Add iOS jailbreak release

Makefile

@@ -115,18 +115,17 @@ upload_ios_app_store:
 	cd ../sing-box-for-apple && \
 	xcodebuild -exportArchive -archivePath build/SFI.xcarchive -exportOptionsPlist SFI/Upload.plist -allowProvisioningUpdates
 
-export_ios_ipa:
-	cd ../sing-box-for-apple && \
-	xcodebuild -exportArchive -archivePath build/SFI.xcarchive -exportOptionsPlist SFI/Export.plist -allowProvisioningUpdates -exportPath build/SFI && \
-	cp build/SFI/sing-box.ipa dist/SFI.ipa
+build_ios_deb:
+	$(MAKE) -C ../sing-box-for-apple build_ios_deb
 
-upload_ios_ipa:
+upload_ios_deb:
 	cd dist && \
-	cp SFI.ipa "SFI-${VERSION}.ipa" && \
-	ghr --replace --draft --prerelease "v${VERSION}" "SFI-${VERSION}.ipa"
+	ghr --replace --draft --prerelease "v${VERSION}" ../sing-box-for-apple/build/jailbreak/"SFI-${VERSION}-iphoneos-arm64.deb"
 
 release_ios: build_ios upload_ios_app_store
 
+release_ios_deb: build_ios_deb upload_ios_deb
+
 build_macos:
 	cd ../sing-box-for-apple && \
 	rm -rf build/SFM.xcarchive && \

docs/clients/apple/features.md

@@ -40,13 +40,13 @@ SFI/SFM/SFT provides an unprivileged TUN implementation through NetworkExtension
 
 | Route/DNS rule option | Available        | Note                  |
 |-----------------------|------------------|-----------------------|
-| `process_name`        | :material-close: | No permission         |
-| `process_path`        | :material-close: | No permission         |
-| `process_path_regex`  | :material-close: | No permission         |
+| `process_name`        | :material-alert: | Only supported in the macOS standalone and iOS jailbreak versions |
+| `process_path`        | :material-alert: | Only supported in the macOS standalone and iOS jailbreak versions |
+| `process_path_regex`  | :material-alert: | Only supported in the macOS standalone and iOS jailbreak versions |
 | `package_name`        | :material-close: | /                     |
 | `package_name_regex`  | :material-close: | /                     |
-| `user`                | :material-close: | No permission         |
-| `user_id`             | :material-close: | No permission         |
+| `user`                | :material-alert: | Only supported in the macOS standalone and iOS jailbreak versions |
+| `user_id`             | :material-alert: | Only supported in the macOS standalone and iOS jailbreak versions |
 | `wifi_ssid`           | :material-alert: | Only supported on iOS |
 | `wifi_bssid`          | :material-alert: | Only supported on iOS |
 

docs/clients/apple/index.md

@@ -9,7 +9,7 @@ platform-specific function implementation, such as TUN transparent proxy impleme
 
 !!! failure ""
 
-    Due to non-technical reasons, we are temporarily unable to update the sing-box app on the App Store and release the standalone version of the macOS client (TestFlight users are not affected)
+    We are temporarily unable to update sing-box apps on the App Store because the reviewer mistakenly found that we violated the rules (TestFlight users are not affected).
 
 ## :material-graph: Requirements
 
@@ -26,15 +26,26 @@ TestFlight quota is only available to [sponsors](https://github.com/sponsors/nek
 Once you donate, you can get an invitation by join our Telegram group for sponsors from [@yet_another_sponsor_bot](https://t.me/yet_another_sponsor_bot)
 or sending us your Apple ID [via email](mailto:contact@sagernet.org).
 
-## ~~:material-file-download: Download (macOS standalone version)~~
+## :material-cellphone-arrow-down: Download (iOS jailbreak version)
 
-* ~~[Homebrew Cask](https://formulae.brew.sh/cask/sfm)~~
+* [GitHub Releases](https://github.com/SagerNet/sing-box/releases) (`SFI-iphoneos-arm64.deb`)
+
+The jailbroken version of SFI: requires rootless iOS 15.0+
+
+Additional features:
+
+* It can run a [Tailscale SSH server](/configuration/endpoint/tailscale/#ssh_server) on the device.
+* [Process matching](/configuration/route/rule/#process_name) (`process_name`, `process_path`, `user`, and so on) works in route and DNS rules.
+
+## :material-file-download: Download (macOS standalone version)
+
+* [Homebrew Cask](https://formulae.brew.sh/cask/sfm)
 
 ```bash
 # brew install sfm
 ```
 
-* ~~[GitHub Releases](https://github.com/SagerNet/sing-box/releases)~~
+* [GitHub Releases](https://github.com/SagerNet/sing-box/releases)
 
 ## :material-source-repository: Source code
 

docs/configuration/endpoint/tailscale.md

@@ -169,7 +169,8 @@ Access is controlled by the SSH ACL in the Tailscale admin console, which maps e
 - **Windows**: sessions run as the sing-box process identity; the mapped user is not impersonated, so a session mapped to a different local account is refused.
 - **Android**: the user is resolved by the app rather than the system user database. `root` is the superuser (UID 0) and `shell` is the ADB shell user (UID 2000); every other name is resolved as the package name of an installed application, running as that application's UID with its data directory as the home directory, so the target application must be installed. `termux` is a shortcut for `com.termux`, and `sing-box` for the app's own package name; when Termux is installed, the `root` and `termux` users load the Termux environment. Running as the sing-box application itself requires no root, while any other user requires granted root access; without root, sessions are limited to the sing-box user.
 - **macOS**: the SSH server is only available in the standalone version and requires the Root Helper; the App Store version is not supported.
-- **iOS** and **tvOS**: not yet supported.
+- **iOS**: the SSH server is only available in the jailbreak build; the App Store and TestFlight versions are not supported.
+- **tvOS**: not yet supported.
 
 Object format:
 

docs/configuration/endpoint/tailscale.zh.md

@@ -168,7 +168,8 @@ UDP NAT 过期时间。
 - **Windows**：会话以 sing-box 进程的身份运行；映射的用户不会被模拟，因此映射到其他本地账户的会话将被拒绝。
 - **Android**：用户由应用解析，而非系统用户数据库。`root` 即超级用户（UID 0），`shell` 为 ADB shell 用户（UID 2000）；其他名称均作为已安装应用的包名解析，以该应用的 UID 运行，并使用其数据目录作为主目录，因此目标应用必须已安装。`termux` 是 `com.termux` 的快捷方式，`sing-box` 是应用自身包名的快捷方式；当 Termux 已安装时，`root` 和 `termux` 用户将加载 Termux 环境。以 sing-box 应用自身身份运行无需 root，其他用户则需要已授予的 root 权限；非 root 时，会话仅限于 sing-box 用户。
 - **macOS**：SSH 服务器仅在独立版本中可用，且需要 Root Helper；App Store 版本不支持。
-- **iOS** 和 **tvOS**：暂不支持。
+- **iOS**：SSH 服务器仅在越狱版本中可用；App Store 和 TestFlight 版本不支持。
+- **tvOS**：暂不支持。
 
 对象格式：