sing-box: 1.11.15 -> 1.12.3, nixos/sing-box: add user and group, nixosTests.sing-box: migrate config

[Prince213]

Release notes: https://github.com/SagerNet/sing-box/releases/tag/v1.12.3
Changelog: https://sing-box.sagernet.org/changelog/#1123

Reference:

• https://git.sr.ht/~prince213/nix-packages/tree/main/item/pkgs/sing-box-beta/default.nix
• https://git.sr.ht/~prince213/nix-packages/tree/main/item/modules/services/networking/sing-box.nix

Things done

• Built on platform:
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• Tested, as applicable:
  • NixOS tests in nixos/tests.
  • Package tests at passthru.tests.
  • Tests in lib/tests or pkgs/test for functions and "core" functionality.
• Ran nixpkgs-review on this PR. See nixpkgs-review usage.
• Tested basic functionality of all binary files, usually in ./result/bin/.
• Nixpkgs Release Notes
  • Package update: when the change is major or breaking.
• NixOS Release Notes
  • Module addition: when adding a new NixOS module.
  • Module update: when the change is significant.
• Fits CONTRIBUTING.md, pkgs/README.md, maintainers/README.md and other READMEs.

---

Add a 👍 reaction to pull requests you find important.

[Prince213]

nixpkgs-review result

Generated using nixpkgs-review-gha

Command: nixpkgs-review pr 430835

Logs: https://github.com/Prince213/nixpkgs-review-gha/actions/runs/16716235811

---

x86_64-linux

⏩ 2 packages blacklisted:

• nixos-install-tools
• tests.nixos-functions.nixos-test

✅ 1 package built:

• sing-box

---

aarch64-linux

⏩ 2 packages blacklisted:

• nixos-install-tools
• tests.nixos-functions.nixos-test

✅ 1 package built:

• sing-box

---

x86_64-darwin (sandbox = true)

✅ 1 package built:

• sing-box

---

aarch64-darwin (sandbox = true)

✅ 1 package built:

• sing-box

[NickCao]

Otherwise LGTM.

[nekohasekai]

It should be noted that although sing-box 1.12.0 changes some configuration formats, it is not a breaking change. The old format will continue to be compatible until two minor versions, which is about a year later, giving users plenty of time to update their configurations.

[Prince213]

It should be noted that although sing-box 1.12.0 changes some configuration formats, it is not a breaking change. The old format will continue to be compatible until two minor versions, which is about a year later, giving users plenty of time to update their configurations.

Thanks. However, this will mean that if we don't consider 1.11.15 -> 1.12.0 as a breaking change, then we need to make 1.12.1 -> 1.12.2 as one, which breaks semantic versioning and will cause confusion. Thus it's better to do it right now, and nothing can stop nixos-unstable user to migrate now or later anyway.

[nekohasekai]

It should be noted that although sing-box 1.12.0 changes some configuration formats, it is not a breaking change. The old format will continue to be compatible until two minor versions, which is about a year later, giving users plenty of time to update their configurations.

Thanks. However, this will mean that if we don't consider 1.11.15 -> 1.12.0 as a breaking change, then we need to make 1.12.1 -> 1.12.2 as one, which breaks semantic versioning and will cause confusion. Thus it's better to do it right now, and nothing can stop nixos-unstable user to migrate now or later anyway.

You seem to have misunderstood, that's 1.14.0, not 1.12.2

[nekohasekai]

Since 1.12 has been in beta for six months and I haven't received any bug reports regarding the default interface finder, I suspect this is a configuration issue or a test failure caused by an unusual environment.

In any case, if this bug occurs during normal use, please open an issue with us.

[Prince213]

I suspect this is a configuration issue or a test failure caused by an unusual environment.

sing-box works fine, just that there's this harmless ERROR level message. It could be related to how we set up network interfaces, as I don't see this outside of NixOS tests.

[Prince213]

nixpkgs-review result

Generated using nixpkgs-review-gha

Command: nixpkgs-review pr 430835 -p sing-box -p nixosTests.sing-box

Logs: https://github.com/Prince213/nixpkgs-review-gha/actions/runs/17088627400

---

x86_64-linux

✅ 1 test built:

• nixosTests.sing-box

✅ 1 package built:

• sing-box

---

aarch64-linux

✅ 1 test built:

• nixosTests.sing-box

✅ 1 package built:

• sing-box

---

x86_64-darwin (sandbox = true)

✅ 1 package built:

• sing-box

---

aarch64-darwin (sandbox = true)

✅ 1 package built:

• sing-box

[Prince213]

nixpkgs-review result

Generated using nixpkgs-review-gha

Command: nixpkgs-review pr 430835 -p sing-box -p nixosTests.sing-box
Commit: 5bcb1aca6fbbbc18874f3f0291e06d57310e4889 (subsequent changes)
Merge: b370d8814c11efde6144f01b02e140b94586bfb8

Logs: https://github.com/Prince213/nixpkgs-review-gha/actions/runs/17118080780

---

x86_64-linux

✅ 1 test built:

• nixosTests.sing-box

✅ 1 package built:

• sing-box

---

aarch64-linux

❌ 1 package failed to build:

• nixosTests.sing-box

✅ 1 package built:

• sing-box

---

x86_64-darwin (sandbox = true)

✅ 1 package built:

• sing-box

---

aarch64-darwin (sandbox = true)

✅ 1 package built:

• sing-box

[Prince213]

aarch64-linux test is failing consistently:

error: Cannot build '/nix/store/iqvxcg445ch6hv7kia2cpwzlh91yh7b0-vm-test-run-sing-box.drv'.
       Reason: required system or feature not available
       Required system: 'aarch64-linux' with features {kvm, nixos-test}
       Current system: 'aarch64-linux' with features {benchmark, big-parallel, nixos-test, uid-range}

[dramforever]

aarch64-linux sing-box.tests.sing-box passes on my Apple MacBook Pro (14-inch, M1 Pro, 2021) "j314s"

[NickCao]

Again, please test if the polkit/dbus rules actually work as intended, otherwise we may as well remove them.

[Prince213]

Again, please test if the polkit/dbus rules actually work as intended, otherwise we may as well remove them.

They are used when sing-box is running as an unprivileged user (such as sing-box) and needs to set up resolved-related features. Since resolved is tested to work, we can be confident that the rules are working.