fix: package Android AAR compliance cross-platform

Author: UndergroundAlzar

apps/android/lib/settings/settings_page.dart

@@ -70,7 +70,7 @@ class SettingsPage extends StatelessWidget {
             child: AboutListTile(
               icon: Icon(Icons.info_outline),
               applicationName: 'AikoBox',
-              applicationVersion: '0.1.0-beta.2',
+              applicationVersion: '0.1.0-beta.3',
               applicationLegalese: 'GPL-3.0',
             ),
           ),

apps/android/pubspec.yaml

@@ -1,7 +1,7 @@
 name: aikobox_android
 description: AikoBox Android client.
 publish_to: none
-version: 0.1.0-beta.2+2
+version: 0.1.0-beta.3+3
 
 environment:
   sdk: '>=3.12.2 <4.0.0'

docs/releases/v0.1.0-beta.2.md docs/releases/v0.1.0-beta.3.mddocs/releases/v0.1.0-beta.2.md renamed to docs/releases/v0.1.0-beta.3.md

@@ -1,20 +1,20 @@
-# AikoBox v0.1.0-beta.2
+# AikoBox v0.1.0-beta.3
 
-AikoBox `v0.1.0-beta.2` 是首个同时提供 Windows x64 与 Android ARM64 的公开预发行版。本版重点修复 Windows 核心、系统代理、路由转换和备份恢复的高风险问题，并首次提供由固定发布密钥签名的 Android VPN 客户端。它仍是 Beta；升级或首次安装前，请保留可用的联网方案和配置备份。
+AikoBox `v0.1.0-beta.3` 是首个同时提供 Windows x64 与 Android ARM64 的公开预发行版。本版重点修复 Windows 核心、系统代理、路由转换和备份恢复的高风险问题，并首次提供由固定发布密钥签名的 Android VPN 客户端。它仍是 Beta；升级或首次安装前，请保留可用的联网方案和配置备份。
 
-AikoBox `v0.1.0-beta.2` is the first public prerelease for both Windows x64 and Android ARM64. It focuses on high-risk fixes in Windows core lifecycle, system proxy handling, route conversion, and backup recovery, and introduces an Android VPN client signed with a fixed release key. This is still a beta; keep a working connectivity fallback and configuration backup before installing or upgrading.
+AikoBox `v0.1.0-beta.3` is the first public prerelease for both Windows x64 and Android ARM64. It focuses on high-risk fixes in Windows core lifecycle, system proxy handling, route conversion, and backup recovery, and introduces an Android VPN client signed with a fixed release key. This is still a beta; keep a working connectivity fallback and configuration backup before installing or upgrading.
 
 ## 下载 / Downloads
 
-- `aikobox-windows-0.1.0-beta.2-x64-setup.exe`：Windows 10/11 x64 安装版；TUN 需要管理员授权。
-- `aikobox-windows-0.1.0-beta.2-x64-portable.exe`：Windows 10/11 x64 便携版；建议首次试用。
-- `aikobox-android-0.1.0-beta.2-arm64-v8a.apk`：仅适用于 ARM64-v8a、Android 7.0（API 24）或更高版本。
+- `aikobox-windows-0.1.0-beta.3-x64-setup.exe`：Windows 10/11 x64 安装版；TUN 需要管理员授权。
+- `aikobox-windows-0.1.0-beta.3-x64-portable.exe`：Windows 10/11 x64 便携版；建议首次试用。
+- `aikobox-android-0.1.0-beta.3-arm64-v8a.apk`：仅适用于 ARM64-v8a、Android 7.0（API 24）或更高版本。
 - 每个二进制文件均有同名 `.sha256`，并提供统一的 `SHA256SUMS.txt`、`RELEASE-MANIFEST.txt` 和第三方许可审计。
 - Release 同时附带 Android libbox、Windows sing-box 核心与 Windows sysproxy 的完整对应源码包、依赖许可证包、机器可读证据报告、独立 Notice 和组件校验和。统一 `SHA256SUMS.txt` 覆盖除其自身外的全部公开资产。
 
-- `aikobox-windows-0.1.0-beta.2-x64-setup.exe`: installer for Windows 10/11 x64; TUN requires elevation.
-- `aikobox-windows-0.1.0-beta.2-x64-portable.exe`: portable Windows 10/11 x64 build; recommended for first-time testing.
-- `aikobox-android-0.1.0-beta.2-arm64-v8a.apk`: for ARM64-v8a devices running Android 7.0 (API 24) or newer only.
+- `aikobox-windows-0.1.0-beta.3-x64-setup.exe`: installer for Windows 10/11 x64; TUN requires elevation.
+- `aikobox-windows-0.1.0-beta.3-x64-portable.exe`: portable Windows 10/11 x64 build; recommended for first-time testing.
+- `aikobox-android-0.1.0-beta.3-arm64-v8a.apk`: for ARM64-v8a devices running Android 7.0 (API 24) or newer only.
 - Every binary has a matching `.sha256`; the release also includes `SHA256SUMS.txt`, `RELEASE-MANIFEST.txt`, and the third-party license audit.
 - The Release also carries complete corresponding source, dependency-license bundles, machine-readable evidence reports, standalone Notices, and component checksums for Android libbox, the Windows sing-box core, and Windows sysproxy. The unified `SHA256SUMS.txt` covers every public asset except itself.
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "aikobox",
-  "version": "0.1.0-beta.2",
+  "version": "0.1.0-beta.3",
   "description": "Windows proxy client powered by sing-box with Clash YAML compatibility",
   "private": true,
   "license": "GPL-3.0-only",

scripts/license-android-libbox-release.mjs

@@ -15,6 +15,7 @@ import {
 import { tmpdir } from 'node:os'
 import { basename, dirname, extname, join, relative, resolve } from 'node:path'
 import { fileURLToPath, pathToFileURL } from 'node:url'
+import AdmZip from 'adm-zip'
 
 import {
   EXPECTED_GO_VERSION,
@@ -241,14 +242,21 @@ export function extractSource(sourceDir, destination) {
   return join(destination, `sing-box-${LIBBOX_VERSION}`)
 }
 
-function extractLibbox(aarPath, temporaryRoot, goExe) {
-  const entries = run('tar', ['-tf', aarPath]).replaceAll('\r\n', '\n').split('\n').filter(Boolean)
+export function readArm64LibboxFromAar(aarPath) {
+  const archive = new AdmZip(aarPath)
+  const entries = archive.getEntries().map((entry) => entry.entryName)
   const native = entries.filter((entry) => /^jni\/[^/]+\/[^/]+\.so$/.test(entry))
   if (native.length !== 1 || native[0] !== 'jni/arm64-v8a/libbox.so') {
     throw new Error(`AAR ABI gate failed: ${native.join(', ')}`)
   }
+  const entry = archive.getEntry(native[0])
+  if (!entry || entry.isDirectory) throw new Error('AAR libbox payload is missing')
+  return entry.getData()
+}
+
+function extractLibbox(aarPath, temporaryRoot, goExe) {
   const libboxPath = join(temporaryRoot, 'libbox.so')
-  writeFileSync(libboxPath, run('tar', ['-xOf', aarPath, native[0]], { encoding: 'buffer' }))
+  writeFileSync(libboxPath, readArm64LibboxFromAar(aarPath))
   const raw = run(goExe, ['version', '-m', libboxPath])
   const buildInfo = parseGoBuildInfo(raw)
   if (buildInfo.goVersion !== EXPECTED_GO_VERSION) {

scripts/license-android-libbox-release.test.mjs

@@ -3,14 +3,16 @@ import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import test from 'node:test'
+import AdmZip from 'adm-zip'
 
 import {
   auditCoverage,
   isLegalFile,
   nativeInputsFromPackage,
   parseJsonStream,
   parseModuleInventory,
-  parseVendorModules
+  parseVendorModules,
+  readArm64LibboxFromAar
 } from './license-android-libbox-release.mjs'
 
 function inventory(count = 75) {
@@ -43,6 +45,23 @@ test('recognizes legal files without treating source files as notices', () => {
   assert.equal(isLegalFile('/module/license_test.go'), false)
 })
 
+test('reads the ARM64 libbox payload from the ZIP-format AAR without invoking tar', () => {
+  const fixture = mkdtempSync(join(tmpdir(), 'aikobox-aar-test-'))
+  try {
+    const aarPath = join(fixture, 'libbox.aar')
+    const archive = new AdmZip()
+    archive.addFile('jni/arm64-v8a/libbox.so', Buffer.from('arm64-libbox'))
+    archive.writeZip(aarPath)
+    assert.deepEqual(readArm64LibboxFromAar(aarPath), Buffer.from('arm64-libbox'))
+
+    archive.addFile('jni/x86_64/libbox.so', Buffer.from('unexpected-abi'))
+    archive.writeZip(aarPath)
+    assert.throws(() => readArm64LibboxFromAar(aarPath), /AAR ABI gate failed/)
+  } finally {
+    rmSync(fixture, { recursive: true, force: true })
+  }
+})
+
 test('detects linked native inputs and blocks incomplete coverage', () => {
   const fixture = mkdtempSync(join(tmpdir(), 'aikobox-license-test-'))
   try {