "v2rayN-*-1*.aarch64.rpm" -exec mv {} "$GITHUB_WORKSPACE/dist/rpm/v2rayN-linux-rhel-arm64.rpm" \; || true
         echo "==== Dist tree ===="
         ls -R "$GITHUB_WORKSPACE/dist/rpm" || true
-
     - name: Upload RPMs to release
       uses: svenstaro/upload-release-action@v2
-      with:
-        file: dist/rpm/**/*.rpm
-        tag: ${{ env.RELEASE_TAG }}
-        file_glob: true
-        prerelease: true
+      with: { file: "dist/rpm/**/*.rpm", tag: "${{ env.RELEASE_TAG }}", file_glob: true, prerelease: true }
 
   rpm-riscv64:
     name: build and release rpm riscv64
-    if: |
-      (github.event_name == 'workflow_dispatch' && inputs.release_tag != '') ||
-      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
+    if: (github.event_name == 'workflow_dispatch' && inputs.release_tag != '') || (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
     runs-on: ubuntu-24.04-riscv
     container: rockylinux/rockylinux:10
-    env:
-      RELEASE_TAG: ${{ case(inputs.release_tag != '', inputs.release_tag, github.ref_name) }}
-
+    env: { RELEASE_TAG: "${{ case(inputs.release_tag != '', inputs.release_tag, github.ref_name) }}" }
     steps:
     - name: Prepare tools (Red Hat)
       shell: bash
       run: |
         set -euo pipefail
         dnf -y makecache
-        dnf -y install \
-          sudo git rpm-build rpmdevtools dnf-plugins-core \
-          rsync findutils tar gzip unzip which jq
-
+        dnf -y install sudo git rpm-build rpmdevtools dnf-plugins-core rsync findutils tar gzip unzip which jq
     - name: Checkout repo (for scripts)
       shell: bash
-      env:
-        GITHUB_TOKEN: ${{ github.token }}
+      env: { GITHUB_TOKEN: "${{ github.token }}" }
       run: |
         set -euo pipefail
         rm -rf ./*
@@ -212,37 +144,28 @@ jobs:
         git fetch --depth=1 origin "${GITHUB_SHA}"
         git checkout FETCH_HEAD
         git submodule update --init --recursive
-
     - name: Ensure script permissions
       run: chmod 755 package-rhel-riscv.sh
-
     - name: Package RPM (RHEL-family)
       run: ./package-rhel-riscv.sh "${RELEASE_TAG}"
-
     - name: Collect RPMs into workspace
       run: |
         mkdir -p "$GITHUB_WORKSPACE/dist/rpm-riscv64"
         rsync -av "$HOME/rpmbuild/RPMS/" "$GITHUB_WORKSPACE/dist/rpm-riscv64/" || true
-        find "$GITHUB_WORKSPACE/dist/rpm-riscv64" -name "*.riscv64.rpm" \
-          -exec mv {} "$GITHUB_WORKSPACE/dist/rpm-riscv64/v2rayN-linux-rhel-riscv64.rpm" \; || true
+        find "$GITHUB_WORKSPACE/dist/rpm-riscv64" -name "*.riscv64.rpm" -exec mv {} "$GITHUB_WORKSPACE/dist/rpm-riscv64/v2rayN-linux-rhel-riscv64.rpm" \; || true
         echo "==== Dist tree ===="
         ls -R "$GITHUB_WORKSPACE/dist/rpm-riscv64" || true
-
     - name: Upload RPMs to release
       shell: bash
-      env:
-        GITHUB_TOKEN: ${{ github.token }}
+      env: { GITHUB_TOKEN: "${{ github.token }}" }
       run: |
         set -euo pipefail
         shopt -s globstar nullglob
-
         files=(dist/rpm-riscv64/**/*.rpm)
         (( ${#files[@]} )) || { echo "No RPMs found."; exit 1; }
-
         api="${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases/tags/${RELEASE_TAG}"
         upload_url="$(curl -fsSL -H "Authorization: Bearer ${GITHUB_TOKEN}" "$api" | jq -r '.upload_url // empty' | sed 's/{?name,label}//')"
         [[ "$upload_url" ]] || { echo "Release upload URL not found: ${RELEASE_TAG}"; exit 1; }
-
         for f in "${files[@]}"; do
           echo "Uploading ${f##*/}"
           curl -fsSL -X POST \
@@ -254,14 +177,10 @@ jobs:
 
   deb-riscv64:
     name: build and release deb riscv64
-    if: |
-      (github.event_name == 'workflow_dispatch' && inputs.release_tag != '') ||
-      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
+    if: (github.event_name == 'workflow_dispatch' && inputs.release_tag != '') || (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
     runs-on: ubuntu-24.04-riscv
     container: debian:13
-    env:
-      RELEASE_TAG: ${{ case(inputs.release_tag != '', inputs.release_tag, github.ref_name) }}
-
+    env: { RELEASE_TAG: "${{ case(inputs.release_tag != '', inputs.release_tag, github.ref_name) }}" }
     steps:
     - name: Prepare tools (Debian)
       shell: bash
@@ -269,14 +188,10 @@ jobs:
         set -euo pipefail
         export DEBIAN_FRONTEND=noninteractive
         apt-get update
-        apt-get install -y sudo git rsync findutils tar gzip unzip which curl jq wget file \
-                           ca-certificates desktop-file-utils xdg-utils fakeroot dpkg-dev \
-                           gcc make libc6-dev libgcc-s1 libstdc++6 zlib1g libatomic1
-
+        apt-get install -y sudo git rsync findutils tar gzip unzip which curl jq wget file ca-certificates desktop-file-utils xdg-utils fakeroot dpkg-dev gcc make libc6-dev libgcc-s1 libstdc++6 zlib1g libatomic1
     - name: Checkout repo (for scripts)
       shell: bash
-      env:
-        GITHUB_TOKEN: ${{ github.token }}
+      env: { GITHUB_TOKEN: "${{ github.token }}" }
       run: |
         set -euo pipefail
         rm -rf ./*
@@ -286,37 +201,28 @@ jobs:
         git fetch --depth=1 origin "${GITHUB_SHA}"
         git checkout FETCH_HEAD
         git submodule update --init --recursive
-
     - name: Ensure script permissions
       run: chmod 755 package-debian-riscv.sh
-
     - name: Package DEB (Debian-family)
       run: ./package-debian-riscv.sh "${RELEASE_TAG}"
-
     - name: Collect DEBs into workspace
       run: |
         mkdir -p "$GITHUB_WORKSPACE/dist/deb-riscv64"
         rsync -av "$HOME/debbuild/" "$GITHUB_WORKSPACE/dist/deb-riscv64/" || true
-        find "$GITHUB_WORKSPACE/dist/deb-riscv64" -name "*.deb" \
-          -exec mv {} "$GITHUB_WORKSPACE/dist/deb-riscv64/v2rayN-linux-riscv64.deb" \; || true
+        find "$GITHUB_WORKSPACE/dist/deb-riscv64" -name "*.deb" -exec mv {} "$GITHUB_WORKSPACE/dist/deb-riscv64/v2rayN-linux-riscv64.deb" \; || true
         echo "==== Dist tree ===="
         ls -R "$GITHUB_WORKSPACE/dist/deb-riscv64" || true
-
     - name: Upload DEBs to release
       shell: bash
-      env:
-        GITHUB_TOKEN: ${{ github.token }}
+      env: { GITHUB_TOKEN: "${{ github.token }}" }
       run: |
         set -euo pipefail
         shopt -s globstar nullglob
-
         files=(dist/deb-riscv64/**/*.deb)
         (( ${#files[@]} )) || { echo "No DEBs found."; exit 1; }
-
         api="${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases/tags/${RELEASE_TAG}"
         upload_url="$(curl -fsSL -H "Authorization: Bearer ${GITHUB_TOKEN}" "$api" | jq -r '.upload_url // empty' | sed 's/{?name,label}//')"
         [[ "$upload_url" ]] || { echo "Release upload URL not found: ${RELEASE_TAG}"; exit 1; }
-
         for f in "${files[@]}"; do
           echo "Uploading ${f##*/}"
           curl -fsSL -X POST \
@@ -328,11 +234,8 @@ jobs:
 
   deb-loong64:
     name: build and release deb loong64
-    if: |
-      (github.event_name == 'workflow_dispatch' && inputs.release_tag != '') ||
-      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
-    runs-on: ubuntu-24.04
-
+    if: (github.event_name == 'workflow_dispatch' && inputs.release_tag != '') || (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
+    runs-on: ubuntu-26.04
     env:
       RELEASE_TAG: ${{ case(inputs.release_tag != '', inputs.release_tag, github.ref_name) }}
       QCOW2_URL: https://github.com/xujiegb/debian-loong64-qcow2/releases/download/13.5/debian13-loong64.qcow2
@@ -342,74 +245,72 @@ jobs:
       EFI_CODE: edk2-loongarch64-code.fd
       EFI_VARS: edk2-loongarch64-vars.fd
       QEMU_VERSION: 10.2.3
-
     steps:
     - name: Prepare host tools
       shell: bash
       run: |
         set -euo pipefail
-
         sudo apt-get update
-        sudo apt-get install -y rsync qemu-utils expect wget curl ca-certificates libfdt1 libglib2.0-0 libpixman-1-0 libslirp0
-
-    - name: Checkout repo
-      uses: actions/checkout@v6
-      with:
-        submodules: recursive
-        fetch-depth: 0
-
+        sudo apt-get install -y git rsync qemu-utils qemu-system-common expect wget curl ca-certificates libfdt1 libglib2.0-0 libpixman-1-0 libslirp0 virtiofsd
+        sudo ln -sf /usr/libexec/virtiofsd /usr/local/bin/virtiofsd
+        virtiofsd --version || virtiofsd --help | head
+    - name: Host clone repo
+      shell: bash
+      env: { GITHUB_TOKEN: "${{ github.token }}" }
+      run: |
+        set -euo pipefail
+        rm -rf repo
+        git clone --no-single-branch --tags "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" repo
     - name: Download QEMU prebuild
       run: |
         set -euo pipefail
-
-        wget -O qemu-linux-x64.tar.gz \
-          "https://github.com/xujiegb/qemu-linux-prebuild/releases/download/${QEMU_VERSION}/qemu-linux-x64.tar.gz"
-
-        tar -xzf qemu-linux-x64.tar.gz
-
+        wget -O qemu-linux-x64-v3.tar.gz "https://github.com/xujiegb/qemu-linux-prebuild/releases/download/${QEMU_VERSION}/qemu-linux-x64-v3.tar.gz"
+        tar -xzf qemu-linux-x64-v3.tar.gz
         mkdir -p "$HOME/qemu-install"
-
-        rsync -a qemu-linux-x64/ "$HOME/qemu-install/"
-
+        rsync -a qemu-linux-x64-v3/ "$HOME/qemu-install/"
         "$HOME/qemu-install/bin/qemu-system-loongarch64" --version
-
     - name: Download loong64 qcow2 and EFI firmware
       shell: bash
       run: |
         set -euo pipefail
-
         wget -O "$QCOW2_IMAGE" "$QCOW2_URL"
         wget -O "$EFI_CODE" "$EFI_CODE_URL"
         wget -O "$EFI_VARS" "$EFI_VARS_URL"
-
         qemu-img info "$QCOW2_IMAGE"
-
     - name: Build loong64 DEB in VM through serial console
       shell: bash
       timeout-minutes: 180
-      env:
-        RELEASE_TAG: ${{ env.RELEASE_TAG }}
+      env: { RELEASE_TAG: "${{ env.RELEASE_TAG }}" }
       run: |
         set -euo pipefail
-
         mkdir -p "$GITHUB_WORKSPACE/dist/deb-loong64"
 
+        export VIRTIOFSD_SOCKET="$RUNNER_TEMP/virtiofs-deb-loong64.sock"
+        rm -f "$VIRTIOFSD_SOCKET"
+
+        sudo virtiofsd --socket-path="$VIRTIOFSD_SOCKET" -o source="$GITHUB_WORKSPACE" -o cache=auto &
+
+        VIRTIOFSD_PID=$!
+        trap 'sudo kill "$VIRTIOFSD_PID" 2>/dev/null || true; rm -f "$VIRTIOFSD_SOCKET"' EXIT
+
+        for i in {1..100}; do
+          [[ -S "$VIRTIOFSD_SOCKET" ]] && break
+          sleep 0.1
+        done
+
+        [[ -S "$VIRTIOFSD_SOCKET" ]] || { echo "virtiofsd socket not created"; exit 1; }
+        sudo chown "$USER:$(id -gn)" "$VIRTIOFSD_SOCKET" || true
+        sudo chmod 660 "$VIRTIOFSD_SOCKET" || true
         expect <<'EOF'
         log_user 1
         set timeout -1
-
         set release_tag $env(RELEASE_TAG)
         set qemu_bin "$env(HOME)/qemu-install/bin/qemu-system-loongarch64"
         set qemu_rom_dir "$env(HOME)/qemu-install/share/qemu"
-
-        set workspace $env(GITHUB_WORKSPACE)
-        set repo $env(GITHUB_REPOSITORY)
-        set sha $env(GITHUB_SHA)
-
+        set virtiofs_socket $env(VIRTIOFSD_SOCKET)
         set qcow2 $env(QCOW2_IMAGE)
         set efi_code $env(EFI_CODE)
         set efi_vars $env(EFI_VARS)
-
         proc wait_prompt {} {
           expect {
             -re "__CI_PROMPT__# " {}
@@ -417,86 +318,216 @@ jobs:
             eof { exit 1 }
           }
         }
-
         proc run_cmd {cmd} {
           send -- "$cmd\r"
           wait_prompt
         }
-
         spawn $qemu_bin \
           -L $qemu_rom_dir \
           -machine virt \
           -accel tcg,thread=multi,tb-size=2048 \
           -cpu la464 \
           -m 9216 \
+          -object memory-backend-memfd,id=mem0,size=9216M,share=on \
+          -numa node,memdev=mem0 \
           -smp 4 \
           -drive if=pflash,format=raw,unit=0,file=$efi_code,readonly=on \
           -drive if=pflash,format=raw,unit=1,file=$efi_vars \
           -device virtio-blk-pci,drive=hd0,bootindex=1 \
           -drive if=none,media=disk,id=hd0,file=$qcow2,format=qcow2 \
           -netdev user,id=net0 \
-          -device virtio-net-pci,netdev=net0 \
-          -virtfs local,path=$workspace,mount_tag=workspace,security_model=none,id=workspace \
+          -device virtio-net-pci-non-transitional,netdev=net0 \
+          -chardev socket,id=charfs0,path=$virtiofs_socket \
+          -device vhost-user-fs-pci,chardev=charfs0,tag=workspace \
           -display none \
           -serial stdio \
           -monitor none
-
         expect -re "login:|debian login:"
         send -- "root\r"
-
         expect -re "Password:|密码:|密码："
         send -- "password\r"
-
         expect {
           -re "# " {}
           timeout { exit 1 }
           eof { exit 1 }
         }
-
         send -- "export TERM=dumb; export PS1='__CI_PROMPT__# '\r"
         wait_prompt
-
         run_cmd "mkdir -p /workspace"
-        run_cmd "mount -t 9p -o trans=virtio,version=9p2000.L workspace /workspace || mount -t 9p -o trans=virtio workspace /workspace"
+        run_cmd "mount -t virtiofs workspace /workspace"
         run_cmd "IFACE=\$(ip -o link show | awk -F': ' '\$2 != \"lo\" {print \$2; exit}') ; ip link set \$IFACE up || true"
         run_cmd "dhclient \$IFACE || true"
         run_cmd "printf 'nameserver 10.0.2.3\nnameserver 1.1.1.1\n' >/etc/resolv.conf"
         run_cmd "apt-get update || apt-get update || apt-get update"
-        run_cmd "DEBIAN_FRONTEND=noninteractive apt-get install -y sudo git rsync findutils tar gzip unzip which curl jq wget file ca-certificates desktop-file-utils xdg-utils fakeroot dpkg-dev gcc make libc6-dev libgcc-s1 libstdc++6 zlib1g libatomic1"
+        run_cmd "DEBIAN_FRONTEND=noninteractive apt-get install -y sudo git rsync findutils tar gzip unzip which curl jq wget file ca-certificates desktop-file-utils xdg-utils fakeroot dpkg-dev gcc make libc6-dev libgcc-s1 libstdc++6 zlib1g libatomic1 fuse3"
         run_cmd "rm -rf /root/v2rayN-src"
-        run_cmd "git clone --recursive https://github.com/$repo.git /root/v2rayN-src"
-        run_cmd "cd /root/v2rayN-src && git fetch --depth=1 origin $sha && git checkout FETCH_HEAD && git submodule update --init --recursive"
+        run_cmd "rsync -a --info=progress2 /workspace/repo/ /root/v2rayN-src/"
+        run_cmd "cd /root/v2rayN-src && git config --global --add safe.directory /root/v2rayN-src"
         run_cmd "cd /root/v2rayN-src && chmod 755 package-debian-loong.sh"
-
         send -- "cd /root/v2rayN-src; cat >/tmp/run-loong-build.sh <<'SCRIPT'\nset +e\nset -o pipefail\nbash -x ./package-debian-loong.sh \"\$RELEASE_TAG\" 2>&1 | tee /tmp/build.log\nrc=\$?\nmkdir -p /workspace/dist/deb-loong64\ncp -av /root/debbuild/*.deb /workspace/dist/deb-loong64/ 2>/dev/null || true\necho __BUILD_DONE__\$rc\nSCRIPT\nRELEASE_TAG=\"$release_tag\" bash /tmp/run-loong-build.sh\r"
-
         expect {
-          -re "__BUILD_DONE__0" {
-            send -- "poweroff\r"
-          }
-          default {
-            exit 1
-          }
+          -re "__BUILD_DONE__0" { send -- "poweroff\r" }
+          default { exit 1 }
         }
         EOF
-
     - name: Collect DEBs
       shell: bash
       run: |
         set -euo pipefail
-
         mkdir -p "$GITHUB_WORKSPACE/dist/deb-loong64"
-
-        find "$GITHUB_WORKSPACE/dist/deb-loong64" -name "*.deb" \
-          -exec mv {} "$GITHUB_WORKSPACE/dist/deb-loong64/v2rayN-linux-loong64.deb" \; || true
-
+        find "$GITHUB_WORKSPACE/dist/deb-loong64" -name "*.deb" -exec mv {} "$GITHUB_WORKSPACE/dist/deb-loong64/v2rayN-linux-loong64.deb" \; || true
         echo "==== Dist tree ===="
         ls -R "$GITHUB_WORKSPACE/dist/deb-loong64"
-
     - name: Upload DEBs to release
       uses: svenstaro/upload-release-action@v2
-      with:
-        file: dist/deb-loong64/**/*.deb
-        tag: ${{ env.RELEASE_TAG }}
-        file_glob: true
-        prerelease: true
+      with: { file: "dist/deb-loong64/**/*.deb", tag: "${{ env.RELEASE_TAG }}", file_glob: true, prerelease: true }
+
+  rpm-loong64:
+    name: build and release rpm loong64
+    if: (github.event_name == 'workflow_dispatch' && inputs.release_tag != '') || (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
+    runs-on: ubuntu-26.04
+    env:
+      RELEASE_TAG: ${{ case(inputs.release_tag != '', inputs.release_tag, github.ref_name) }}
+      QCOW2_URL: https://github.com/xujiegb/fedora-loong64-qcow2/releases/download/43/fedora43-loong64.qcow2
+      EFI_CODE_URL: https://github.com/xujiegb/fedora-loong64-qcow2/releases/download/43/edk2-loongarch64-code.fd
+      EFI_VARS_URL: https://github.com/xujiegb/fedora-loong64-qcow2/releases/download/43/edk2-loongarch64-vars.fd
+      QCOW2_IMAGE: fedora43-loong64.qcow2
+      EFI_CODE: edk2-loongarch64-code.fd
+      EFI_VARS: edk2-loongarch64-vars.fd
+      QEMU_VERSION: 10.2.3
+    steps:
+    - name: Prepare host tools
+      shell: bash
+      run: |
+        set -euo pipefail
+        sudo apt-get update
+        sudo apt-get install -y git rsync qemu-utils qemu-system-common expect wget curl ca-certificates libfdt1 libglib2.0-0 libpixman-1-0 libslirp0 virtiofsd
+        sudo ln -sf /usr/libexec/virtiofsd /usr/local/bin/virtiofsd
+        virtiofsd --version || virtiofsd --help | head
+    - name: Host clone repo
+      shell: bash
+      env: { GITHUB_TOKEN: "${{ github.token }}" }
+      run: |
+        set -euo pipefail
+        rm -rf repo
+        git clone --no-single-branch --tags "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" repo
+    - name: Download QEMU prebuild
+      run: |
+        set -euo pipefail
+        wget -O qemu-linux-x64-v3.tar.gz "https://github.com/xujiegb/qemu-linux-prebuild/releases/download/${QEMU_VERSION}/qemu-linux-x64-v3.tar.gz"
+        tar -xzf qemu-linux-x64-v3.tar.gz
+        mkdir -p "$HOME/qemu-install"
+        rsync -a qemu-linux-x64-v3/ "$HOME/qemu-install/"
+        "$HOME/qemu-install/bin/qemu-system-loongarch64" --version
+    - name: Download loong64 qcow2 and EFI firmware
+      shell: bash
+      run: |
+        set -euo pipefail
+        wget -O "$QCOW2_IMAGE" "$QCOW2_URL"
+        wget -O "$EFI_CODE" "$EFI_CODE_URL"
+        wget -O "$EFI_VARS" "$EFI_VARS_URL"
+        qemu-img info "$QCOW2_IMAGE"
+    - name: Build loong64 RPM in VM through serial console
+      shell: bash
+      timeout-minutes: 180
+      env: { RELEASE_TAG: "${{ env.RELEASE_TAG }}" }
+      run: |
+        set -euo pipefail
+        mkdir -p "$GITHUB_WORKSPACE/dist/rpm-loong64"
+
+        export VIRTIOFSD_SOCKET="$RUNNER_TEMP/virtiofs-rpm-loong64.sock"
+        rm -f "$VIRTIOFSD_SOCKET"
+
+        sudo virtiofsd --socket-path="$VIRTIOFSD_SOCKET" -o source="$GITHUB_WORKSPACE" -o cache=auto &
+
+        VIRTIOFSD_PID=$!
+        trap 'sudo kill "$VIRTIOFSD_PID" 2>/dev/null || true; rm -f "$VIRTIOFSD_SOCKET"' EXIT
+
+        for i in {1..100}; do
+          [[ -S "$VIRTIOFSD_SOCKET" ]] && break
+          sleep 0.1
+        done
+
+        [[ -S "$VIRTIOFSD_SOCKET" ]] || { echo "virtiofsd socket not created"; exit 1; }
+        sudo chown "$USER:$(id -gn)" "$VIRTIOFSD_SOCKET" || true
+        sudo chmod 660 "$VIRTIOFSD_SOCKET" || true
+        expect <<'EOF'
+        log_user 1
+        set timeout -1
+        set release_tag $env(RELEASE_TAG)
+        set qemu_bin "$env(HOME)/qemu-install/bin/qemu-system-loongarch64"
+        set qemu_rom_dir "$env(HOME)/qemu-install/share/qemu"
+        set virtiofs_socket $env(VIRTIOFSD_SOCKET)
+        set qcow2 $env(QCOW2_IMAGE)
+        set efi_code $env(EFI_CODE)
+        set efi_vars $env(EFI_VARS)
+        proc wait_prompt {} {
+          expect {
+            -re "__CI_PROMPT__# " {}
+            timeout { exit 1 }
+            eof { exit 1 }
+          }
+        }
+        proc run_cmd {cmd} {
+          send -- "$cmd\r"
+          wait_prompt
+        }
+        spawn $qemu_bin \
+          -L $qemu_rom_dir \
+          -machine virt \
+          -accel tcg,thread=multi,tb-size=2048 \
+          -cpu la464 \
+          -m 9216 \
+          -object memory-backend-memfd,id=mem0,size=9216M,share=on \
+          -numa node,memdev=mem0 \
+          -smp 4 \
+          -drive if=pflash,format=raw,unit=0,file=$efi_code,readonly=on \
+          -drive if=pflash,format=raw,unit=1,file=$efi_vars \
+          -device virtio-blk-pci,drive=hd0,bootindex=1 \
+          -drive if=none,media=disk,id=hd0,file=$qcow2,format=qcow2 \
+          -netdev user,id=net0 \
+          -device virtio-net-pci-non-transitional,netdev=net0 \
+          -chardev socket,id=charfs0,path=$virtiofs_socket \
+          -device vhost-user-fs-pci,chardev=charfs0,tag=workspace \
+          -display none \
+          -serial stdio \
+          -monitor none
+        expect -re "login:|fedora login:"
+        send -- "root\r"
+        expect -re "Password:|密码:|密码："
+        send -- "password\r"
+        expect {
+          -re "# " {}
+          timeout { exit 1 }
+          eof { exit 1 }
+        }
+        send -- "export TERM=dumb; export PS1='__CI_PROMPT__# '\r"
+        wait_prompt
+        run_cmd "mkdir -p /workspace"
+        run_cmd "mount -t virtiofs workspace /workspace"
+        run_cmd "IFACE=\$(ip -o link show | awk -F': ' '\$2 != \"lo\" {print \$2; exit}') ; ip link set \$IFACE up || true"
+        run_cmd "dhclient \$IFACE || true"
+        run_cmd "printf 'nameserver 10.0.2.3\nnameserver 1.1.1.1\n' >/etc/resolv.conf"
+        run_cmd "dnf -y makecache || dnf -y makecache || dnf -y makecache"
+        run_cmd "dnf -y install sudo git rpm-build rpmdevtools dnf-plugins-core rsync findutils tar gzip unzip which curl jq file ca-certificates fuse3 --nogpgcheck"
+        run_cmd "rm -rf /root/v2rayN-src"
+        run_cmd "rsync -a --info=progress2 /workspace/repo/ /root/v2rayN-src/"
+        run_cmd "cd /root/v2rayN-src && git config --global --add safe.directory /root/v2rayN-src"
+        run_cmd "cd /root/v2rayN-src && chmod 755 package-rhel-loong.sh"
+        send -- "cd /root/v2rayN-src; cat >/tmp/run-loong-rpm-build.sh <<'SCRIPT'\nset +e\nset -o pipefail\nbash -x ./package-rhel-loong.sh \"\$RELEASE_TAG\" 2>&1 | tee /tmp/build.log\nrc=\$?\nmkdir -p /workspace/dist/rpm-loong64\nfind /root/rpmbuild/RPMS -name '*.rpm' -exec cp -av {} /workspace/dist/rpm-loong64/ \\; 2>/dev/null || true\necho __BUILD_DONE__\$rc\nSCRIPT\nRELEASE_TAG=\"$release_tag\" bash /tmp/run-loong-rpm-build.sh\r"
+        expect {
+          -re "__BUILD_DONE__0" { send -- "poweroff\r" }
+          default { exit 1 }
+        }
+        EOF
+    - name: Collect RPMs
+      shell: bash
+      run: |
+        set -euo pipefail
+        mkdir -p "$GITHUB_WORKSPACE/dist/rpm-loong64"
+        find "$GITHUB_WORKSPACE/dist/rpm-loong64" -name "*.loongarch64.rpm" -exec mv {} "$GITHUB_WORKSPACE/dist/rpm-loong64/v2rayN-linux-rhel-loong64.rpm" \; || true
+        echo "==== Dist tree ===="
+        ls -R "$GITHUB_WORKSPACE/dist/rpm-loong64"
+    - name: Upload RPMs to release
+      uses: svenstaro/upload-release-action@v2
+      with: { file: "dist/rpm-loong64/**/*.rpm", tag: "${{ env.RELEASE_TAG }}", file_glob: true, prerelease: true }

.github/workflows/build-osx.yml

@@ -45,7 +45,7 @@ jobs:
         }} 
     steps:
     - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
 
     - name: Restore build artifacts
       uses: actions/download-artifact@v8

.github/workflows/build-windows-x86.yml

@@ -0,0 +1,231 @@
+name: release Windows x86
+
+on:
+  workflow_dispatch:
+    inputs:
+      release_tag:
+        required: false
+        type: string
+
+permissions:
+  contents: write
+
+jobs:
+  package-x86:
+    name: build and release windows x86 WPF & Avalonia
+    if: inputs.release_tag != ''
+    runs-on: windows-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - flavor: wpf
+            project: ./v2rayN/v2rayN/v2rayN.csproj
+            zip_name: v2rayN-windows-86.zip
+          - flavor: desktop
+            project: ./v2rayN/v2rayN.Desktop/v2rayN.Desktop.csproj
+            zip_name: v2rayN-windows-86-desktop.zip
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          submodules: recursive
+          fetch-depth: 0
+
+      - name: Purge SDKs
+        shell: pwsh
+        run: |
+          echo "Before:"
+          dotnet --list-sdks
+          
+          dotnet --list-sdks | % {
+            $_ -match '^\S+\s+\[(.+)\]$' > $null
+            $d = Join-Path $Matches[1] $_.Split()[0]
+            Write-Host "Removing $d"
+            if ($IsWindows) { rm $d -r -fo } else { sudo rm -rf "$d" }
+          }
+
+          echo "After:"
+          dotnet --list-sdks 2>$null; $LASTEXITCODE=0
+
+      - name: Setup .NET 10.0.1xx
+        uses: actions/setup-dotnet@v5.3.0
+        with:
+          dotnet-version: 10.0.1xx
+
+      - name: Publish ${{ matrix.flavor }} win-x86
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = "Stop"
+
+          dotnet restore "${{ matrix.project }}" -r win-x86
+
+          dotnet publish "${{ matrix.project }}" `
+            -c Release `
+            -r win-x86 `
+            -p:SelfContained=true `
+            -p:EnableWindowsTargeting=true `
+            -o "publish/${{ matrix.flavor }}"
+
+      - name: Publish AmazTool win-x86
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = "Stop"
+
+          dotnet publish "./v2rayN/AmazTool/AmazTool.csproj" `
+            -c Release `
+            -r win-x86 `
+            -p:SelfContained=true `
+            -p:PublishTrimmed=true `
+            -p:EnableWindowsTargeting=true `
+            -o "publish/${{ matrix.flavor }}"
+
+      - name: Detect bundled core versions
+        id: detect-core
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = "Stop"
+
+          New-Item -ItemType Directory -Force -Path "tmp/probe" | Out-Null
+
+          Invoke-WebRequest -Uri "https://github.com/2dust/v2rayN-core-bin/raw/refs/heads/master/v2rayN-windows-64/bin/xray/xray.exe" -OutFile "tmp/probe/xray.exe"
+          $xrayOutput = (& "tmp/probe/xray.exe" version) -join "`n"
+          Write-Host $xrayOutput
+
+          $xrayMatch = [regex]::Match($xrayOutput, 'Xray\s+([0-9.]+)')
+          if ($xrayMatch.Success) {
+            $xrayVer = $xrayMatch.Groups[1].Value
+          } else {
+            throw "Failed to detect Xray version"
+          }
+
+          Invoke-WebRequest -Uri "https://github.com/2dust/v2rayN-core-bin/raw/refs/heads/master/v2rayN-windows-64/bin/sing_box/sing-box.exe" -OutFile "tmp/probe/sing-box.exe"
+          $singOutput = (& "tmp/probe/sing-box.exe" version) -join "`n"
+          Write-Host $singOutput
+
+          $singMatch = [regex]::Match($singOutput, 'sing-box version\s+([0-9.]+)')
+          if ($singMatch.Success) {
+            $singVer = $singMatch.Groups[1].Value
+          } else {
+            throw "Failed to detect sing-box version"
+          }
+
+          Write-Host "Bundled Xray version: $xrayVer"
+          Write-Host "Bundled sing-box version: $singVer"
+
+          "xray_version=$xrayVer" >> $env:GITHUB_OUTPUT
+          "sing_version=$singVer" >> $env:GITHUB_OUTPUT
+
+      - name: Download x86 cores and rule assets
+        shell: pwsh
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          $ErrorActionPreference = "Stop"
+
+          $headers = @{
+            Authorization = "Bearer $env:GH_TOKEN"
+            Accept = "application/vnd.github+json"
+            "X-GitHub-Api-Version" = "2022-11-28"
+          }
+
+          $root = "publish/${{ matrix.flavor }}"
+          $bin = Join-Path $root "bin"
+          $xrayDir = Join-Path $bin "xray"
+          $singDir = Join-Path $bin "sing_box"
+          $srssDir = Join-Path $bin "srss"
+
+          New-Item -ItemType Directory -Force -Path $xrayDir, $singDir, $srssDir | Out-Null
+
+          $xrayVer = "${{ steps.detect-core.outputs.xray_version }}"
+          $singVer = "${{ steps.detect-core.outputs.sing_version }}"
+
+          $xrayTag = "v$xrayVer"
+          $singTag = "v$singVer"
+
+          $xrayUrl = "https://github.com/autorepobot/Xray-core/releases/download/$xrayTag/Xray-windows-32.zip"
+          $singUrl = "https://github.com/SagerNet/sing-box/releases/download/$singTag/sing-box-$singVer-windows-386.zip"
+
+          Write-Host "Bundled Xray version: $xrayVer"
+          Write-Host "Bundled sing-box version: $singVer"
+          Write-Host "Xray: $xrayUrl"
+          Write-Host "sing-box: $singUrl"
+
+          New-Item -ItemType Directory -Force -Path "tmp" | Out-Null
+
+          Invoke-WebRequest -Uri $xrayUrl -OutFile "tmp/xray.zip"
+          Expand-Archive -Force "tmp/xray.zip" "tmp/xray"
+
+          Get-ChildItem "tmp/xray" -Recurse -Include "*.exe","*.dll" | ForEach-Object {
+            Copy-Item $_.FullName (Join-Path $xrayDir $_.Name) -Force
+          }
+
+          Invoke-WebRequest -Uri $singUrl -OutFile "tmp/sing-box.zip"
+          Expand-Archive -Force "tmp/sing-box.zip" "tmp/sing-box"
+
+          $singExe = Get-ChildItem "tmp/sing-box" -Recurse -Filter "sing-box.exe" | Select-Object -First 1
+          if (-not $singExe) {
+            throw "sing-box.exe not found"
+          }
+
+          Copy-Item $singExe.FullName "$singDir/sing-box.exe" -Force
+
+          $cronet = Get-ChildItem "tmp/sing-box" -Recurse -Filter "libcronet*.dll" | Select-Object -First 1
+          if ($cronet) {
+            Copy-Item $cronet.FullName "$singDir/libcronet.dll" -Force
+          }
+
+          Invoke-WebRequest -Uri "https://github.com/Loyalsoldier/V2ray-rules-dat/releases/latest/download/geosite.dat" -OutFile "$bin/geosite.dat"
+          Invoke-WebRequest -Uri "https://github.com/Loyalsoldier/V2ray-rules-dat/releases/latest/download/geoip.dat" -OutFile "$bin/geoip.dat"
+          Invoke-WebRequest -Uri "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/geoip-only-cn-private.dat" -OutFile "$bin/geoip-only-cn-private.dat"
+          Invoke-WebRequest -Uri "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/Country.mmdb" -OutFile "$bin/Country.mmdb"
+          Invoke-WebRequest -Uri "https://github.com/MetaCubeX/meta-rules-dat/releases/latest/download/geoip.metadb" -OutFile "$bin/geoip.metadb"
+
+          $geoipRules = @(
+            "geoip-private.srs",
+            "geoip-cn.srs",
+            "geoip-facebook.srs",
+            "geoip-fastly.srs",
+            "geoip-google.srs",
+            "geoip-netflix.srs",
+            "geoip-telegram.srs",
+            "geoip-twitter.srs"
+          )
+
+          foreach ($f in $geoipRules) {
+            Invoke-WebRequest -Uri "https://raw.githubusercontent.com/2dust/sing-box-rules/refs/heads/rule-set-geoip/$f" -OutFile "$srssDir/$f"
+          }
+
+          $geositeRules = @(
+            "geosite-cn.srs",
+            "geosite-gfw.srs",
+            "geosite-google.srs",
+            "geosite-greatfire.srs",
+            "geosite-geolocation-cn.srs",
+            "geosite-category-ads-all.srs",
+            "geosite-private.srs"
+          )
+
+          foreach ($f in $geositeRules) {
+            Invoke-WebRequest -Uri "https://raw.githubusercontent.com/2dust/sing-box-rules/refs/heads/rule-set-geosite/$f" -OutFile "$srssDir/$f"
+          }
+
+      - name: Package zip
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = "Stop"
+
+          Compress-Archive `
+            -Path "publish/${{ matrix.flavor }}/*" `
+            -DestinationPath "${{ matrix.zip_name }}" `
+            -Force
+
+      - name: Upload zip archive to release
+        uses: svenstaro/upload-release-action@v2
+        with:
+          file: ${{ matrix.zip_name }}
+          tag: ${{ inputs.release_tag }}
+          prerelease: true
+          overwrite: true

.github/workflows/build.yml

@@ -46,11 +46,27 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
       with:
         submodules: 'recursive'
         fetch-depth: '0'
 
+    - name: Purge SDKs
+      shell: pwsh
+      run: |
+        echo "Before:"
+        dotnet --list-sdks
+        
+        dotnet --list-sdks | % {
+          $_ -match '^\S+\s+\[(.+)\]$' > $null
+          $d = Join-Path $Matches[1] $_.Split()[0]
+          Write-Host "Removing $d"
+          if ($IsWindows) { rm $d -r -fo } else { sudo rm -rf "$d" }
+        }
+        
+        echo "After:"
+        dotnet --list-sdks 2>$null; $LASTEXITCODE=0
+
     - name: Setup .NET
       uses: actions/setup-dotnet@v5.3.0
       with:
@@ -68,4 +84,4 @@ jobs:
       uses: actions/upload-artifact@v7.0.1
       with:
         name: ${{ matrix.arch }}
-        path: ${{ matrix.arch }}
+        path: ${{ matrix.arch }}

.github/workflows/package-zip.yml

@@ -37,7 +37,7 @@ jobs:
         }}
     steps:
     - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
 
     - name: Restore build artifacts
       uses: actions/download-artifact@v8

.github/workflows/test.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
       with:
         submodules: 'recursive'
         fetch-depth: '0'

package-debian-loong.sh

@@ -13,8 +13,8 @@ PKGROOT="v2rayN-publish"
 PROJECT_HINT="v2rayN.Desktop/v2rayN.Desktop.csproj"
 OUTPUT_DIR="${HOME}/debbuild"
 DOTNET_TFM="net10.0"
-DOTNET_LOONGARCH_VERSION="10.0.108"
-DOTNET_LOONGARCH_TAG="v10.0.108-loongarch64"
+DOTNET_LOONGARCH_VERSION="10.0.109"
+DOTNET_LOONGARCH_TAG="v10.0.109-loongarch64"
 DOTNET_LOONGARCH_BASE="https://github.com/loongson/dotnet/releases/download"
 DOTNET_LOONGARCH_FILE="dotnet-sdk-${DOTNET_LOONGARCH_VERSION}-linux-loongarch64.tar.gz"
 DOTNET_SDK_URL="${DOTNET_LOONGARCH_BASE}/${DOTNET_LOONGARCH_TAG}/${DOTNET_LOONGARCH_FILE}"

package-debian-riscv.sh

@@ -12,7 +12,7 @@ MIN_KERNEL="5.10"
 PKGROOT="v2rayN-publish"
 PROJECT_HINT="v2rayN.Desktop/v2rayN.Desktop.csproj"
 OUTPUT_DIR="${HOME}/debbuild"
-DOTNET_RISCV_VERSION="10.0.108"
+DOTNET_RISCV_VERSION="10.0.109"
 DOTNET_RISCV_BASE="https://github.com/xujiegb/dotnet-riscv/releases/download"
 DOTNET_RISCV_FILE="dotnet-sdk-${DOTNET_RISCV_VERSION}-linux-riscv64.tar.gz"
 DOTNET_SDK_URL="${DOTNET_RISCV_BASE}/${DOTNET_RISCV_VERSION}/${DOTNET_RISCV_FILE}"

package-rhel-loong.sh

@@ -0,0 +1,709 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+VERSION_ARG=""
+WITH_CORE="both"
+FORCE_NETCORE=0
+BUILD_FROM=""
+XRAY_VER="${XRAY_VER:-}"
+SING_VER="${SING_VER:-}"
+
+MIN_KERNEL="5.10"
+PKGROOT="v2rayN-publish"
+PROJECT_HINT="v2rayN.Desktop/v2rayN.Desktop.csproj"
+RPM_TOPDIR="${HOME}/rpmbuild"
+DOTNET_LOONGARCH_VERSION="10.0.109"
+DOTNET_LOONGARCH_TAG="v10.0.109-loongarch64"
+DOTNET_LOONGARCH_BASE="https://github.com/loongson/dotnet/releases/download"
+DOTNET_LOONGARCH_FILE="dotnet-sdk-${DOTNET_LOONGARCH_VERSION}-linux-loongarch64.tar.gz"
+DOTNET_SDK_URL="${DOTNET_LOONGARCH_BASE}/${DOTNET_LOONGARCH_TAG}/${DOTNET_LOONGARCH_FILE}"
+
+OS_ID=""
+OS_NAME=""
+OS_VERSION_ID=""
+HOST_ARCH=""
+SCRIPT_DIR=""
+PROJECT=""
+VERSION=""
+
+declare -a BUILT_RPMS=()
+
+die() {
+  echo "$*" >&2
+  exit 1
+}
+
+parse_args() {
+  local first_arg="${1:-}"
+
+  if [[ -n "$first_arg" && "$first_arg" != --* ]]; then
+    VERSION_ARG="$first_arg"
+    shift || true
+  fi
+
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --with-core)   WITH_CORE="${2:-both}"; shift 2 ;;
+      --xray-ver)    XRAY_VER="${2:-}"; shift 2 ;;
+      --singbox-ver) SING_VER="${2:-}"; shift 2 ;;
+      --netcore)     FORCE_NETCORE=1; shift ;;
+      --buildfrom)   BUILD_FROM="${2:-}"; shift 2 ;;
+      *)
+        [[ -n "${VERSION_ARG:-}" ]] || VERSION_ARG="$1"
+        shift
+        ;;
+    esac
+  done
+
+  if [[ -n "${VERSION_ARG:-}" && -n "${BUILD_FROM:-}" ]]; then
+    die "You cannot specify both an explicit version and --buildfrom at the same time.
+        Provide either a version (e.g. 7.14.0) OR --buildfrom 1|2|3."
+  fi
+}
+
+detect_environment() {
+  local current_kernel=""
+  local lowest=""
+
+  . /etc/os-release
+
+  OS_ID="${ID:-}"
+  OS_NAME="${NAME:-$OS_ID}"
+  OS_VERSION_ID="${VERSION_ID:-}"
+  HOST_ARCH="$(uname -m)"
+
+  case "$OS_ID" in
+    rhel|rocky|almalinux|fedora|centos)
+      echo "Detected supported system: ${OS_NAME:-$OS_ID} ${OS_VERSION_ID:-}"
+      ;;
+    *)
+      die "Unsupported system: ${OS_NAME:-unknown} (${OS_ID:-unknown}).
+This script only supports: RHEL / Rocky / AlmaLinux / Fedora / CentOS."
+      ;;
+  esac
+
+  case "$HOST_ARCH" in
+    loongarch64) ;;
+    *) die "Only supports loongarch64" ;;
+  esac
+
+  current_kernel="$(uname -r)"
+  lowest="$(printf '%s\n%s\n' "$MIN_KERNEL" "$current_kernel" | sort -V | head -n1)"
+
+  [[ "$lowest" == "$MIN_KERNEL" ]] || die "Kernel $current_kernel is below $MIN_KERNEL"
+  echo "[OK] Kernel $current_kernel verified."
+}
+
+install_dependencies() {
+  local install_ok=0
+  local tmp_dotnet=""
+
+  if command -v dnf >/dev/null 2>&1; then
+    sudo dnf -y --nogpgcheck install \
+      rpm-build rpmdevtools curl unzip tar jq rsync git python3 \
+      glibc-devel kernel-headers libatomic file ca-certificates libicu \
+      && install_ok=1
+
+    mkdir -p "$HOME/.dotnet"
+    tmp_dotnet="$(mktemp -d)"
+    curl -fL "$DOTNET_SDK_URL" -o "$tmp_dotnet/$DOTNET_LOONGARCH_FILE"
+    tar -C "$HOME/.dotnet" -xzf "$tmp_dotnet/$DOTNET_LOONGARCH_FILE"
+    rm -rf "$tmp_dotnet"
+
+    export PATH="$HOME/.dotnet:$PATH"
+    export DOTNET_ROOT="$HOME/.dotnet"
+
+    mkdir -p "$HOME/.nuget/NuGet"
+
+    cat > "$HOME/.nuget/NuGet/NuGet.Config" <<EOF
+<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+  <packageSources>
+    <clear />
+    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
+    <add key="loongnix" value="https://lnuget.loongnix.cn/v3/index.json" allowInsecureConnections="true" />
+  </packageSources>
+</configuration>
+EOF
+
+    dotnet --info >/dev/null 2>&1 || install_ok=0
+  fi
+
+  if [[ "$install_ok" -ne 1 ]]; then
+    echo "Could not auto-install dependencies for '$OS_ID'. Make sure these are available:"
+    echo "dotnet-loongarch SDK, curl, unzip, tar, rsync, git, python3, rpm, rpmdevtools, rpm-build (on Red Hat branch)"
+    exit 1
+  fi
+}
+
+prepare_workspace() {
+  SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+  cd "$SCRIPT_DIR"
+
+  if [[ -f .gitmodules ]]; then
+    git submodule sync --recursive || true
+    git submodule update --init --recursive || true
+  fi
+
+  PROJECT="$PROJECT_HINT"
+  [[ -f "$PROJECT" ]] || PROJECT="$(find . -maxdepth 3 -name 'v2rayN.Desktop.csproj' | head -n1 || true)"
+  [[ -f "$PROJECT" ]] || die "v2rayN.Desktop.csproj not found"
+}
+
+choose_channel() {
+  local ch="latest"
+  local sel=""
+
+  if [[ -n "${BUILD_FROM:-}" ]]; then
+    case "$BUILD_FROM" in
+      1) echo "latest"; return 0 ;;
+      2) echo "prerelease"; return 0 ;;
+      3) echo "keep"; return 0 ;;
+      *) die "[ERROR] Invalid --buildfrom value: ${BUILD_FROM}. Use 1|2|3." ;;
+    esac
+  fi
+
+  if [[ -t 0 ]]; then
+    echo "[?] Choose v2rayN release channel:" >&2
+    echo "    1) Latest (stable)  [default]" >&2
+    echo "    2) Pre-release (preview)" >&2
+    echo "    3) Keep current (do nothing)" >&2
+    printf "Enter 1, 2 or 3 [default 1]: " >&2
+
+    if read -r sel </dev/tty; then
+      case "${sel:-}" in
+        2) ch="prerelease" ;;
+        3) ch="keep" ;;
+      esac
+    fi
+  fi
+
+  echo "$ch"
+}
+
+get_latest_tag_latest() {
+  curl -fsSL "https://api.github.com/repos/2dust/v2rayN/releases/latest" \
+    | jq -re '.tag_name' \
+    | sed 's/^v//'
+}
+
+get_latest_tag_prerelease() {
+  curl -fsSL "https://api.github.com/repos/2dust/v2rayN/releases?per_page=20" \
+    | jq -re 'first(.[] | select(.prerelease == true) | .tag_name)' \
+    | sed 's/^v//'
+}
+
+sync_submodules() {
+  if [[ -f .gitmodules ]]; then
+    git submodule sync --recursive || true
+    git submodule update --init --recursive || true
+  fi
+}
+
+git_try_checkout() {
+  local want="$1"
+  local ref=""
+
+  if git rev-parse --git-dir >/dev/null 2>&1; then
+    git fetch --tags --force --prune --depth=1 || true
+    git rev-parse "refs/tags/${want}" >/dev/null 2>&1 && ref="$want"
+
+    if [[ -n "$ref" ]]; then
+      echo "[OK] Found ref '${ref}', checking out..."
+      git checkout -f "$ref"
+      sync_submodules
+      return 0
+    fi
+  fi
+
+  return 1
+}
+
+apply_channel_or_keep() {
+  local ch="$1"
+  local tag=""
+
+  if [[ "$ch" == "keep" ]]; then
+    echo "[*] Keep current repository state (no checkout)."
+    VERSION="$(git describe --tags --abbrev=0 2>/dev/null || echo '0.0.0+git')"
+    VERSION="${VERSION#v}"
+    return 0
+  fi
+
+  echo "[*] Resolving ${ch} tag from GitHub releases..."
+
+  case "$ch" in
+    latest)     tag="$(get_latest_tag_latest || true)" ;;
+    prerelease) tag="$(get_latest_tag_prerelease || true)" ;;
+    *)          die "Failed to resolve latest tag for channel '${ch}'." ;;
+  esac
+
+  [[ -n "$tag" ]] || die "Failed to resolve latest tag for channel '${ch}'."
+
+  echo "[*] Latest tag for '${ch}': ${tag}"
+  git_try_checkout "$tag" || die "Failed to checkout '${tag}'."
+  VERSION="${tag#v}"
+}
+
+resolve_version() {
+  if git rev-parse --git-dir >/dev/null 2>&1; then
+    if [[ -n "${VERSION_ARG:-}" ]]; then
+      local clean_ver="${VERSION_ARG#v}"
+
+      if git_try_checkout "$clean_ver"; then
+        VERSION="$clean_ver"
+      else
+        echo "[WARN] Tag '${VERSION_ARG}' not found."
+        apply_channel_or_keep "$(choose_channel)"
+      fi
+    else
+      apply_channel_or_keep "$(choose_channel)"
+    fi
+  else
+    echo "Current directory is not a git repo; proceeding on current tree."
+    VERSION="${VERSION_ARG:-0.0.0}"
+  fi
+
+  VERSION="${VERSION#v}"
+  echo "[*] GUI version resolved as: ${VERSION}"
+}
+
+xray_url_for_rid() {
+  local rid="$1"
+  local ver="$2"
+
+  case "$rid" in
+    linux-loongarch64) echo "https://github.com/XTLS/Xray-core/releases/download/v${ver}/Xray-linux-loong64.zip" ;;
+    *)                 return 1 ;;
+  esac
+}
+
+singbox_url_for_rid() {
+  local rid="$1"
+  local ver="$2"
+
+  case "$rid" in
+    linux-loongarch64) echo "https://github.com/SagerNet/sing-box/releases/download/v${ver}/sing-box-${ver}-linux-loong64.tar.gz" ;;
+    *)                 return 1 ;;
+  esac
+}
+
+bundle_url_for_rid() {
+  local rid="$1"
+
+  case "$rid" in
+    linux-loongarch64) echo "https://raw.githubusercontent.com/2dust/v2rayN-core-bin/refs/heads/master/v2rayN-linux-loong64.zip" ;;
+    *)                 return 1 ;;
+  esac
+}
+
+download_xray() {
+  local outdir="$1"
+  local rid="$2"
+  local ver="${XRAY_VER:-}"
+  local url=""
+  local tmp=""
+
+  mkdir -p "$outdir"
+
+  if [[ -z "$ver" ]]; then
+    ver="$(curl -fsSL https://api.github.com/repos/XTLS/Xray-core/releases/latest \
+      | grep -Eo '"tag_name":\s*"v[^"]+"' \
+      | sed -E 's/.*"v([^"]+)".*/\1/' \
+      | head -n1)" || true
+  fi
+
+  [[ -n "$ver" ]] || { echo "[xray] Failed to get version"; return 1; }
+  url="$(xray_url_for_rid "$rid" "$ver")" || { echo "[xray] Unsupported RID: $rid"; return 1; }
+
+  echo "[+] Download xray: $url"
+
+  tmp="$(mktemp -d)"
+  curl -fL "$url" -o "$tmp/xray.zip" || { rm -rf "$tmp"; return 1; }
+  unzip -q "$tmp/xray.zip" -d "$tmp" || { rm -rf "$tmp"; return 1; }
+  install -m 755 "$tmp/xray" "$outdir/xray" || { rm -rf "$tmp"; return 1; }
+  rm -rf "$tmp"
+}
+
+download_singbox() {
+  local outdir="$1"
+  local rid="$2"
+  local ver="${SING_VER:-}"
+  local url=""
+  local tmp=""
+  local bin=""
+  local cronet=""
+
+  mkdir -p "$outdir"
+
+  if [[ -z "$ver" ]]; then
+    ver="$(curl -fsSL https://api.github.com/repos/SagerNet/sing-box/releases/latest \
+      | grep -Eo '"tag_name":\s*"v[^"]+"' \
+      | sed -E 's/.*"v([^"]+)".*/\1/' \
+      | head -n1)" || true
+  fi
+
+  [[ -n "$ver" ]] || { echo "[sing-box] Failed to get version"; return 1; }
+  url="$(singbox_url_for_rid "$rid" "$ver")" || { echo "[sing-box] Unsupported RID: $rid"; return 1; }
+
+  echo "[+] Download sing-box: $url"
+
+  tmp="$(mktemp -d)"
+  curl -fL "$url" -o "$tmp/singbox.tar.gz" || { rm -rf "$tmp"; return 1; }
+  tar -C "$tmp" -xzf "$tmp/singbox.tar.gz" || { rm -rf "$tmp"; return 1; }
+
+  bin="$(find "$tmp" -type f -name 'sing-box' | head -n1 || true)"
+  [[ -n "$bin" ]] || { echo "[!] sing-box unpack failed"; rm -rf "$tmp"; return 1; }
+
+  install -m 755 "$bin" "$outdir/sing-box" || { rm -rf "$tmp"; return 1; }
+
+  cronet="$(find "$tmp" -type f -name 'libcronet*.so*' | head -n1 || true)"
+  [[ -n "$cronet" ]] && install -m 644 "$cronet" "$outdir/libcronet.so" || true
+
+  rm -rf "$tmp"
+}
+
+unify_geo_layout() {
+  local outroot="$1"
+  local n
+  local names=(
+    geosite.dat
+    geoip.dat
+    geoip-only-cn-private.dat
+    Country.mmdb
+    geoip.metadb
+  )
+
+  mkdir -p "$outroot/bin"
+
+  for n in "${names[@]}"; do
+    if [[ -f "$outroot/bin/xray/$n" ]]; then
+      mv -f "$outroot/bin/xray/$n" "$outroot/bin/$n"
+    fi
+  done
+}
+
+download_geo_assets() {
+  local outroot="$1"
+  local bin_dir="$outroot/bin"
+  local srss_dir="$bin_dir/srss"
+  local f=""
+
+  mkdir -p "$bin_dir" "$srss_dir"
+
+  echo "[+] Download Xray Geo to ${bin_dir}"
+  curl -fsSL -o "$bin_dir/geosite.dat" "https://github.com/Loyalsoldier/V2ray-rules-dat/releases/latest/download/geosite.dat"
+  curl -fsSL -o "$bin_dir/geoip.dat" "https://github.com/Loyalsoldier/V2ray-rules-dat/releases/latest/download/geoip.dat"
+  curl -fsSL -o "$bin_dir/geoip-only-cn-private.dat" "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/geoip-only-cn-private.dat"
+  curl -fsSL -o "$bin_dir/Country.mmdb" "https://raw.githubusercontent.com/Loyalsoldier/geoip/release/Country.mmdb"
+
+  echo "[+] Download sing-box rule DB & rule-sets"
+  curl -fsSL -o "$bin_dir/geoip.metadb" "https://github.com/MetaCubeX/meta-rules-dat/releases/latest/download/geoip.metadb"
+
+  for f in geoip-private.srs geoip-cn.srs geoip-facebook.srs geoip-fastly.srs geoip-google.srs geoip-netflix.srs geoip-telegram.srs geoip-twitter.srs; do
+    curl -fsSL -o "$srss_dir/$f" "https://raw.githubusercontent.com/2dust/sing-box-rules/refs/heads/rule-set-geoip/$f"
+  done
+
+  for f in geosite-cn.srs geosite-gfw.srs geosite-google.srs geosite-greatfire.srs geosite-geolocation-cn.srs geosite-category-ads-all.srs geosite-private.srs; do
+    curl -fsSL -o "$srss_dir/$f" "https://raw.githubusercontent.com/2dust/sing-box-rules/refs/heads/rule-set-geosite/$f"
+  done
+
+  unify_geo_layout "$outroot"
+}
+
+populate_assets_zip_mode() {
+  local outroot="$1"
+  local rid="$2"
+  local url=""
+  local tmp=""
+  local nested_dir=""
+
+  url="$(bundle_url_for_rid "$rid")" || { echo "[!] Bundle unsupported RID: $rid"; return 1; }
+
+  echo "[+] Try v2rayN bundle archive: $url"
+
+  tmp="$(mktemp -d)"
+  curl -fL "$url" -o "$tmp/v2rayn.zip" || { echo "[!] Bundle download failed"; rm -rf "$tmp"; return 1; }
+  unzip -q "$tmp/v2rayn.zip" -d "$tmp" || { echo "[!] Bundle unzip failed"; rm -rf "$tmp"; return 1; }
+
+  if [[ -d "$tmp/bin" ]]; then
+    mkdir -p "$outroot/bin"
+    rsync -a "$tmp/bin/" "$outroot/bin/"
+  else
+    rsync -a "$tmp/" "$outroot/"
+  fi
+
+  rm -f "$outroot/v2rayn.zip" 2>/dev/null || true
+  find "$outroot" -type d -name "mihomo" -prune -exec rm -rf {} + 2>/dev/null || true
+
+  nested_dir="$(find "$outroot" -maxdepth 1 -type d -name 'v2rayN-linux-*' | head -n1 || true)"
+  if [[ -n "$nested_dir" && -d "$nested_dir/bin" ]]; then
+    mkdir -p "$outroot/bin"
+    rsync -a "$nested_dir/bin/" "$outroot/bin/"
+    rm -rf "$nested_dir"
+  fi
+
+  unify_geo_layout "$outroot"
+  rm -rf "$tmp"
+
+  echo "[+] Bundle extracted to $outroot"
+}
+
+populate_assets_netcore_mode() {
+  local outroot="$1"
+  local rid="$2"
+
+  mkdir -p "$outroot/bin/xray" "$outroot/bin/sing_box"
+
+  if [[ "$WITH_CORE" == "xray" || "$WITH_CORE" == "both" ]]; then
+    download_xray "$outroot/bin/xray" "$rid" || echo "[!] xray download failed (skipped)"
+  fi
+
+  if [[ "$WITH_CORE" == "sing-box" || "$WITH_CORE" == "both" ]]; then
+    download_singbox "$outroot/bin/sing_box" "$rid" || echo "[!] sing-box download failed (skipped)"
+  fi
+
+  download_geo_assets "$outroot" || echo "[!] Geo rules download failed (skipped)"
+}
+
+stage_runtime_assets() {
+  local outroot="$1"
+  local rid="$2"
+
+  mkdir -p "$outroot/bin/xray" "$outroot/bin/sing_box"
+
+  if [[ "$FORCE_NETCORE" -eq 0 ]]; then
+    if populate_assets_zip_mode "$outroot" "$rid"; then
+      echo "[*] Using v2rayN bundle archive."
+    else
+      echo "[*] Bundle failed, fallback to separate core + rules."
+      populate_assets_netcore_mode "$outroot" "$rid"
+    fi
+  else
+    echo "[*] --netcore specified: use separate core + rules."
+    populate_assets_netcore_mode "$outroot" "$rid"
+  fi
+}
+
+describe_target() {
+  local short="$1"
+
+  case "$short" in
+    loongarch64) printf '%s\n%s\n%s\n' "linux-loongarch64" "loongarch64" "loongarch64" ;;
+    *)           echo "Unknown arch '$short' (use loongarch64)" >&2; return 1 ;;
+  esac
+}
+
+publish_binary() {
+  local rid="$1"
+
+  dotnet clean "$PROJECT" -c Release
+  rm -rf "$(dirname "$PROJECT")/bin/Release/net10.0" || true
+  dotnet restore "$PROJECT"
+  dotnet publish "$PROJECT" -c Release -r "$rid" -p:PublishSingleFile=false -p:SelfContained=true
+}
+
+write_spec_file() {
+  local specfile="$1"
+
+  cat > "$specfile" <<'SPEC'
+%global debug_package %{nil}
+%undefine _debuginfo_subpackages
+%undefine _debugsource_packages
+%global __requires_exclude ^liblttng-ust\.so\..*$
+
+Name:           v2rayN
+Version:        __VERSION__
+Release:        1%{?dist}
+Summary:        v2rayN (Avalonia) GUI client for Linux
+License:        GPL-3.0-only
+URL:            https://github.com/2dust/v2rayN
+BugURL:         https://github.com/2dust/v2rayN/issues
+ExclusiveArch:  loongarch64
+Source0:        __PKGROOT__.tar.gz
+
+Requires:       cairo, pango, openssl, mesa-libEGL, mesa-libGL
+Requires:       glibc >= 2.34
+Requires:       fontconfig >= 2.13.1
+Requires:       desktop-file-utils >= 0.26
+Requires:       xdg-utils >= 1.1.3
+Requires:       coreutils >= 8.32
+Requires:       bash >= 5.1
+Requires:       freetype >= 2.10
+
+%description
+v2rayN Linux for Red Hat Enterprise Linux
+Support vless / vmess / Trojan / http / socks / Anytls / Hysteria2 / Shadowsocks / tuic / WireGuard
+Support Red Hat Enterprise Linux / Fedora Linux / Rocky Linux / AlmaLinux / CentOS
+For more information, Please visit our website
+https://github.com/2dust/v2rayN
+
+%prep
+%setup -q -n __PKGROOT__
+
+%build
+
+%install
+install -dm0755 %{buildroot}/opt/v2rayN
+cp -a * %{buildroot}/opt/v2rayN/
+
+find %{buildroot}/opt/v2rayN -type d -exec chmod 0755 {} +
+find %{buildroot}/opt/v2rayN -type f -exec chmod 0644 {} +
+[ -f %{buildroot}/opt/v2rayN/v2rayN ] && chmod 0755 %{buildroot}/opt/v2rayN/v2rayN || :
+
+install -dm0755 %{buildroot}%{_bindir}
+install -m0755 /dev/stdin %{buildroot}%{_bindir}/v2rayn << 'EOF'
+#!/usr/bin/bash
+set -euo pipefail
+DIR="/opt/v2rayN"
+
+if [[ -x "$DIR/v2rayN" ]]; then exec "$DIR/v2rayN" "$@"; fi
+
+for dll in v2rayN.Desktop.dll v2rayN.dll; do
+  if [[ -f "$DIR/$dll" ]]; then exec /usr/bin/dotnet "$DIR/$dll" "$@"; fi
+done
+
+echo "v2rayN launcher: no executable found in $DIR" >&2
+ls -l "$DIR" >&2 || true
+exit 1
+EOF
+
+install -dm0755 %{buildroot}%{_datadir}/applications
+install -m0644 /dev/stdin %{buildroot}%{_datadir}/applications/v2rayn.desktop << 'EOF'
+[Desktop Entry]
+Type=Application
+Name=v2rayN
+Comment=v2rayN for Red Hat Enterprise Linux
+Exec=v2rayn
+Icon=v2rayn
+Terminal=false
+Categories=Network;
+EOF
+
+install -dm0755 %{buildroot}%{_datadir}/icons/hicolor/256x256/apps
+install -m0644 %{_builddir}/__PKGROOT__/v2rayn.png %{buildroot}%{_datadir}/icons/hicolor/256x256/apps/v2rayn.png
+
+%post
+/usr/bin/update-desktop-database %{_datadir}/applications >/dev/null 2>&1 || true
+/usr/bin/gtk-update-icon-cache -f %{_datadir}/icons/hicolor >/dev/null 2>&1 || true
+
+%postun
+/usr/bin/update-desktop-database %{_datadir}/applications >/dev/null 2>&1 || true
+/usr/bin/gtk-update-icon-cache -f %{_datadir}/icons/hicolor >/dev/null 2>&1 || true
+
+%files
+%{_bindir}/v2rayn
+/opt/v2rayN
+%{_datadir}/applications/v2rayn.desktop
+%{_datadir}/icons/hicolor/256x256/apps/v2rayn.png
+SPEC
+
+  sed -i "s/__VERSION__/${VERSION}/g" "$specfile"
+  sed -i "s/__PKGROOT__/${PKGROOT}/g" "$specfile"
+}
+
+package_binary() {
+  local short="$1"
+  local rid="$2"
+  local rpm_target="$3"
+  local archdir="$4"
+  local pubdir=""
+  local workdir=""
+  local specfile=""
+  local sourcedir=""
+  local specdir=""
+  local project_dir=""
+  local icon_candidate=""
+  local f=""
+
+  pubdir="$(dirname "$PROJECT")/bin/Release/net10.0/${rid}/publish"
+  [[ -d "$pubdir" ]] || { echo "Publish directory not found: $pubdir"; return 1; }
+
+  workdir="$(mktemp -d)"
+  trap '[[ -n "${workdir:-}" ]] && rm -rf "$workdir"' RETURN
+
+  mkdir -p "$workdir/$PKGROOT"
+  cp -a "$pubdir/." "$workdir/$PKGROOT/"
+
+  project_dir="$(cd "$(dirname "$PROJECT")" && pwd)"
+  icon_candidate="$project_dir/v2rayN.png"
+  [[ -f "$icon_candidate" ]] || { echo "Required icon not found: $icon_candidate"; return 1; }
+  cp "$icon_candidate" "$workdir/$PKGROOT/v2rayn.png"
+
+  stage_runtime_assets "$workdir/$PKGROOT" "$rid"
+
+  rpmdev-setuptree
+  sourcedir="${RPM_TOPDIR}/SOURCES"
+  specdir="${RPM_TOPDIR}/SPECS"
+  specfile="${specdir}/v2rayN.spec"
+
+  mkdir -p "$sourcedir" "$specdir"
+  tar -C "$workdir" -czf "$sourcedir/$PKGROOT.tar.gz" "$PKGROOT"
+
+  write_spec_file "$specfile"
+  rpmbuild -ba "$specfile" --target "$rpm_target"
+
+  echo "Build done for $short. RPM at:"
+  for f in "${RPM_TOPDIR}/RPMS/${archdir}/v2rayN-${VERSION}-1"*.rpm; do
+    [[ -e "$f" ]] || continue
+    echo "  $f"
+    BUILT_RPMS+=("$f")
+  done
+}
+
+select_targets() {
+  printf '%s\n' loongarch64
+}
+
+build_one_target() {
+  local short="$1"
+  local meta=()
+  local rid=""
+  local rpm_target=""
+  local archdir=""
+
+  mapfile -t meta < <(describe_target "$short") || return 1
+  rid="${meta[0]}"
+  rpm_target="${meta[1]}"
+  archdir="${meta[2]}"
+
+  echo "[*] Building for target: $short  (RID=$rid, RPM --target $rpm_target)"
+  publish_binary "$rid"
+  package_binary "$short" "$rid" "$rpm_target" "$archdir"
+}
+
+print_summary() {
+  local rp=""
+
+  echo ""
+  echo "================ Build Summary ================"
+  if [[ "${#BUILT_RPMS[@]}" -gt 0 ]]; then
+    for rp in "${BUILT_RPMS[@]}"; do
+      echo "$rp"
+    done
+  else
+    echo "No RPMs detected in summary (check build logs above)."
+  fi
+  echo "=============================================="
+}
+
+main() {
+  local targets=()
+  local arch=""
+
+  parse_args "$@"
+  detect_environment
+  install_dependencies
+  prepare_workspace
+  resolve_version
+
+  mapfile -t targets < <(select_targets)
+
+  for arch in "${targets[@]}"; do
+    build_one_target "$arch"
+  done
+
+  print_summary
+}
+
+main "$@"

package-rhel-riscv.sh

@@ -12,7 +12,7 @@ MIN_KERNEL="5.10"
 PKGROOT="v2rayN-publish"
 PROJECT_HINT="v2rayN.Desktop/v2rayN.Desktop.csproj"
 RPM_TOPDIR="${HOME}/rpmbuild"
-DOTNET_RISCV_VERSION="10.0.108"
+DOTNET_RISCV_VERSION="10.0.109"
 DOTNET_RISCV_BASE="https://github.com/xujiegb/dotnet-riscv/releases/download"
 DOTNET_RISCV_FILE="dotnet-sdk-${DOTNET_RISCV_VERSION}-linux-riscv64.tar.gz"
 DOTNET_SDK_URL="${DOTNET_RISCV_BASE}/${DOTNET_RISCV_VERSION}/${DOTNET_RISCV_FILE}"
@@ -501,7 +501,7 @@ write_spec_file() {
 Name:           v2rayN
 Version:        __VERSION__
 Release:        1%{?dist}
-Summary:        v2rayN (Avalonia) GUI client for Linux (riscv64)
+Summary:        v2rayN (Avalonia) GUI client for Linux
 License:        GPL-3.0-only
 URL:            https://github.com/2dust/v2rayN
 BugURL:         https://github.com/2dust/v2rayN/issues

package-rhel.sh

@@ -490,7 +490,7 @@ write_spec_file() {
 Name:           v2rayN
 Version:        __VERSION__
 Release:        1%{?dist}
-Summary:        v2rayN (Avalonia) GUI client for Linux (x86_64/aarch64)
+Summary:        v2rayN (Avalonia) GUI client for Linux
 License:        GPL-3.0-only
 URL:            https://github.com/2dust/v2rayN
 BugURL:         https://github.com/2dust/v2rayN/issues
@@ -698,4 +698,4 @@ main() {
   print_summary
 }
 
-main "$@"
+main "$@"

v2rayN/Directory.Build.props

@@ -1,7 +1,7 @@
 <Project>
 
     <PropertyGroup>
-        <Version>7.22.6</Version>
+        <Version>7.23.0</Version>
     </PropertyGroup>
 
     <PropertyGroup>

v2rayN/ServiceLib/Common/Utils.cs

@@ -716,6 +716,18 @@ public class Utils
         return (endpoints, connections);
     }
 
+    public static bool IsLocalIP(string ipAddress)
+    {
+        if (!IPAddress.TryParse(ipAddress, out var targetAddress))
+        {
+            return false;
+        }
+
+        return NetworkInterface.GetAllNetworkInterfaces()
+               .SelectMany(ni => ni.GetIPProperties().UnicastAddresses)
+               .Any(ua => ua.Address.Equals(targetAddress));
+    }
+
     #endregion Speed Test
 
     #region Miscellaneous

v2rayN/ServiceLib/Global.cs

@@ -476,7 +476,8 @@ public class Global
         "fa",
         "fr",
         "ru",
-        "hu"
+        "hu",
+        "id"
     ];
 
     public static readonly List<string> Alpns =

v2rayN/ServiceLib/Handler/Builder/CoreConfigContextBuilder.cs

@@ -6,8 +6,8 @@ public record CoreConfigContextBuilderResult(CoreConfigContext Context, NodeVali
 }
 
 /// <summary>
-/// Holds the results of a full context build, including the main context and an optional
-/// pre-socks context (e.g. for TUN protection or pre-socks chaining).
+///     Holds the results of a full context build, including the main context and an optional
+///     pre-socks context (e.g. for TUN protection or pre-socks chaining).
 /// </summary>
 public record CoreConfigContextBuilderAllResult(
     CoreConfigContextBuilderResult MainResult,
@@ -17,8 +17,8 @@ public record CoreConfigContextBuilderAllResult(
     public bool Success => MainResult.Success && (PreSocksResult?.Success ?? true);
 
     /// <summary>
-    /// Merges all errors and warnings from the main result and the optional pre-socks result
-    /// into a single <see cref="NodeValidatorResult"/> for unified notification.
+    ///     Merges all errors and warnings from the main result and the optional pre-socks result
+    ///     into a single <see cref="NodeValidatorResult" /> for unified notification.
     /// </summary>
     public NodeValidatorResult CombinedValidatorResult => new(
         [.. MainResult.ValidatorResult.Errors, .. PreSocksResult?.ValidatorResult.Errors ?? []],
@@ -28,14 +28,14 @@ public record CoreConfigContextBuilderAllResult(
 public class CoreConfigContextBuilder
 {
     /// <summary>
-    /// Builds a <see cref="CoreConfigContext"/> for the given node, resolves its proxy map,
-    /// and processes outbound nodes referenced by routing rules.
+    ///     Builds a <see cref="CoreConfigContext" /> for the given node, resolves its proxy map,
+    ///     and processes outbound nodes referenced by routing rules.
     /// </summary>
     public static async Task<CoreConfigContextBuilderResult> Build(Config config, ProfileItem node)
     {
         var runCoreType = AppManager.Instance.GetCoreType(node, node.ConfigType);
         var coreType = runCoreType == ECoreType.sing_box ? ECoreType.sing_box : ECoreType.Xray;
-        var context = new CoreConfigContext()
+        var context = new CoreConfigContext
         {
             Node = node,
             RunCoreType = runCoreType,
@@ -61,7 +61,8 @@ public class CoreConfigContextBuilder
         if (!(context.RoutingItem?.RuleSet.IsNullOrEmpty() ?? true))
         {
             var rules = JsonUtils.Deserialize<List<RulesItem>>(context.RoutingItem?.RuleSet) ?? [];
-            foreach (var ruleItem in rules.Where(ruleItem => ruleItem.Enabled && !Global.OutboundTags.Contains(ruleItem.OutboundTag)))
+            foreach (var ruleItem in rules.Where(ruleItem =>
+                         ruleItem.Enabled && !Global.OutboundTags.Contains(ruleItem.OutboundTag)))
             {
                 if (ruleItem.OutboundTag.IsNullOrEmpty())
                 {
@@ -72,7 +73,8 @@ public class CoreConfigContextBuilder
                 var ruleOutboundNode = await AppManager.Instance.GetProfileItemViaRemarks(ruleItem.OutboundTag);
                 if (ruleOutboundNode == null)
                 {
-                    validatorResult.Warnings.Add(string.Format(ResUI.MsgRoutingRuleOutboundNodeNotFound, ruleItem.Remarks, ruleItem.OutboundTag));
+                    validatorResult.Warnings.Add(string.Format(ResUI.MsgRoutingRuleOutboundNodeNotFound,
+                        ruleItem.Remarks, ruleItem.OutboundTag));
                     ruleItem.OutboundTag = Global.ProxyTag;
                     continue;
                 }
@@ -83,7 +85,8 @@ public class CoreConfigContextBuilder
                 if (!ruleNodeValidatorResult.Success)
                 {
                     validatorResult.Warnings.AddRange(ruleNodeValidatorResult.Errors.Select(e =>
-                        string.Format(ResUI.MsgRoutingRuleOutboundNodeError, ruleItem.Remarks, ruleItem.OutboundTag, e)));
+                        string.Format(ResUI.MsgRoutingRuleOutboundNodeError, ruleItem.Remarks, ruleItem.OutboundTag,
+                            e)));
                     ruleItem.OutboundTag = Global.ProxyTag;
                     continue;
                 }
@@ -110,9 +113,9 @@ public class CoreConfigContextBuilder
     }
 
     /// <summary>
-    /// Builds the main <see cref="CoreConfigContext"/> for <paramref name="node"/> and, when
-    /// the main build succeeds, also builds the optional pre-socks context required for TUN
-    /// protection or pre-socks proxy chaining.
+    ///     Builds the main <see cref="CoreConfigContext" /> for <paramref name="node" /> and, when
+    ///     the main build succeeds, also builds the optional pre-socks context required for TUN
+    ///     protection or pre-socks proxy chaining.
     /// </summary>
     public static async Task<CoreConfigContextBuilderAllResult> BuildAll(Config config, ProfileItem node)
     {
@@ -132,16 +135,31 @@ public class CoreConfigContextBuilder
         {
             Context = mainResult.Context with
             {
-                IsTunEnabled = false, // main core doesn't handle tun directly when pre-socks is used
+                IsTunEnabled = false,
+                // main core doesn't handle tun directly when pre-socks is used
                 ProtectDomainList = [.. mainResult.Context.ProtectDomainList, .. preResult.Context.ProtectDomainList],
-            }
+            },
         };
+        if (mainResult.Context.IsTunEnabled
+            && mainResult.Context.AppConfig.TunModeItem.StrictRoute)
+        {
+            var appConfig = JsonUtils.DeepCopy(mainResult.Context.AppConfig);
+            appConfig.CoreBasicItem.BindInterface = string.Empty;
+            appConfig.CoreBasicItem.SendThrough = string.Empty;
+            resolvedMainResult = resolvedMainResult with
+            {
+                Context = resolvedMainResult.Context with
+                {
+                    AppConfig = appConfig,
+                },
+            };
+        }
         return new CoreConfigContextBuilderAllResult(resolvedMainResult, preResult);
     }
 
     /// <summary>
-    /// Determines whether a pre-socks context is required for <paramref name="nodeContext"/>
-    /// and, if so, builds and returns it. Returns <c>null</c> when no pre-socks core is needed.
+    ///     Determines whether a pre-socks context is required for <paramref name="nodeContext" />
+    ///     and, if so, builds and returns it. Returns <c>null</c> when no pre-socks core is needed.
     /// </summary>
     private static async Task<CoreConfigContextBuilderResult?> BuildPreSocksIfNeeded(CoreConfigContext nodeContext)
     {
@@ -157,8 +175,9 @@ public class CoreConfigContextBuilder
             {
                 Context = preSocksResult.Context with
                 {
-                    ProtectDomainList = [.. nodeContext.ProtectDomainList ?? [], .. preSocksResult.Context.ProtectDomainList ?? []],
-                }
+                    ProtectDomainList =
+                    [.. nodeContext.ProtectDomainList ?? [], .. preSocksResult.Context.ProtectDomainList ?? []],
+                },
             };
         }
 
@@ -166,8 +185,8 @@ public class CoreConfigContextBuilder
     }
 
     /// <summary>
-    /// Resolves a node into the context, optionally wrapping it in a subscription-level proxy chain.
-    /// Returns the effective (possibly replaced) node and the validation result.
+    ///     Resolves a node into the context, optionally wrapping it in a subscription-level proxy chain.
+    ///     Returns the effective (possibly replaced) node and the validation result.
     /// </summary>
     public static async Task<(ProfileItem, NodeValidatorResult)> ResolveNodeAsync(CoreConfigContext context,
         ProfileItem node,
@@ -202,12 +221,13 @@ public class CoreConfigContextBuilder
     }
 
     /// <summary>
-    /// If the node's subscription defines prev/next profiles, creates a virtual
-    /// <see cref="EConfigType.ProxyChain"/> node that wraps them together.
-    /// Returns <c>null</c> as the chain item when no chain is needed.
-    /// Any warnings (e.g. missing prev/next profile) are returned in the validator result.
+    ///     If the node's subscription defines prev/next profiles, creates a virtual
+    ///     <see cref="EConfigType.ProxyChain" /> node that wraps them together.
+    ///     Returns <c>null</c> as the chain item when no chain is needed.
+    ///     Any warnings (e.g. missing prev/next profile) are returned in the validator result.
     /// </summary>
-    private static async Task<(ProfileItem? ChainNode, NodeValidatorResult ValidatorResult)> BuildSubscriptionChainNodeAsync(ProfileItem node)
+    private static async Task<(ProfileItem? ChainNode, NodeValidatorResult ValidatorResult)>
+        BuildSubscriptionChainNodeAsync(ProfileItem node)
     {
         var result = NodeValidatorResult.Empty();
 
@@ -248,7 +268,7 @@ public class CoreConfigContextBuilder
         }
 
         // Build new proxy chain node
-        var chainNode = new ProfileItem()
+        var chainNode = new ProfileItem
         {
             IndexId = $"inner-{Utils.GetGuid(false)}",
             ConfigType = EConfigType.ProxyChain,
@@ -266,8 +286,8 @@ public class CoreConfigContextBuilder
     }
 
     /// <summary>
-    /// Dispatches registration to either <see cref="RegisterGroupNodeAsync"/> or
-    /// <see cref="RegisterSingleNodeAsync"/> based on the node's config type.
+    ///     Dispatches registration to either <see cref="RegisterGroupNodeAsync" /> or
+    ///     <see cref="RegisterSingleNodeAsync" /> based on the node's config type.
     /// </summary>
     private static async Task<NodeValidatorResult> RegisterNodeAsync(CoreConfigContext context, ProfileItem node)
     {
@@ -275,15 +295,12 @@ public class CoreConfigContextBuilder
         {
             return await RegisterGroupNodeAsync(context, node);
         }
-        else
-        {
-            return RegisterSingleNodeAsync(context, node);
-        }
+        return RegisterSingleNodeAsync(context, node);
     }
 
     /// <summary>
-    /// Validates a single (non-group) node and, on success, adds it to the proxy map
-    /// and records any domain addresses that should bypass the proxy.
+    ///     Validates a single (non-group) node and, on success, adds it to the proxy map
+    ///     and records any domain addresses that should bypass the proxy.
     /// </summary>
     private static NodeValidatorResult RegisterSingleNodeAsync(CoreConfigContext context, ProfileItem node)
     {
@@ -347,8 +364,8 @@ public class CoreConfigContextBuilder
     }
 
     /// <summary>
-    /// Entry point for registering a group node. Initialises the visited/ancestor sets
-    /// and delegates to <see cref="TraverseGroupNodeAsync"/>.
+    ///     Entry point for registering a group node. Initialises the visited/ancestor sets
+    ///     and delegates to <see cref="TraverseGroupNodeAsync" />.
     /// </summary>
     private static async Task<NodeValidatorResult> RegisterGroupNodeAsync(CoreConfigContext context,
         ProfileItem node)
@@ -364,9 +381,9 @@ public class CoreConfigContextBuilder
     }
 
     /// <summary>
-    /// Recursively walks the children of a group node, registering valid leaf nodes
-    /// and nested groups. Detects cycles via <paramref name="ancestorsGroup"/> and
-    /// deduplicates shared nodes via <paramref name="globalVisitedGroup"/>.
+    ///     Recursively walks the children of a group node, registering valid leaf nodes
+    ///     and nested groups. Detects cycles via <paramref name="ancestorsGroup" /> and
+    ///     deduplicates shared nodes via <paramref name="globalVisitedGroup" />.
     /// </summary>
     private static async Task<NodeValidatorResult> TraverseGroupNodeAsync(
         CoreConfigContext context,
@@ -430,13 +447,10 @@ public class CoreConfigContextBuilder
             childNodeValidatorResult.Errors.Add(string.Format(ResUI.MsgGroupNoValidChildNode, node.Remarks));
             return childNodeValidatorResult;
         }
-        else
-        {
-            childNodeValidatorResult.Warnings.AddRange(childNodeValidatorResult.Errors);
-            childNodeValidatorResult.Errors.Clear();
-        }
+        childNodeValidatorResult.Warnings.AddRange(childNodeValidatorResult.Errors);
+        childNodeValidatorResult.Errors.Clear();
 
-        node.SetProtocolExtra(node.GetProtocolExtra() with { ChildItems = Utils.List2String(childIndexIdList), });
+        node.SetProtocolExtra(node.GetProtocolExtra() with { ChildItems = Utils.List2String(childIndexIdList) });
         context.AllProxiesMap[node.IndexId] = node;
         return childNodeValidatorResult;
     }

v2rayN/ServiceLib/Handler/Fmt/VmessFmt.cs

@@ -66,7 +66,9 @@ public class VmessFmt : BaseFmt
             sni = item.Sni,
             alpn = item.Alpn,
             fp = item.Fingerprint,
-            insecure = item.GetAllowInsecure() ? "1" : "0"
+            insecure = item.GetAllowInsecure() ? "1" : "0",
+            vcn = item.VerifyPeerCertByName,
+            pcs = item.CertSha
         };
 
         var url = JsonUtils.Serialize(vmessQRCode);
@@ -141,6 +143,8 @@ public class VmessFmt : BaseFmt
         item.Alpn = Utils.ToString(vmessQRCode.alpn);
         item.Fingerprint = Utils.ToString(vmessQRCode.fp);
         item.AllowInsecure = vmessQRCode.insecure == "1" ? Global.StringTrue : string.Empty;
+        item.VerifyPeerCertByName = Utils.ToString(vmessQRCode.vcn);
+        item.CertSha = Utils.ToString(vmessQRCode.pcs);
 
         return item;
     }

v2rayN/ServiceLib/Manager/CertPemManager.cs

@@ -190,8 +190,8 @@ public class CertPemManager
     /// <summary>
     ///     Get certificate in PEM format from a server with CA pinning validation
     /// </summary>
-    public async Task<(string?, string?)> GetCertPemAsync(string target, string serverName, int timeout = 4,
-        List<string>? verifyPeerCertByName = null, bool allowInsecure = false)
+    public async Task<(string?, string?)> GetCertPemAsync(string target, string serverName,
+        List<string>? verifyPeerCertByName = null, int timeout = 4)
     {
         try
         {
@@ -204,8 +204,7 @@ public class CertPemManager
             await client.ConnectAsync(domain, port > 0 ? port : 443, cts.Token);
 
             var callback = new RemoteCertificateValidationCallback((sender, certificate, chain, sslPolicyErrors) =>
-                ValidateServerCertificate(sender, certificate, chain, sslPolicyErrors, verifyPeerCertByName ?? [],
-                    allowInsecure));
+                ValidateServerCertificate(sender, certificate, chain, sslPolicyErrors, verifyPeerCertByName ?? []));
             await using var ssl = new SslStream(client.GetStream(), false, callback);
 
             var sslOptions = new SslClientAuthenticationOptions
@@ -240,8 +239,8 @@ public class CertPemManager
     /// <summary>
     ///     Get certificate chain in PEM format from a server with CA pinning validation
     /// </summary>
-    public async Task<(List<string>, string?)> GetCertChainPemAsync(string target, string serverName, int timeout = 4,
-        List<string>? verifyPeerCertByName = null, bool allowInsecure = false)
+    public async Task<(List<string>, string?)> GetCertChainPemAsync(string target, string serverName,
+        List<string>? verifyPeerCertByName = null, int timeout = 4)
     {
         var pemList = new List<string>();
         try
@@ -255,8 +254,7 @@ public class CertPemManager
             await client.ConnectAsync(domain, port > 0 ? port : 443, cts.Token);
 
             var callback = new RemoteCertificateValidationCallback((sender, certificate, chain, sslPolicyErrors) =>
-                ValidateServerCertificate(sender, certificate, chain, sslPolicyErrors, verifyPeerCertByName ?? [],
-                    allowInsecure));
+                ValidateServerCertificate(sender, certificate, chain, sslPolicyErrors, verifyPeerCertByName ?? []));
             await using var ssl = new SslStream(client.GetStream(), false, callback);
 
             var sslOptions = new SslClientAuthenticationOptions
@@ -299,20 +297,13 @@ public class CertPemManager
         X509Certificate? certificate,
         X509Chain? chain,
         SslPolicyErrors sslPolicyErrors,
-        List<string> verifyPeerCertByName,
-        bool allowInsecure)
+        List<string> verifyPeerCertByName)
     {
         if (certificate == null)
         {
             return false;
         }
 
-        // In insecure mode, accept any certificate so self-signed certs can be fetched.
-        if (allowInsecure)
-        {
-            return true;
-        }
-
         // Build certificate chain
         var cert2 = certificate as X509Certificate2 ?? new X509Certificate2(certificate);
         var certChain = chain ?? new X509Chain();

v2rayN/ServiceLib/Manager/NetBridgeManager.cs

@@ -166,6 +166,18 @@ public sealed class NetBridgeManager
         }
     }
 
+    public async Task<bool> SetDnsViaProxy(bool enable)
+    {
+        if (_netBridgeService == null)
+        {
+            return false;
+        }
+
+        _netBridgeService.SetDnsViaProxy(enable);
+
+        return await Task.FromResult(true);
+    }
+
     private async Task<bool> ApplyRoutesInternal()
     {
         if (_netBridgeService == null)
@@ -208,6 +220,11 @@ public sealed class NetBridgeManager
 
     private static List<NetBridgeRuleConfig> BuildRuleConfigs(string? ruleProcess)
     {
+        if (ruleProcess.IsNullOrEmpty())
+        {
+            return new();
+        }
+
         var processNames = Utils.String2List(Utils.Convert2Comma(ruleProcess));
         return processNames.Select(processName => new NetBridgeRuleConfig
         {

v2rayN/ServiceLib/Models/Configs/ConfigItems.cs

@@ -282,4 +282,5 @@ public class SimpleDNSItem
 public class NetBridgeItem
 {
     public string? RuleProcess { get; set; }
+    public bool EnableDnsViaProxy { get; set; }
 }

v2rayN/ServiceLib/Models/CoreConfigs/V2rayConfig.cs

@@ -20,7 +20,7 @@ public class Stats4Ray
 
 public class Metrics4Ray
 {
-    public string tag { get; set; }
+    public string listen { get; set; }
 }
 
 public class Policy4Ray

v2rayN/ServiceLib/Models/Dto/VmessQRCode.cs

@@ -40,4 +40,8 @@ public class VmessQRCode
     public string fp { get; set; } = string.Empty;
 
     public string insecure { get; set; } = string.Empty;
+
+    public string vcn { get; set; } = string.Empty;
+
+    public string pcs { get; set; } = string.Empty;
 }

v2rayN/ServiceLib/Resx/ResUI.Designer.cs

@@ -2688,24 +2688,6 @@ namespace ServiceLib.Resx {
             }
         }
         
-        /// <summary>
-        ///   查找类似 Allow insecure cert fetch (self-signed) 的本地化字符串。
-        /// </summary>
-        public static string TbAllowInsecureCertFetch {
-            get {
-                return ResourceManager.GetString("TbAllowInsecureCertFetch", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   查找类似 Only for fetching self-signed certificates. This may expose you to MITM risks. 的本地化字符串。
-        /// </summary>
-        public static string TbAllowInsecureCertFetchTips {
-            get {
-                return ResourceManager.GetString("TbAllowInsecureCertFetchTips", resourceCulture);
-            }
-        }
-        
         /// <summary>
         ///   查找类似 ALPN 的本地化字符串。
         /// </summary>
@@ -3070,7 +3052,7 @@ namespace ServiceLib.Resx {
         }
         
         /// <summary>
-        ///   查找类似 Enables process traffic hijacking (experimental), similar to Proxifer; can coexist with system proxy; conflicts with TUN mode, please do not enable them simultaneously; 的本地化字符串。
+        ///   查找类似 Enables process traffic hijacking (experimental), similar to Proxifer; can coexist with system proxy; conflicts with TUN mode, please do not enable them simultaneously;please allow v2rayN to use a private network in your firewall. 的本地化字符串。
         /// </summary>
         public static string TbEnableNetBridge {
             get {
@@ -3078,6 +3060,15 @@ namespace ServiceLib.Resx {
             }
         }
         
+        /// <summary>
+        ///   查找类似 DNS via Bridge 的本地化字符串。
+        /// </summary>
+        public static string TbEnabletDnsViaProxy {
+            get {
+                return ResourceManager.GetString("TbEnabletDnsViaProxy", resourceCulture);
+            }
+        }
+        
         /// <summary>
         ///   查找类似 Enable Tun 的本地化字符串。
         /// </summary>
@@ -3717,6 +3708,15 @@ namespace ServiceLib.Resx {
             }
         }
         
+        /// <summary>
+        ///   查找类似 Save rules 的本地化字符串。
+        /// </summary>
+        public static string TbSaveNetBridgeRule {
+            get {
+                return ResourceManager.GetString("TbSaveNetBridgeRule", resourceCulture);
+            }
+        }
+        
         /// <summary>
         ///   查找类似 sing-box Full Config Template 的本地化字符串。
         /// </summary>

v2rayN/ServiceLib/Resx/ResUI.fa.resx

@@ -1698,12 +1698,6 @@ The "Get Certificate" action may fail if a self-signed certificate is used or if
   <data name="TransportExtra" xml:space="preserve">
     <value>XHTTP Extra</value>
   </data>
-  <data name="TbAllowInsecureCertFetch" xml:space="preserve">
-    <value>Allow insecure cert fetch (self-signed)</value>
-  </data>
-  <data name="TbAllowInsecureCertFetchTips" xml:space="preserve">
-    <value>Only for fetching self-signed certificates. This may expose you to MITM risks.</value>
-  </data>
   <data name="menuUdpTestServer" xml:space="preserve">
     <value>Test Configurations UDP Delay</value>
   </data>

v2rayN/ServiceLib/Resx/ResUI.fr.resx

@@ -1695,12 +1695,6 @@ The "Get Certificate" action may fail if a self-signed certificate is used or if
   <data name="TransportExtra" xml:space="preserve">
     <value>XHTTP Extra</value>
   </data>
-  <data name="TbAllowInsecureCertFetch" xml:space="preserve">
-    <value>Allow insecure cert fetch (self-signed)</value>
-  </data>
-  <data name="TbAllowInsecureCertFetchTips" xml:space="preserve">
-    <value>Pour obtenir des certificats auto-signés uniquement. Risque MITM.</value>
-  </data>
   <data name="TbSettingsSendThrough" xml:space="preserve">
     <value>Adresse de sortie locale (SendThrough)</value>
   </data>

v2rayN/ServiceLib/Resx/ResUI.hu.resx

@@ -1698,12 +1698,6 @@ The "Get Certificate" action may fail if a self-signed certificate is used or if
   <data name="TransportExtra" xml:space="preserve">
     <value>XHTTP Extra</value>
   </data>
-  <data name="TbAllowInsecureCertFetch" xml:space="preserve">
-    <value>Allow insecure cert fetch (self-signed)</value>
-  </data>
-  <data name="TbAllowInsecureCertFetchTips" xml:space="preserve">
-    <value>Only for fetching self-signed certificates. This may expose you to MITM risks.</value>
-  </data>
   <data name="menuUdpTestServer" xml:space="preserve">
     <value>Test Configurations UDP Delay</value>
   </data>

v2rayN/ServiceLib/Resx/ResUI.resx

@@ -1701,12 +1701,6 @@ The "Get Certificate" action may fail if a self-signed certificate is used or if
   <data name="TransportExtra" xml:space="preserve">
     <value>XHTTP Extra</value>
   </data>
-  <data name="TbAllowInsecureCertFetch" xml:space="preserve">
-    <value>Allow insecure cert fetch (self-signed)</value>
-  </data>
-  <data name="TbAllowInsecureCertFetchTips" xml:space="preserve">
-    <value>Only for fetching self-signed certificates. This may expose you to MITM risks.</value>
-  </data>
   <data name="menuUdpTestServer" xml:space="preserve">
     <value>Test Configurations UDP Delay</value>
   </data>
@@ -1771,7 +1765,7 @@ The "Get Certificate" action may fail if a self-signed certificate is used or if
     <value>Split the tail of packets into smaller fragments. This may affect throughput and latency.</value>
   </data>
   <data name="TbEnableNetBridge" xml:space="preserve">
-    <value>Enables process traffic hijacking (experimental), similar to Proxifer; can coexist with system proxy; conflicts with TUN mode, please do not enable them simultaneously;</value>
+    <value>Enables process traffic hijacking (experimental), similar to Proxifer; can coexist with system proxy; conflicts with TUN mode, please do not enable them simultaneously;please allow v2rayN to use a private network in your firewall.</value>
   </data>
   <data name="NetBridgeRuleTips" xml:space="preserve">
     <value>The process names that need to be proxied; separate multiple processes with commas. Processes not in the list will also be hijacked, but will connect directly.</value>
@@ -1779,4 +1773,10 @@ The "Get Certificate" action may fail if a self-signed certificate is used or if
   <data name="menuNetBridge" xml:space="preserve">
     <value>Process traffic hijacking (experimental)</value>
   </data>
-</root>
+  <data name="TbEnabletDnsViaProxy" xml:space="preserve">
+    <value>DNS via Bridge</value>
+  </data>
+  <data name="TbSaveNetBridgeRule" xml:space="preserve">
+    <value>Save rules</value>
+  </data>
+</root>

v2rayN/ServiceLib/Resx/ResUI.ru.resx

@@ -1698,12 +1698,6 @@
   <data name="TransportExtra" xml:space="preserve">
     <value>Дополнительные параметры XHTTP (Extra)</value>
   </data>
-  <data name="TbAllowInsecureCertFetch" xml:space="preserve">
-    <value>Разрешить небезопасную загрузку сертификата (самоподписанного)</value>
-  </data>
-  <data name="TbAllowInsecureCertFetchTips" xml:space="preserve">
-    <value>Только для загрузки самоподписанных сертификатов. Это может подвергнуть вас риску атаки «человек посередине» (MITM).</value>
-  </data>
   <data name="menuUdpTestServer" xml:space="preserve">
     <value>Тест UDP-задержки конфигураций</value>
   </data>

v2rayN/ServiceLib/Resx/ResUI.zh-Hans.resx

@@ -1695,12 +1695,6 @@
   <data name="TransportExtra" xml:space="preserve">
     <value>XHTTP Extra</value>
   </data>
-  <data name="TbAllowInsecureCertFetch" xml:space="preserve">
-    <value>允许不安全获取证书（自签名）</value>
-  </data>
-  <data name="TbAllowInsecureCertFetchTips" xml:space="preserve">
-    <value>仅用于抓取自签证书，存在中间人风险。</value>
-  </data>
   <data name="menuUdpTestServer" xml:space="preserve">
     <value>测试 UDP 延迟 (多选)</value>
   </data>
@@ -1768,7 +1762,7 @@
     <value>将数据包末端拆分为更小片段发送，可能影响吞吐与延迟。</value>
   </data>
   <data name="TbEnableNetBridge" xml:space="preserve">
-    <value>启用进程流量劫持（实验性），类似 Proxifer 功能；可以和系统代理并存；和 TUN 模式冲突，请不要同时开启；</value>
+    <value>启用进程流量劫持（实验性），类似 Proxifer 功能；可以和系统代理并存；和 TUN 模式冲突，请不要同时开启；请在防火墙中允许 v2rayN 使用专用网络</value>
   </data>
   <data name="NetBridgeRuleTips" xml:space="preserve">
     <value>需要代理的进程名，多个进程请用逗号分隔；不在列表中的进程也会被劫持，但是会直连</value>
@@ -1776,4 +1770,10 @@
   <data name="menuNetBridge" xml:space="preserve">
     <value>进程流量劫持（实验性）</value>
   </data>
+  <data name="TbEnabletDnsViaProxy" xml:space="preserve">
+    <value>DNS 通过 Bridge</value>
+  </data>
+  <data name="TbSaveNetBridgeRule" xml:space="preserve">
+    <value>保存规则</value>
+  </data>
 </root>

v2rayN/ServiceLib/Resx/ResUI.zh-Hant.resx

@@ -1695,12 +1695,6 @@
   <data name="TransportExtra" xml:space="preserve">
     <value>XHTTP Extra</value>
   </data>
-  <data name="TbAllowInsecureCertFetch" xml:space="preserve">
-    <value>允許不安全獲取證書（自簽名）</value>
-  </data>
-  <data name="TbAllowInsecureCertFetchTips" xml:space="preserve">
-    <value>僅用於抓取自簽證書，存在中間人風險。</value>
-  </data>
   <data name="menuUdpTestServer" xml:space="preserve">
     <value>測試 UDP 延遲（多選）</value>
   </data>
@@ -1768,7 +1762,7 @@
     <value>將封包末端拆分為更小的片段進行傳送，可能會影響吞吐量與延遲</value>
   </data>
   <data name="TbEnableNetBridge" xml:space="preserve">
-    <value>啟用進程流量劫持（實驗性），類似 Proxifer 功能；可以和系統代理並存；和 TUN 模式衝突，請不要同時開啟；</value>
+    <value>啟用進程流量劫持（實驗性），類似 Proxifer 功能；可以和系統代理並存；和 TUN 模式衝突，請不要同時開啟；請在防火牆中允許 v2rayN 使用專用網絡</value>
   </data>
   <data name="NetBridgeRuleTips" xml:space="preserve">
     <value>需要代理程式的進程名，多個進程請用逗號分隔；不在清單中的進程也會被劫持，但是會直連</value>
@@ -1776,4 +1770,10 @@
   <data name="menuNetBridge" xml:space="preserve">
     <value>進程流量劫持（實驗性）</value>
   </data>
+  <data name="TbEnabletDnsViaProxy" xml:space="preserve">
+    <value>DNS 透過 Bridge</value>
+  </data>
+  <data name="TbSaveNetBridgeRule" xml:space="preserve">
+    <value>保存規則</value>
+  </data>
 </root>

v2rayN/ServiceLib/Sample/SampleClientConfig

@@ -17,14 +17,6 @@
 	],
 	"routing": {
 		"domainStrategy": "IPIfNonMatch",
-		"rules": [
-			{
-				"inboundTag": [
-					"api"
-				],
-				"outboundTag": "api",
-				"type": "field"
-			}
-		]
+		"rules": []
 	}
 }

v2rayN/ServiceLib/ServiceLib.csproj

@@ -67,6 +67,9 @@
 		<EmbeddedResource Update="Resx\ResUI.hu.resx">
 			<Generator>PublicResXFileCodeGenerator</Generator>
 		</EmbeddedResource>
+        <EmbeddedResource Update="Resx\ResUI.id.resx">
+			<Generator>PublicResXFileCodeGenerator</Generator>
+		</EmbeddedResource>
 		<EmbeddedResource Update="Resx\ResUI.resx">
 			<SubType>Designer</SubType>
 			<LastGenOutput>ResUI.Designer.cs</LastGenOutput>

v2rayN/ServiceLib/Services/CoreConfig/Singbox/SingboxConfigTemplateService.cs

@@ -83,6 +83,11 @@ public partial class CoreConfigSingboxService
         {
             return;
         }
+        if (!Utils.IsLocalIP(sendThrough))
+        {
+            return;
+        }
+
         foreach (var outbound in _coreConfig.outbounds ?? [])
         {
             outbound.inet4_bind_address = ShouldBindNet(outbound) ? sendThrough : null;

v2rayN/ServiceLib/Services/CoreConfig/V2ray/V2rayConfigTemplateService.cs

@@ -176,6 +176,11 @@ public partial class CoreConfigV2rayService
         {
             return;
         }
+        if (!Utils.IsLocalIP(sendThrough))
+        {
+            return;
+        }
+
         foreach (var outbound in _coreConfig.outbounds ?? [])
         {
             outbound.sendThrough = ShouldBindNet(outbound) ? sendThrough : null;

v2rayN/ServiceLib/Services/CoreConfig/V2ray/V2rayStatisticService.cs

@@ -6,45 +6,19 @@ public partial class CoreConfigV2rayService
     {
         if (_config.GuiItem.EnableStatistics || _config.GuiItem.DisplayRealTimeSpeed)
         {
-            const string tag = nameof(EInboundProtocol.api);
-            Metrics4Ray apiObj = new();
+            Metrics4Ray metricsObj = new();
             Policy4Ray policyObj = new();
             SystemPolicy4Ray policySystemSetting = new();
 
             _coreConfig.stats = new Stats4Ray();
 
-            apiObj.tag = tag;
-            _coreConfig.metrics = apiObj;
+            metricsObj.listen = $"{Global.Loopback}:{AppManager.Instance.StatePort}";
+            _coreConfig.metrics = metricsObj;
 
             policySystemSetting.statsOutboundDownlink = true;
             policySystemSetting.statsOutboundUplink = true;
             policyObj.system = policySystemSetting;
             _coreConfig.policy = policyObj;
-
-            if (!_coreConfig.inbounds.Exists(item => item.tag == tag))
-            {
-                Inbounds4Ray apiInbound = new();
-                Inboundsettings4Ray apiInboundSettings = new();
-                apiInbound.tag = tag;
-                apiInbound.listen = Global.Loopback;
-                apiInbound.port = AppManager.Instance.StatePort;
-                apiInbound.protocol = Global.InboundAPIProtocol;
-                apiInboundSettings.address = Global.Loopback;
-                apiInbound.settings = apiInboundSettings;
-                _coreConfig.inbounds.Add(apiInbound);
-            }
-
-            if (!_coreConfig.routing.rules.Exists(item => item.outboundTag == tag))
-            {
-                RulesItem4Ray apiRoutingRule = new()
-                {
-                    inboundTag = new List<string> { tag },
-                    outboundTag = tag,
-                    type = "field"
-                };
-
-                _coreConfig.routing.rules.Add(apiRoutingRule);
-            }
         }
     }
 }

v2rayN/ServiceLib/ViewModels/AddServerViewModel.cs

@@ -23,9 +23,6 @@ public class AddServerViewModel : MyReactiveObject
     [Reactive]
     public string CertSha { get; set; }
 
-    [Reactive]
-    public bool AllowInsecureCertFetch { get; set; }
-
     [Reactive]
     public string SalamanderPass { get; set; }
 
@@ -475,8 +472,7 @@ public class AddServerViewModel : MyReactiveObject
         }
 
         (Cert, var certError) = await CertPemManager.Instance.GetCertPemAsync(domain, serverName,
-            verifyPeerCertByName: Utils.String2List(SelectedSource.VerifyPeerCertByName),
-            allowInsecure: AllowInsecureCertFetch);
+            verifyPeerCertByName: Utils.String2List(SelectedSource.VerifyPeerCertByName));
         UpdateCertTip(certError);
     }
 
@@ -502,8 +498,7 @@ public class AddServerViewModel : MyReactiveObject
         }
 
         var (certs, certError) = await CertPemManager.Instance.GetCertChainPemAsync(domain, serverName,
-            verifyPeerCertByName: Utils.String2List(SelectedSource.VerifyPeerCertByName),
-            allowInsecure: AllowInsecureCertFetch);
+            verifyPeerCertByName: Utils.String2List(SelectedSource.VerifyPeerCertByName));
         Cert = CertPemManager.ConcatenatePemChain(certs);
         UpdateCertTip(certError);
     }

v2rayN/ServiceLib/ViewModels/NetBridgeViewModel.cs

@@ -5,6 +5,9 @@ public class NetBridgeViewModel : MyReactiveObject
     [Reactive]
     public bool EnableNetBridge { get; set; }
 
+    [Reactive]
+    public bool EnabletDnsViaProxy { get; set; }
+
     [Reactive]
     public string RuleProcess { get; set; }
 
@@ -27,22 +30,31 @@ public class NetBridgeViewModel : MyReactiveObject
                 await ToggleNetBridgeAsync(enabled);
             });
 
+        this.WhenAnyValue(x => x.EnabletDnsViaProxy)
+        .Skip(1)
+        .Subscribe(async enabled =>
+        {
+            await ToggleDnsViaProxyAsync(enabled);
+        });
+
         _ = Init();
     }
 
     private async Task Init()
     {
+        EnabletDnsViaProxy = _config.NetBridgeItem.EnableDnsViaProxy;
+
         _config.NetBridgeItem ??= new()
         {
             RuleProcess = string.Empty
         };
 
         EnableNetBridge = false;
-        RuleProcess = _config.NetBridgeItem.RuleProcess;
-        if (RuleProcess.IsNullOrEmpty())
+        if (_config.NetBridgeItem.RuleProcess.IsNullOrEmpty())
         {
-            RuleProcess = "Chrome.exe";
+            _config.NetBridgeItem.RuleProcess = "Chrome.exe";
         }
+        RuleProcess = _config.NetBridgeItem.RuleProcess;
 
         await Task.CompletedTask;
     }
@@ -58,6 +70,7 @@ public class NetBridgeViewModel : MyReactiveObject
             {
                 await NetBridgeManager.Instance.UpdateProxyConfig(Global.Loopback, AppManager.Instance.GetLocalPort(EInboundProtocol.socks));
                 await NetBridgeManager.Instance.UpdateRoutes(RuleProcess);
+                await NetBridgeManager.Instance.SetDnsViaProxy(EnabletDnsViaProxy);
             }
             NoticeManager.Instance.Enqueue(succeed ? ResUI.OperationSuccess : ResUI.OperationFailed);
         }
@@ -68,6 +81,13 @@ public class NetBridgeViewModel : MyReactiveObject
         }
     }
 
+    private async Task ToggleDnsViaProxyAsync(bool enabled)
+    {
+        _config.NetBridgeItem.EnableDnsViaProxy = enabled;
+
+        await NetBridgeManager.Instance.SetDnsViaProxy(enabled);
+    }
+
     /// </summary>
     private async Task SaveRulesAsync()
     {

v2rayN/v2rayN.Desktop/App.axaml.cs

@@ -23,8 +23,8 @@ public partial class App : Application
                 DataContext = StatusBarViewModel.Instance;
             }
 
-            desktop.Exit += OnExit;
-            desktop.MainWindow = new MainWindow();
+            var mainWindow = new MainWindow();
+            desktop.MainWindow = mainWindow;
 
             if (OperatingSystem.IsMacOS())
             {
@@ -35,6 +35,8 @@ public partial class App : Application
         base.OnFrameworkInitializationCompleted();
     }
 
+    #region MacOS Activation
+
     private void OnMacOSActivated(object? sender, ActivatedEventArgs args)
     {
         if (args.Kind != ActivationKind.Reopen)
@@ -42,17 +44,69 @@ public partial class App : Application
             return;
         }
 
+        if ((ApplicationLifetime as IClassicDesktopStyleApplicationLifetime)?.MainWindow is not MainWindow mainWindow)
+        {
+            return;
+        }
+
+        var isMiniaturized = MacAppUtils.IsWindowMiniaturized(mainWindow);
+
         Dispatcher.UIThread.Post(() =>
         {
+            if (isMiniaturized)
+            {
+                RestoreMacOSAccessoryPolicyAfterMiniaturize(mainWindow);
+                mainWindow.ShowHideWindow(true);
+                return;
+            }
+
             if (!AppManager.Instance.Config.UiItem.MacOSShowInDock)
             {
                 MacAppUtils.SetActivationPolicyAccessory();
             }
-            
-            ((ApplicationLifetime as IClassicDesktopStyleApplicationLifetime)?.MainWindow as MainWindow)?.ShowHideWindow(true);
+
+            mainWindow.ShowHideWindow(true);
         });
     }
 
+    private static void RestoreMacOSAccessoryPolicyAfterMiniaturize(MainWindow mainWindow)
+    {
+        if (AppManager.Instance.Config.UiItem.MacOSShowInDock)
+        {
+            return;
+        }
+
+        mainWindow
+            .GetObservable(Window.WindowStateProperty)
+            .Skip(1)
+            .Where(state => state != WindowState.Minimized)
+            .Take(1)
+            .ObserveOn(RxSchedulers.MainThreadScheduler)
+            .Subscribe(_ => QueueMacOSAccessoryPolicyRestore(mainWindow));
+    }
+
+    private static void QueueMacOSAccessoryPolicyRestore(MainWindow mainWindow)
+    {
+        // AppKit may keep isMiniaturized set until the Dock restore animation finishes.
+        DispatcherTimer.RunOnce(() => RestoreMacOSAccessoryPolicy(mainWindow), TimeSpan.FromMilliseconds(300));
+    }
+
+    private static void RestoreMacOSAccessoryPolicy(MainWindow mainWindow)
+    {
+        if (AppManager.Instance.Config.UiItem.MacOSShowInDock || MacAppUtils.IsWindowMiniaturized(mainWindow))
+        {
+            return;
+        }
+
+        MacAppUtils.SetActivationPolicyAccessory();
+        mainWindow.Activate();
+        mainWindow.Focus();
+    }
+
+    #endregion MacOS Activation
+
+    #region App Event
+
     private void CurrentDomain_UnhandledException(object sender, UnhandledExceptionEventArgs e)
     {
         if (e.ExceptionObject != null)
@@ -66,10 +120,6 @@ public partial class App : Application
         Logging.SaveLog("TaskScheduler_UnobservedTaskException", e.Exception);
     }
 
-    private void OnExit(object? sender, ControlledApplicationLifetimeExitEventArgs e)
-    {
-    }
-
     private async void MenuAddServerViaClipboardClick(object? sender, EventArgs e)
     {
         try
@@ -91,4 +141,6 @@ public partial class App : Application
         await AppManager.Instance.AppExitAsync(false);
         AppManager.Instance.Shutdown(true);
     }
+
+    #endregion App Event
 }

v2rayN/v2rayN.Desktop/Base/WindowBase.cs

@@ -6,6 +6,13 @@ public class WindowBase<TViewModel> : ReactiveWindow<TViewModel> where TViewMode
     {
         Initialized += OnWindowInitialized;
         Loaded += OnLoaded;
+        Loaded += (s, e) =>
+        {
+            if (Owner != null && !ShowInTaskbar)
+            {
+                CanMinimize = false;
+            }
+        };
     }
 
     private void ReactiveWindowBase_Closed(object? sender, EventArgs e)

v2rayN/v2rayN.Desktop/Common/AppBuilderExtension.cs

@@ -18,18 +18,18 @@ public static class AppBuilderExtension
 
         if (OperatingSystem.IsWindows())
         {
-            AddFontFallback(fallbacks, "Segoe UI Symbol");
             AddFontFallback(fallbacks, "Segoe UI Emoji");
+            AddFontFallback(fallbacks, "Segoe UI Symbol");
         }
         else if (OperatingSystem.IsMacOS())
         {
-            AddFontFallback(fallbacks, "Apple Symbols");
             AddFontFallback(fallbacks, "Apple Color Emoji");
+            AddFontFallback(fallbacks, "Apple Symbols");
         }
         else if (OperatingSystem.IsLinux())
         {
-            AddFontFallback(fallbacks, "Noto Sans Symbols");
             AddFontFallback(fallbacks, "Noto Color Emoji");
+            AddFontFallback(fallbacks, "Noto Sans Symbols");
         }
 
         return appBuilder.With(new FontManagerOptions

v2rayN/v2rayN.Desktop/Common/MacAppUtils.cs

@@ -13,6 +13,10 @@ internal static class MacAppUtils
             sel_registerName("setActivationPolicy:"),
             ActivationPolicyAccessory);
 
+    public static bool IsWindowMiniaturized(Window window)
+        => window.TryGetPlatformHandle() is IMacOSTopLevelPlatformHandle { NSWindow: not 0 } handle
+            && objc_msgSend_bool(handle.NSWindow, sel_registerName("isMiniaturized"));
+    
     [DllImport(LibObjC)]
     private static extern nint objc_getClass(string name);
 
@@ -22,6 +26,10 @@ internal static class MacAppUtils
     [DllImport(LibObjC, EntryPoint = "objc_msgSend")]
     private static extern nint objc_msgSend(nint receiver, nint selector);
 
+    [DllImport(LibObjC, EntryPoint = "objc_msgSend")]
+    [return: MarshalAs(UnmanagedType.I1)]
+    private static extern bool objc_msgSend_bool(nint receiver, nint selector);
+    
     [DllImport(LibObjC, EntryPoint = "objc_msgSend")]
     private static extern void objc_msgSend(nint receiver, nint selector, nint argument);
 }

v2rayN/v2rayN.Desktop/Views/AddServerWindow.axaml

@@ -1189,25 +1189,6 @@
                                                 Margin="{StaticResource Margin4}"
                                                 Content="{x:Static resx:ResUI.TbFetchCertChain}" />
                                         </StackPanel>
-                                        <StackPanel HorizontalAlignment="Left" Orientation="Horizontal">
-                                            <TextBlock
-                                                Margin="{StaticResource Margin4}"
-                                                VerticalAlignment="Center"
-                                                Text="{x:Static resx:ResUI.TbAllowInsecureCertFetch}" />
-                                            <ToggleSwitch
-                                                x:Name="togAllowInsecureCertFetch"
-                                                Margin="{StaticResource Margin4}"
-                                                HorizontalAlignment="Left" />
-                                        </StackPanel>
-                                        <TextBlock
-                                            x:Name="txtAllowInsecureCertFetchTips"
-                                            Width="400"
-                                            Margin="{StaticResource Margin4}"
-                                            VerticalAlignment="Center"
-                                            Foreground="#FFD32F2F"
-                                            IsVisible="False"
-                                            Text="{x:Static resx:ResUI.TbAllowInsecureCertFetchTips}"
-                                            TextWrapping="Wrap" />
                                         <TextBlock
                                             Width="400"
                                             Margin="{StaticResource Margin4}"

v2rayN/v2rayN.Desktop/Views/AddServerWindow.axaml.cs

@@ -236,8 +236,6 @@ public partial class AddServerWindow : WindowBase<AddServerViewModel>
             this.Bind(ViewModel, vm => vm.CertSha, v => v.txtCertSha256Pinning.Text).DisposeWith(disposables);
             this.Bind(ViewModel, vm => vm.CertTip, v => v.labCertPinning.Text).DisposeWith(disposables);
             this.Bind(ViewModel, vm => vm.Cert, v => v.txtCert.Text).DisposeWith(disposables);
-            this.Bind(ViewModel, vm => vm.AllowInsecureCertFetch, v => v.togAllowInsecureCertFetch.IsChecked).DisposeWith(disposables);
-            this.Bind(ViewModel, vm => vm.AllowInsecureCertFetch, v => v.txtAllowInsecureCertFetchTips.IsVisible).DisposeWith(disposables);
             this.Bind(ViewModel, vm => vm.SelectedSource.EchConfigList, v => v.txtEchConfigList.Text).DisposeWith(disposables);
             this.Bind(ViewModel, vm => vm.SelectedSource.VerifyPeerCertByName, v => v.txtVerifyPeerCertByName.Text).DisposeWith(disposables);
 

v2rayN/v2rayN.Desktop/Views/MainWindow.axaml.cs

@@ -429,7 +429,7 @@ public partial class MainWindow : WindowBase<MainWindowViewModel>
     public void ShowHideWindow(bool? blShow)
     {
         var bl = blShow ??
-                    (Utils.IsLinux()
+                    (Utils.IsLinux() || Utils.IsMacOS()
                     ? (!AppManager.Instance.ShowInTaskbar ^ (WindowState == WindowState.Minimized))
                     : !AppManager.Instance.ShowInTaskbar);
         if (bl)

v2rayN/v2rayN.Desktop/Views/MessageBoxDialog.axaml.cs

@@ -18,6 +18,8 @@ public partial class MessageBoxDialog : Window
 
         btnYes.Click += BtnYes_Click;
         btnNo.Click += BtnNo_Click;
+
+        CanMinimize = false;
     }
 
     private void BtnYes_Click(object? sender, RoutedEventArgs e)

v2rayN/v2rayN.Desktop/Views/NetBridgeView.axaml

@@ -34,6 +34,25 @@
                     TextWrapping="Wrap" />
             </StackPanel>
 
+            <StackPanel
+                Margin="{StaticResource Margin8}"
+                DockPanel.Dock="Top"
+                Orientation="Horizontal">
+
+                <ToggleSwitch
+                    x:Name="togEnabletDnsViaProxy"
+                    Margin="{StaticResource Margin8}"
+                    HorizontalAlignment="Left" />
+
+                <TextBlock
+                    Width="500"
+                    Margin="{StaticResource Margin8}"
+                    VerticalAlignment="Center"
+                    Text="{x:Static resx:ResUI.TbEnabletDnsViaProxy}"
+                    TextWrapping="Wrap" />
+            </StackPanel>
+
+
             <DockPanel>
                 <StackPanel
                     Margin="{StaticResource Margin8}"
@@ -57,7 +76,7 @@
                     <Button
                         x:Name="btnSave"
                         Width="100"
-                        Content="{x:Static resx:ResUI.TbConfirm}"
+                        Content="{x:Static resx:ResUI.TbSaveNetBridgeRule}"
                         IsDefault="True" />
                 </StackPanel>
 

v2rayN/v2rayN.Desktop/Views/ProfilesView.axaml

@@ -277,11 +277,19 @@
                         Header="{x:Static resx:ResUI.LvTestSpeed}"
                         Tag="SpeedVal" />
 
-                    <DataGridTextColumn
-                        Width="100"
-                        Binding="{Binding IpInfo}"
-                        Header="{x:Static resx:ResUI.LvTestIpInfo}"
-                        Tag="IpInfo" />
+                    <DataGridTemplateColumn SortMemberPath="IpInfo" Tag="IpInfo">
+                        <DataGridTemplateColumn.Header>
+                            <TextBlock Text="{x:Static resx:ResUI.LvTestIpInfo}" />
+                        </DataGridTemplateColumn.Header>
+                        <DataGridTemplateColumn.CellTemplate>
+                            <DataTemplate>
+                                <SelectableTextBlock
+                                    Margin="{StaticResource MarginLr8}"
+                                    VerticalAlignment="Center"
+                                    Text="{Binding Path=IpInfo, Mode=OneWay}" />
+                            </DataTemplate>
+                        </DataGridTemplateColumn.CellTemplate>
+                    </DataGridTemplateColumn>
 
                     <DataGridTextColumn
                         Width="100"

v2rayN/v2rayN.Desktop/v2rayN.Desktop.csproj

@@ -7,6 +7,7 @@
 		<AvaloniaUseCompiledBindingsByDefault>true</AvaloniaUseCompiledBindingsByDefault>
 		<AssemblyName>v2rayN</AssemblyName>
 		<AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+		<CETCompat>false</CETCompat>
 	</PropertyGroup>
 
 	<ItemGroup>

v2rayN/v2rayN/Views/AddServerWindow.xaml

@@ -1519,27 +1519,6 @@
                                         Content="{x:Static resx:ResUI.TbFetchCertChain}"
                                         Style="{StaticResource DefButton}" />
                                 </StackPanel>
-                                <StackPanel HorizontalAlignment="Left" Orientation="Horizontal">
-                                    <TextBlock
-                                        Margin="{StaticResource Margin4}"
-                                        VerticalAlignment="Center"
-                                        Style="{StaticResource ToolbarTextBlock}"
-                                        Text="{x:Static resx:ResUI.TbAllowInsecureCertFetch}" />
-                                    <ToggleButton
-                                        x:Name="togAllowInsecureCertFetch"
-                                        Margin="{StaticResource Margin4}"
-                                        HorizontalAlignment="Left" />
-                                </StackPanel>
-                                <TextBlock
-                                    x:Name="txtAllowInsecureCertFetchTips"
-                                    Width="400"
-                                    Margin="{StaticResource Margin4}"
-                                    VerticalAlignment="Center"
-                                    Foreground="#FFD32F2F"
-                                    Style="{StaticResource ToolbarTextBlock}"
-                                    Text="{x:Static resx:ResUI.TbAllowInsecureCertFetchTips}"
-                                    TextWrapping="Wrap"
-                                    Visibility="Collapsed" />
                                 <TextBlock
                                     Width="400"
                                     Margin="{StaticResource Margin4}"

v2rayN/v2rayN/Views/AddServerWindow.xaml.cs

@@ -234,10 +234,6 @@ public partial class AddServerWindow
             this.Bind(ViewModel, vm => vm.CertSha, v => v.txtCertSha256Pinning.Text).DisposeWith(disposables);
             this.Bind(ViewModel, vm => vm.CertTip, v => v.labCertPinning.Text).DisposeWith(disposables);
             this.Bind(ViewModel, vm => vm.Cert, v => v.txtCert.Text).DisposeWith(disposables);
-            this.Bind(ViewModel, vm => vm.AllowInsecureCertFetch, v => v.togAllowInsecureCertFetch.IsChecked).DisposeWith(disposables);
-            this.WhenAnyValue(x => x.ViewModel.AllowInsecureCertFetch)
-                .Select(b => b ? Visibility.Visible : Visibility.Collapsed)
-                .BindTo(this, v => v.txtAllowInsecureCertFetchTips.Visibility);
             this.Bind(ViewModel, vm => vm.Cert, v => v.txtCert.Text).DisposeWith(disposables);
             this.Bind(ViewModel, vm => vm.SelectedSource.EchConfigList, v => v.txtEchConfigList.Text).DisposeWith(disposables);
             this.Bind(ViewModel, vm => vm.SelectedSource.VerifyPeerCertByName, v => v.txtVerifyPeerCertByName.Text).DisposeWith(disposables);

v2rayN/v2rayN/Views/NetBridgeView.xaml

@@ -35,6 +35,25 @@
                 TextWrapping="Wrap" />
         </StackPanel>
 
+        <StackPanel
+            Margin="{StaticResource Margin8}"
+            DockPanel.Dock="Top"
+            Orientation="Horizontal">
+
+            <ToggleButton
+                x:Name="togEnabletDnsViaProxy"
+                Margin="{StaticResource Margin8}"
+                HorizontalAlignment="Left" />
+
+            <TextBlock
+                Width="500"
+                Margin="{StaticResource Margin8}"
+                VerticalAlignment="Center"
+                Style="{StaticResource ToolbarTextBlock}"
+                Text="{x:Static resx:ResUI.TbEnabletDnsViaProxy}"
+                TextWrapping="Wrap" />
+        </StackPanel>
+
         <DockPanel>
             <StackPanel
                 Margin="{StaticResource Margin8}"
@@ -59,7 +78,7 @@
                 <Button
                     x:Name="btnSave"
                     Width="100"
-                    Content="{x:Static resx:ResUI.TbConfirm}"
+                    Content="{x:Static resx:ResUI.TbSaveNetBridgeRule}"
                     IsDefault="True"
                     Style="{StaticResource DefButton}" />
             </StackPanel>

v2rayN/v2rayN/Views/NetBridgeView.xaml.cs

@@ -13,6 +13,7 @@ public partial class NetBridgeView
             this.BindCommand(ViewModel, vm => vm.SaveRulesCmd, v => v.btnSave).DisposeWith(disposables);
 
             this.Bind(ViewModel, vm => vm.EnableNetBridge, v => v.togEnableNetBridge.IsChecked).DisposeWith(disposables);
+            this.Bind(ViewModel, vm => vm.EnabletDnsViaProxy, v => v.togEnabletDnsViaProxy.IsChecked).DisposeWith(disposables);
             this.Bind(ViewModel, vm => vm.RuleProcess, v => v.txtRuleProcess.Text).DisposeWith(disposables);
 
         });

v2rayN/v2rayN/v2rayN.csproj

@@ -10,6 +10,7 @@
 		<ApplicationHighDpiMode>PerMonitorV2</ApplicationHighDpiMode>
 		<SupportedOSPlatformVersion>7.0</SupportedOSPlatformVersion>
 		<AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+		<CETCompat>false</CETCompat>
 	</PropertyGroup>
 
 	<ItemGroup>