PublicVPNList Windows 0.2.0 candidate — corresponding sources and build inputs

Target: Windows 11 x64. No bit-for-bit reproducibility or publication acceptance claimed.
Application helper: Go 1.27.1; Flutter 3.47.6 / Dart 3.13.5; VS 2022 C++ and Windows SDK 26100; Inno Setup 7.1.0.
The allowlisted application source ZIP includes source, Go modules, pubspec.lock, native runner, installer, core hash manifest and build scripts. Supply only public client trust metadata and the exact official core archive, then run scripts/build-native.ps1 as described in packaging/windows/README.md.

Official network core: sing-box 1.14.2, revision af6e64c3b69e6132ebaee0e1a3d24e93903f6709, upstream Go 1.26.8, windows/amd64 v1, CGO_ENABLED=0. Full upstream tags and build settings are recorded in core-modules.json. All 138 exact core/helper module ZIP/mod/info files and original notices are in core-module-sources.tar.gz; source-inventory.json records Go checksum values and archive SHA256. Keep original module versions and use the upstream sing-box build driver/release workflow at that revision; do not infer its flags from a Linux build.

Native DLL: libcronet.dll SHA256 3217c6260fbca5f16072e0b79735742f40109a63bb0ff88fd6b96dd6b54a2928 matches checksum-verified cronet-go/lib/windows_amd64 v0.0.0-20260912104006-c10c03c318db. Upstream library commit says Build from 049f2909. The exact build-driver repository archive is cronet-build-driver-049f2909701c.tar.gz. Its naiveproxy submodule is 72a06c9fca0e2d228588c7f3074bf7efff3ff686, provided in naiveproxy-72a06c9f.tar.gz (SHA256 396d4ad6f5bf8ff812f915f0e21281748d7009773fa1bf182cd765f130fd9b19). The binding cronet-go 0d28acc44093 source is included in the Go module bundle; it pins the same native source.

Reconstruct the build-driver directory from its archive and place the extracted naiveproxy source in its naiveproxy/ subdirectory. On Windows, follow .github/workflows/naive-build.yml windows job and cmd/build-naive in that exact driver, with Visual Studio C++/SDK, Go and Ninja available. Its build command is:
  go run ./cmd/build-naive --target=windows/amd64 build
  go run ./cmd/build-naive --target=windows/amd64 package --local
The driver fetches its pinned Chromium compiler/toolchain inputs via src/get-clang.sh and src/DEPS, configures GN for the Windows x64 Cronet DLL and invokes Ninja. This is the upstream source/build recipe; a local full Cronet rebuild has not been performed. Original native licenses and README.chromium attribution files are retained in native-notices/.

The candidate SBOM distinguishes declared Dart lockfile packages from the compiled Go graph; it does not claim every platform plugin is loaded. Microsoft app-local CRT DLLs are redistributables, with actual signed-file versions/hashes captured by native build. Microsoft operating-system APIs, SDK and compiler executables are not copied into the VPN payload. Their separate license terms continue to apply.

Final beta.1 helper change: safe WFP syscall pointer lifetimes; installer rejects redirected destinations. The fixed helper was built with Go1.27.1 using GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go build -trimpath -o pvld.exe ./cmd/pvld from helper/. Exact final source ZIP is listed in SHA256SUMS. Flutter/C++ and upstream core binaries are the original native-tested payload. The installer was rebuilt with pinned Inno7.1.0 and tested on Windows, including clean reinstall. The outer self-signed test signature is not a trusted Windows publisher signature.

Checksum signature verification with OpenSSL3:
  openssl pkeyutl -verify -pubin -inkey release-public.pem -rawin -in SHA256SUMS -sigfile SHA256SUMS.sig
The Ed25519 key matches the existing Linux0.1.8 release key. First-download trust in the public key relies on HTTPS; private keys are never distributed.