From fb1d72e69dcc0f8a0f7ec1fc122db1f842efe5fe Mon Sep 17 00:00:00 2001
From: Rogee <rogee@ipao.vip>
Date: Mon, 24 Aug 2026 23:19:41 +0800
Subject: [PATCH] HH-635: avoid runtime GeoIP download

Co-authored-by: multica-agent <github@multica.ai>
---
 config/config.yaml                         |  3 ++-
 internal/bootstrap/bootstrap.go            |  2 +-
 internal/bootstrap/config_contract_test.go |  4 +++-
 tests/container-smoke.sh                   | 12 +++++++-----
 4 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/config/config.yaml b/config/config.yaml
index 5ee4390..29a23a9 100644
--- a/config/config.yaml
+++ b/config/config.yaml
@@ -173,6 +173,7 @@ rule-providers:
   ProxyGFWlist: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/ProxyGFWlist.yaml}
   ChinaDomain: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/ChinaDomain.yaml}
   ChinaCompanyIp: {type: file, behavior: ipcidr, format: yaml, path: /usr/local/share/ssclash/rules/ChinaCompanyIp.yaml}
+  ChinaIp: {type: file, behavior: ipcidr, format: yaml, path: /usr/local/share/ssclash/rules/ChinaIp.yaml}
   Download: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/Download.yaml}
 
 rules:
@@ -207,5 +208,5 @@ rules:
   - RULE-SET,ChinaDomain,🎯 全球直连
   - RULE-SET,ChinaCompanyIp,🎯 全球直连
   - RULE-SET,Download,🎯 全球直连
-  - GEOIP,CN,🎯 全球直连
+  - RULE-SET,ChinaIp,🎯 全球直连
   - MATCH,🐟 漏网之鱼
diff --git a/internal/bootstrap/bootstrap.go b/internal/bootstrap/bootstrap.go
index 7de6441..0c36648 100644
--- a/internal/bootstrap/bootstrap.go
+++ b/internal/bootstrap/bootstrap.go
@@ -296,7 +296,7 @@ func Run(ctx context.Context, config RuntimeConfig) error {
 		return reloadSubscription(ctx, client)
 	}
 	if err := updateSubscription(ctx, client, config.SubscriptionURL, activeSubscription, validate); err != nil {
-		return fmt.Errorf("initial subscription update failed")
+		return fmt.Errorf("initial subscription update failed: %w", err)
 	}
 	if err := validateMihomoConfig(ctx, config.CoreBinary, runtimeDir, runtimeConfig); err != nil {
 		return errors.New("generated Mihomo configuration failed validation")
diff --git a/internal/bootstrap/config_contract_test.go b/internal/bootstrap/config_contract_test.go
index 2cce39b..93480a9 100644
--- a/internal/bootstrap/config_contract_test.go
+++ b/internal/bootstrap/config_contract_test.go
@@ -58,12 +58,14 @@ func TestSeededConfigUsesLocalACL4SSRRulesAndMemorySubscription(t *testing.T) {
 		"Microsoft: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/Ruleset/Microsoft.yaml}",
 		"Telegram: {type: file, behavior: classical, format: yaml, path: /usr/local/share/ssclash/rules/Ruleset/Telegram.yaml}",
 		"ChinaCompanyIp: {type: file, behavior: ipcidr, format: yaml, path: /usr/local/share/ssclash/rules/ChinaCompanyIp.yaml}",
+		"ChinaIp: {type: file, behavior: ipcidr, format: yaml, path: /usr/local/share/ssclash/rules/ChinaIp.yaml}",
+		"RULE-SET,ChinaIp,🎯 全球直连",
 	} {
 		if !strings.Contains(config, required) {
 			t.Errorf("seeded config is missing %q", required)
 		}
 	}
-	if strings.Contains(config, "raw.githubusercontent.com") || strings.Contains(config, "type: http") {
+	if strings.Contains(config, "raw.githubusercontent.com") || strings.Contains(config, "type: http") || strings.Contains(config, "GEOIP,CN,") {
 		t.Error("seeded config depends on an online rule or subscription provider")
 	}
 }
diff --git a/tests/container-smoke.sh b/tests/container-smoke.sh
index 4629333..484b561 100755
--- a/tests/container-smoke.sh
+++ b/tests/container-smoke.sh
@@ -93,11 +93,13 @@ if [ "$public_bindings" -ne 2 ] || [ "$loopback_bindings" -ne 1 ]; then
 fi
 
 docker build --tag "$image" .
-docker run --rm --entrypoint /usr/local/lib/ssclash/clash "$image" \
-	-t -d /usr/local/share/ssclash -f /usr/local/share/ssclash/config.yaml >/dev/null 2>&1 && {
-	echo "config validation unexpectedly passed without a subscription provider" >&2
-	exit 1
-}
+docker run --rm --network none --entrypoint /bin/sh "$image" -c '
+	set -eu
+	runtime=$(mktemp -d)
+	cp /usr/local/share/ssclash/config.yaml "$runtime/config.yaml"
+	printf "proxies:\n  - name: smoke-node\n    type: socks5\n    server: 127.0.0.1\n    port: 9\n" > "$runtime/subscription.yaml"
+	/usr/local/lib/ssclash/clash -t -d "$runtime" -f "$runtime/config.yaml"
+' >/dev/null
 
 provider_dir=$(mktemp -d)
 printf '%s\n' \
-- 
2.54.0