Repository navigation
feat: migrate to sing-box 1.14.2 - #9206
garmr-ulfr wants to merge 4 commits into
Conversation
- bump radiance, and sing-box to the getlantern/sing-box-minimal fork - drop the sing-tun fork; 1.14's sing-tun has the gVisor fix it carried - implement the 1.14 platform interface methods on Android, iOS and macOS - set every TUN DNS server address, and none when DNS mode is disabled
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Update sing-box dependencies go.mod, docs/android-arm32-validation.md |
Updates sing-box and related dependency versions, removes the sing-tun replacement, and records that sing-box 1.14 includes the teardown fix upstream. |
Implement platform callbacks android/app/src/main/kotlin/org/getlantern/lantern/{notification/NotificationManager.kt,service/*}, ios/Tunnel/SingBox/ExtensionPlatformInterface.swift, macos/PacketTunnel/SingBox/ExtensionPlatformInterface.swift, lantern-core/stub/stub_interface.go, lantern-core/utils/common_test.go |
Adds notification cancellation and platform callback implementations. Unsupported operations return errors or throw exceptions; capability checks return false, and hostname queries return empty strings. Removes system-certificate callbacks and updates the test listener. |
Configure TUN DNS servers android/app/src/main/kotlin/org/getlantern/lantern/service/LanternVpnService.kt, ios/Tunnel/SingBox/ExtensionPlatformInterface.swift, macos/PacketTunnel/SingBox/ExtensionPlatformInterface.swift |
TUN setup now uses all available DNS server addresses and omits DNS settings when DNS is disabled or no addresses are available. |
Priority:
Estimated code review effort: 3 (Moderate) | ~25 minutes
Change: Feature
Possibly related issues
- getlantern/engineering#3971: The PR changes Android VPN notification methods, but does not show the component-targeted
PendingIntentfix described by the issue. - getlantern/grants#1266: The PR changes DNS handling to use all returned addresses and none when DNS is disabled, but does not establish completion of the full remote-configuration activity.
Possibly related PRs
- getlantern/lantern#8861: The no-VPN service implements
PlatformInterfaceWrapper, which this PR updates with callbacks required by sing-box 1.14.2.
Suggested reviewers: jigar-f, myleshorton
Merge Risk: 
9154d
-
No actionable merge-blocking issue is established by the supplied evidence. Normal checks, including native-platform compilation, should complete before merging.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly and concisely describes the primary change: migrating the project to sing-box 1.14.2. Docstring Coverage Docstring coverage is inconclusive: files from earlier reviews still need to be rechecked within the check's analysis limits. Not blocking. Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request.
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
There was a problem hiding this comment.
🔵 Needs a closer look
The cross-platform VPN upgrade needs native compilation and device-level DNS, disconnect, and reconnect validation before human approval.
No open issues 🎉
What changed in this PR
Migrates Lantern’s VPN core to sing-box 1.14.2 and adapts the Android, iOS, and macOS integrations to its updated platform interface.
Changes:
- Updates Go dependency pins and checksums, aligns gVisor, and removes the superseded sing-tun backport.
- Adds platform callbacks for notification cancellation and unsupported optional features.
- Updates TUN DNS setup to accept multiple servers and respect disabled DNS mode.
| File | Description |
|---|---|
macos/PacketTunnel/SingBox/ExtensionPlatformInterface.swift |
Adapts macOS platform callbacks and DNS setup. |
lantern-core/utils/common_test.go |
Updates the test listener for the expanded interface. |
lantern-core/stub/stub_interface.go |
Aligns the Go stub with the new platform interface. |
ios/Tunnel/SingBox/ExtensionPlatformInterface.swift |
Adapts iOS platform callbacks and DNS setup. |
go.sum |
Updates dependency checksums. |
go.mod |
Pins the upgraded networking dependency stack. |
docs/android-arm32-validation.md |
Documents why the sing-tun backport is no longer pinned. |
android/app/src/main/kotlin/org/getlantern/lantern/service/PlatformInterfaceWrapper.kt |
Implements callbacks for unsupported optional features. |
android/app/src/main/kotlin/org/getlantern/lantern/service/LanternVpnService.kt |
Updates DNS handling and delegates notification cancellation. |
android/app/src/main/kotlin/org/getlantern/lantern/notification/NotificationManager.kt |
Adds notification cancellation by type ID. |
Review effort: Balanced
|
@garmr-ulfr, let's take our time with this one. It seems like a few changes. If ready, we should run nightly and see if it's working without any issue. |
@jigar-f, you have no idea! 😄 v1.14.2 has so many changes, updating to it ended up touching 5 repos, including lantern-cloud. Radiance required a design change, which required a small refactor and updates to pretty much every file in the VPN package. We'll definitely need to do plenty of testing, especially on iOS, to make sure the extension doesn't use too much memory. |
Damn, that's a lot. Thanks for doing it. Hope we get a lot out of it. |
# Conflicts: # go.mod # go.sum
Moves the client to sing-box 1.14.2. It pins:
getlantern/sing-box-minimalat the commit of libbox: build native shell sessions only with with_tailscale sing-box-minimal#75;All three pins need to move to tagged or released versions once those PRs merge.
Dependencies
getlantern/sing-tunreplace. Its only change, theLinkEndpointFilter.Attach(nil)fix, is upstream in the sing-tun that 1.14 uses (be4ce8d320a5). The arm32 validation doc notes this.v0.0.0-20260727.0-sing-box-mod.1, the version 1.14.2 builds against.experimental/libbox/native_shell_session.golinks the whole sagernet/tailscale client into any build withwith_gvisor: about 209 packages in the iOS extension and the Android AAR, against none onmain. sing-box-minimal#75 builds that file only withwith_tailscale, and with itgo list -depsfor./lantern-core/mobileon ios and android shows no sagernet/tailscale packages.Platform interface
libbox's
PlatformInterfacedropsSystemCertificatesand adds methods for the neighbor resolver, the platform shell and SSH used by Tailscale, the bridge outbound, notification cancelling andRegisterMyInterface.RegisterMyInterfaceruns on everyopenTun, so it's a no-op that never throws.CancelNotificationremoves whatSendNotificationposted.systemCertificatesoverride. On Android, sing-box now reads the system root store itself fromAndroidCAStore.lantern-core/stubgets the same methods.TUN DNS
TunOptions.GetDNSServerAddressnow returns a list, andGetDNSModeis new.openTunon all three platforms now:disabled.This matches upstream's own clients.
Testing
go build,go vetandgo test -racepass with the standard tags.TestBuildAttachmentReadsHEICDatafails the same way onmainon my machine; it depends on the local MIME database.gobindfor 1.14: every override's signature matches. CI is the first real compile.Summary by CodeRabbit