fix: adopt sing-box 1.14 DNS hijacking

tests/test_packaging.py

@@ -1,5 +1,7 @@
 from __future__ import annotations
 
+import os
+import subprocess
 import unittest
 from pathlib import Path
 
@@ -25,11 +27,31 @@ class PackagingTests(unittest.TestCase):
         control = (ROOT / "debian/control").read_text(encoding="utf-8")
         self.assertIn("sing-box (= 1.14.0)", control)
 
-    def test_in_place_upgrade_is_rejected(self) -> None:
+    def test_cross_release_upgrade_is_rejected_and_same_release_reinstall_allowed(self) -> None:
         preinst = (ROOT / "debian/preinst").read_text(encoding="utf-8")
-        self.assertIn('[ "$1" = upgrade ]', preinst)
+        self.assertIn('[ "$1" = upgrade ] && [ "${2:-}" != "0.2.0" ]', preinst)
+        self.assertIn("in-place upgrades from another release", preinst)
         self.assertIn("exit 1", preinst)
 
+    @unittest.skipUnless(os.name == "posix", "Debian maintainer scripts require POSIX sh")
+    def test_preinst_lifecycle_exit_codes(self) -> None:
+        preinst = ROOT / "debian/preinst"
+        cases = (
+            (("install",), 0),
+            (("upgrade", "0.2.0", "0.2.0"), 0),
+            (("upgrade", "0.1.0", "0.2.0"), 1),
+            (("upgrade", "0.2.1", "0.2.0"), 1),
+        )
+        for arguments, expected in cases:
+            with self.subTest(arguments=arguments):
+                result = subprocess.run(
+                    ["/bin/sh", str(preinst), *arguments],
+                    capture_output=True,
+                    text=True,
+                    check=False,
+                )
+                self.assertEqual(result.returncode, expected, result.stderr)
+
     def test_postinst_checks_for_legacy_state(self) -> None:
         postinst = (ROOT / "debian/postinst").read_text(encoding="utf-8")
         self.assertIn("vpn_egressctl.installcheck", postinst)