release: prepare 0.2.0 for sing-box 1.14

debian/changelog

@@ -1,3 +1,12 @@
+vpn-egressctl (0.2.0) unstable; urgency=medium
+
+  * Target sing-box 1.14.0 and add the fixed HY2XS Gecko profile.
+  * Preserve the established DNS and routing contract explicitly.
+  * Reject in-place upgrades and legacy rollback state.
+  * License the 0.2 release under MPL-2.0.
+
+ -- Flamy Studio <dev@flamy.studio>  Tue, 08 Sep 2026 00:00:00 +0500
+
 vpn-egressctl (0.1.0) unstable; urgency=medium
 
   * Initial release for sing-box 1.13.19.

debian/control

@@ -8,7 +8,7 @@ Rules-Requires-Root: no
 
 Package: vpn-egressctl
 Architecture: all
-Depends: ${misc:Depends}, ${python3:Depends}, python3 (>= 3.13), sing-box (= 1.13.19), systemd, nftables, iproute2
+Depends: ${misc:Depends}, ${python3:Depends}, python3 (>= 3.13), sing-box (= 1.14.0), systemd, nftables, iproute2
 Description: declarative control plane for the sing-box VPN egress gateway
  Generates, validates and transactionally applies the complete sing-box
  configuration from a protected Hysteria2 URI and a versioned local policy.

debian/copyright

@@ -0,0 +1,15 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: vpn-egressctl
+Source: https://git.flamy.studio/prod/singbox_glue.git
+
+Files: *
+Copyright: 2026 Flamy Studio
+License: MPL-2.0
+
+License: MPL-2.0
+ This Source Code Form is subject to the terms of the Mozilla Public
+ License, v. 2.0. If a copy of the MPL was not distributed with this
+ file, You can obtain one at https://mozilla.org/MPL/2.0/.
+ .
+ On Debian systems, the complete text is available in
+ /usr/share/common-licenses/MPL-2.0 and in the source package as LICENSE.

debian/postinst

@@ -7,6 +7,10 @@ if [ "$1" = configure ]; then
     if [ ! -e /etc/vpn-egress/policy.json ]; then
         install -m 0600 -o root -g root /usr/share/vpn-egressctl/policy.json /etc/vpn-egress/policy.json
     fi
+    python3 -m vpn_egressctl.installcheck \
+        /etc/vpn-egress/policy.json \
+        /var/lib/vpn-egress \
+        /etc/sing-box/config.json
     systemctl daemon-reload >/dev/null 2>&1 || true
 fi
 

debian/preinst

@@ -0,0 +1,10 @@
+#!/bin/sh
+set -eu
+
+if [ "$1" = upgrade ]; then
+    echo "vpn-egressctl 0.2.0 does not support in-place upgrades." >&2
+    echo "Remove the installed release, archive its state, then install 0.2.0 cleanly." >&2
+    exit 1
+fi
+
+exit 0

debian/prerm

@@ -2,7 +2,7 @@
 set -eu
 
 if [ "$1" = remove ]; then
-    systemctl stop vpn-egress-sync.path >/dev/null 2>&1 || true
+    systemctl stop vpn-egress-sync.path sing-box.service >/dev/null 2>&1 || true
     systemctl disable vpn-egress-sync.path vpn-egress-guard.service >/dev/null 2>&1 || true
 fi