HH-635: avoid runtime GeoIP download (#4)

config/config.yaml

@@ -173,6 +173,7 @@ rule-providers:
   ProxyGFWlist: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/ProxyGFWlist.yaml}
   ChinaDomain: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/ChinaDomain.yaml}
   ChinaCompanyIp: {type: file, behavior: ipcidr, format: yaml, path: /usr/local/share/ssclash/rules/ChinaCompanyIp.yaml}
+  ChinaIp: {type: file, behavior: ipcidr, format: yaml, path: /usr/local/share/ssclash/rules/ChinaIp.yaml}
   Download: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/Download.yaml}
 
 rules:
@@ -207,5 +208,5 @@ rules:
   - RULE-SET,ChinaDomain,🎯 全球直连
   - RULE-SET,ChinaCompanyIp,🎯 全球直连
   - RULE-SET,Download,🎯 全球直连
-  - GEOIP,CN,🎯 全球直连
+  - RULE-SET,ChinaIp,🎯 全球直连
   - MATCH,🐟 漏网之鱼

internal/bootstrap/bootstrap.go

@@ -296,7 +296,7 @@ func Run(ctx context.Context, config RuntimeConfig) error {
 		return reloadSubscription(ctx, client)
 	}
 	if err := updateSubscription(ctx, client, config.SubscriptionURL, activeSubscription, validate); err != nil {
-		return fmt.Errorf("initial subscription update failed")
+		return fmt.Errorf("initial subscription update failed: %w", err)
 	}
 	if err := validateMihomoConfig(ctx, config.CoreBinary, runtimeDir, runtimeConfig); err != nil {
 		return errors.New("generated Mihomo configuration failed validation")

internal/bootstrap/config_contract_test.go

@@ -58,12 +58,14 @@ func TestSeededConfigUsesLocalACL4SSRRulesAndMemorySubscription(t *testing.T) {
 		"Microsoft: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/Ruleset/Microsoft.yaml}",
 		"Telegram: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/Ruleset/Telegram.yaml}",
 		"ChinaCompanyIp: {type: file, behavior: ipcidr, format: yaml, path: /usr/local/share/ssclash/rules/ChinaCompanyIp.yaml}",
+		"ChinaIp: {type: file, behavior: ipcidr, format: yaml, path: /usr/local/share/ssclash/rules/ChinaIp.yaml}",
+		"RULE-SET,ChinaIp,🎯 全球直连",
 	} {
 		if !strings.Contains(config, required) {
 			t.Errorf("seeded config is missing %q", required)
 		}
 	}
-	if strings.Contains(config, "raw.githubusercontent.com") || strings.Contains(config, "type: http") {
+	if strings.Contains(config, "raw.githubusercontent.com") || strings.Contains(config, "type: http") || strings.Contains(config, "GEOIP,CN,") {
 		t.Error("seeded config depends on an online rule or subscription provider")
 	}
 }

tests/container-smoke.sh

@@ -93,11 +93,13 @@ if [ "$public_bindings" -ne 2 ] || [ "$loopback_bindings" -ne 1 ]; then
 fi
 
 docker build --tag "$image" .
-docker run --rm --entrypoint /usr/local/lib/ssclash/clash "$image" \
-	-t -d /usr/local/share/ssclash -f /usr/local/share/ssclash/config.yaml >/dev/null 2>&1 && {
-	echo "config validation unexpectedly passed without a subscription provider" >&2
-	exit 1
-}
+docker run --rm --network none --entrypoint /bin/sh "$image" -c '
+	set -eu
+	runtime=$(mktemp -d)
+	cp /usr/local/share/ssclash/config.yaml "$runtime/config.yaml"
+	printf "proxies:\n  - name: smoke-node\n    type: socks5\n    server: 127.0.0.1\n    port: 9\n" > "$runtime/subscription.yaml"
+	/usr/local/lib/ssclash/clash -t -d "$runtime" -f "$runtime/config.yaml"
+' >/dev/null
 
 provider_dir=$(mktemp -d)
 printf '%s\n' \