From e5eb05f86f49b86d106bd604a5da47baac98d3eb Mon Sep 17 00:00:00 2001 From: Andy Aylward Date: Wed, 2 Sep 2026 12:20:05 -0400 Subject: [PATCH] stats: a release asset as the fallback URL for the DB-IP pin Bazel tries the pin's URLs in order and the sha256 keeps both honest; the month's file is mirrored as a release asset named for the month, and the pin-bump steps live on the pin. --- bazel/tools.MODULE.bazel | 13 ++++++++++--- domains/platform/apis/stats/README.md | 7 ++++--- 2 files changed, 14 insertions(+), 6 deletions(-) diff --git a/bazel/tools.MODULE.bazel b/bazel/tools.MODULE.bazel index c4b19e2c..14e65202 100644 --- a/bazel/tools.MODULE.bazel +++ b/bazel/tools.MODULE.bazel @@ -38,11 +38,18 @@ http_file( # DB-IP's free IP-to-country table (CC BY 4.0; muchq.com/stats carries the # attribution), bundled into the stats image (#1467). DB-IP publishes a new -# file each month under a dated URL and keeps the old ones up, so a refresh -# is a pin bump here and nothing on the host. +# file each month under a dated URL, so a refresh is a pin bump here and +# nothing on the host: download the month's file, upload it as a release +# asset named for the month (`gh release create dbip-country-lite-YYYY-MM +# --target main`), and replace the month, the sha256, and both URLs. +# The release is the fallback (#1478): Bazel tries the URLs in order, and +# the pin keeps both honest. http_file( name = "dbip_country_lite", downloaded_file_path = "dbip-country-lite.csv.gz", sha256 = "a32bb3c384bd3de60ad9024596aa5b395a6dd5beaa27a7223407cc2edc681d0b", - urls = ["https://download.db-ip.com/free/dbip-country-lite-2026-09.csv.gz"], + urls = [ + "https://download.db-ip.com/free/dbip-country-lite-2026-09.csv.gz", + "https://github.com/muchq/MoonBase/releases/download/dbip-country-lite-2026-09/dbip-country-lite-2026-09.csv.gz", + ], ) diff --git a/domains/platform/apis/stats/README.md b/domains/platform/apis/stats/README.md index 0a01a262..15a0f7fb 100644 --- a/domains/platform/apis/stats/README.md +++ b/domains/platform/apis/stats/README.md @@ -62,9 +62,10 @@ and the two-letter code, with request, 403, and probe counts — where the scrapers, bots, and scanners come from. The database is DB-IP's free country CSV (CC BY 4.0; muchq.com's stats page carries the attribution), pinned by URL and sha256 as `@dbip_country_lite` in -`bazel/tools.MODULE.bazel` and bundled into the image at -`/geo/dbip-country-lite.csv.gz`; a new month is a pin bump, nothing on -the host. The service loads it at boot into a sorted range table and +`bazel/tools.MODULE.bazel` — DB-IP's own URL first, a release asset on +this repository as the fallback — and bundled into the image at +`/geo/dbip-country-lite.csv.gz`; a new month is a pin bump (the steps are +on the pin), nothing on the host. The service loads it at boot into a sorted range table and binary-searches it, no library. Overlapping rows lose to the range they sit in, and the `ZZ` rows DB-IP uses for reserved and private space are not placements. An address outside every range files under `--`, and so