Repository navigation
fix(build): install full geo files from a pinned source - #111
Merged
Merged
Conversation
Since Xray v26.10.21 every release zip ships the Xray-rules-dat geoip-lite file as geoip.dat (18 codes, no country codes besides cn, ru and ir) and a v2fly geosite.dat without gfw and similar lists. install_xray installed those files into /usr/local/share/xray, so a node image built from dev would refuse to start Xray for any config that routes on geoip:us, geoip:de and so on. install_xray now runs a new install_geofiles target that downloads Loyalsoldier/v2ray-rules-dat geoip.dat and geosite.dat (what the zips shipped through v26.9.30) from a pinned release tag, fails unless each file matches its pinned sha256, and overwrites the zip's files. It then runs check_geofiles, which fails the build unless the installed xray prints "Configuration OK" for testdata/geofiles-check.json (rules on geoip:us, geoip:ir, geosite:category-ads-all, geosite:gfw and more). The check is skipped for cross builds, where the target binary cannot run; the files are the same for every arch, so the native build covers them. update_geofiles_pin prints new pin lines for the newest release after checking it against the release's own .sha256sum files.
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Free-Guy-IR
added a commit
to Free-Guy-IR/node
that referenced
this pull request
Nov 3, 2026
d309483 (PasarGuard#115) is now ported by c2e15f2 and its waiver goes. 47857d4 (the v0.5.5 version bump) is not applicable: the fork keeps its own NodeVersion line. bb40094 (PasarGuard#111) is superseded while the fork pins Xray v26.3.27 and checks the geo files by sha256. d359a8f (PasarGuard#117) is not applicable without StartOrAttach. bd745b5 (PasarGuard#118) is not applicable until PasarGuard#64 brings Xray WireGuard accounts and goes with it. 1549c96 (PasarGuard#116) and 8ad52fe (PasarGuard#112) stay pending to 2026-11-08 under NODE-LEAD, each with its exact remaining work.
Free-Guy-IR
added a commit
to Free-Guy-IR/node
that referenced
this pull request
Nov 4, 2026
…0.31 zip's lite ones
The geo-assets stage took geoip.dat and geosite.dat from the Xray
v26.10.31 release zip, which ships the geoip-lite file and a short
geosite. xray then refuses any routing rule on geoip:us, geoip:de,
geosite:gfw and similar codes ("failed to check code US from
geoip.dat").
The stage now downloads Loyalsoldier/v2ray-rules-dat 202610202206 and
checks geoip.dat and geosite.dat against pinned sha256 values. The
Makefile gains install_geofiles, check_geofiles and update_geofiles_pin
from upstream PasarGuard#111; the three pins are read from the Dockerfile ARG
lines, so the image and make install_xray cannot drift apart.
check_geofiles fails unless xray prints "Configuration OK" for
testdata/geofiles-check.json.
RED: the xray-core 556767e4 binary with the v26.10.31 zip files fails
testdata/geofiles-check.json (rc 23). GREEN: the same binary with the
pinned Loyalsoldier files prints "Configuration OK".
The bb40094 pending waiver row is removed; this trailer ports it.
Upstream: bb40094
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Since v26.10.21, Xray release zips ship XTLS/Xray-rules-dat
geoip-liteasgeoip.dat(18 codes: no countries except cn, ru and ir), and theirgeosite.datlacksgfw,google-cn,apple-cn,china-listandwin-*. Xray refuses a config that uses a removed code (common/geodata: illegal ip rule: geoip:us).make install_xray(and so every image built fromdev) installs the zip's files into/usr/local/share/xray, so the next dev image or a release built from dev would stop the core on any node whose routing uses a country code. Images so far are not affected:latestand the currentdevimage carry the full files.install_geofiles(run byinstall_xray, and on its own) downloads Loyalsoldier/v2ray-rules-datgeoip.datandgeosite.dat, which the Xray zips shipped through v26.9.30, from a pinned release tag, and fails unless each file matches its pinned sha256. Downloads are retried; any failure stops the build before anything is installed.check_geofilesfails the build unless the installedxray run -testloadstestdata/geofiles-check.json(rules ongeoip:us,geoip:de,geoip:ir,geoip:private,geosite:category-ads-all,geosite:category-ir,geosite:gfwand more). The arm64 leg of the multi-arch build verifies the checksums but skips the run check, because its binary cannot run on the amd64 builder; the files are identical for every arch.GEOFILES_TAGuntil someone bumps it. To bump: runmake update_geofiles_pin(it checks the newest release against its own.sha256sumfiles and prints the three new lines), paste them into the Makefile, and the PR's CI runscheck_geofileson the new files. A scheduled bump workflow could follow. Operators who want current data already havepg-node geofiles, which installs its own files and pointsXRAY_ASSETS_PATHat them.XRAY_TAGstays unpinned.Verified: amd64 image build (Xray v26.10.21, both checksums OK,
Configuration OK; inside the image ageoip:usconfig passes); the arm64 builder stage; the zip's lite files, a wrong sha256, an empty pin and a missing tag all fail;go build,go vetandmake testpass.