From 686dcb84457b20bf79f366b4467de5c95acbdfcf Mon Sep 17 00:00:00 2001
From: xingkongwangbin <13731754667@163.com>
Date: Sun, 12 Jul 2026 15:30:58 +0800
Subject: [PATCH 1/2] fix: correct proxy routing, caching, and URL rewriting

---
 internal/cli/daemon.go      |  2 +-
 internal/mirrors/mirrors.go | 18 ++++++++----------
 internal/proxy/handler.go   |  1 +
 internal/proxy/rewriter.go  |  9 ++++++++-
 4 files changed, 18 insertions(+), 12 deletions(-)

diff --git a/internal/cli/daemon.go b/internal/cli/daemon.go
index 5ad5757..7e1da2c 100644
--- a/internal/cli/daemon.go
+++ b/internal/cli/daemon.go
@@ -457,7 +457,7 @@ func (s *Server) createFiberApp() *fiber.App {
 	// Static assets (must be registered before the catch-all proxy below).
 	app.Get("/static/apt-proxy-logo.png", adaptor.HTTPHandler(http.HandlerFunc(proxy.ServeStaticLogo)))
 	// All other paths -> proxy + cache
-	app.All("/*", adaptor.HTTPHandler(s.proxy.Handler))
+	app.All("/*", adaptor.HTTPHandler(s.proxy))
 
 	return app
 }
diff --git a/internal/mirrors/mirrors.go b/internal/mirrors/mirrors.go
index 1f62bb5..2adf4ff 100644
--- a/internal/mirrors/mirrors.go
+++ b/internal/mirrors/mirrors.go
@@ -73,20 +73,18 @@ var builtinByMode = map[int]builtinDistro{
 // for the given proxy mode. When reg is non-nil, registry-loaded
 // mirrors are preferred over the compile-time built-ins.
 func GetGeoMirrorUrlsByMode(reg *distro.Registry, mode int) (mirrors []string) {
-	// Ubuntu/UbuntuPorts: prefer geo-derived mirrors (real point of the
+	// Ubuntu: prefer geo-derived mirrors (real point of the
 	// `mirrors.txt` lookup). Fall back to registry/built-in on failure so
 	// the proxy still has *some* upstream list when the geo API is down.
-	if mode == distro.TypeUbuntu || mode == distro.TypeUbuntuPorts {
+	//
+	// Ubuntu Ports: use built-in list directly. The geo API returns Ubuntu
+	// (amd64) mirrors only; blindly replacing /ubuntu/ with /ubuntu-ports/
+	// produces URLs that do not serve ports content (e.g. archive.ubuntu.com
+	// only serves amd64).
+	if mode == distro.TypeUbuntu {
 		online, err := GetUbuntuMirrorUrlsByGeo()
 		if err == nil && len(online) > 0 {
-			if mode == distro.TypeUbuntu {
-				return online
-			}
-			results := make([]string, 0, len(online))
-			for _, m := range online {
-				results = append(results, strings.ReplaceAll(m, "/ubuntu/", "/ubuntu-ports/"))
-			}
-			return results
+			return online
 		}
 		// Geo failed: fall through to registry/built-in.
 	}
diff --git a/internal/proxy/handler.go b/internal/proxy/handler.go
index 29f3e5d..e20e33f 100644
--- a/internal/proxy/handler.go
+++ b/internal/proxy/handler.go
@@ -342,6 +342,7 @@ func (ap *PackageStruct) processMatchingRule(r *http.Request, rules []distro.Rul
 	}
 
 	r.Header.Del("Cache-Control")
+	r.Header.Del("Range")
 	if rule.Rewrite {
 		ap.rewriteRequest(r, rule)
 	}
diff --git a/internal/proxy/rewriter.go b/internal/proxy/rewriter.go
index a7a1b71..0fd92c3 100644
--- a/internal/proxy/rewriter.go
+++ b/internal/proxy/rewriter.go
@@ -20,6 +20,7 @@ import (
 	"net/http"
 	"net/url"
 	"regexp"
+	"strings"
 	"sync"
 
 	logger "github.com/soulteary/logger-kit"
@@ -355,7 +356,13 @@ func RewriteRequestByMode(r *http.Request, rewriters *URLRewriters, mode int) {
 
 	r.URL.Scheme = rewriter.mirror.Scheme
 	r.URL.Host = rewriter.mirror.Host
-	r.URL.Path = rewriter.mirror.Path + unescapedQuery
+
+	mirrorPath := rewriter.mirror.Path
+	// For Debian security archive: adjust /debian/ → /debian-security/
+	if len(matches) >= 2 && matches[1] == "-security" {
+		mirrorPath = strings.TrimRight(mirrorPath, "/") + "-security/"
+	}
+	r.URL.Path = mirrorPath + unescapedQuery
 }
 
 // MatchingRule finds a matching rule for the given path

From 280afcddf7f1997440d873af80d92f9fcd71a194 Mon Sep 17 00:00:00 2001
From: xingkongwangbin <13731754667@163.com>
Date: Sun, 12 Jul 2026 17:39:22 +0800
Subject: [PATCH 2/2] fix: disable HTTP/2 on upstream transport to prevent
 HPACK panic

---
 internal/proxy/handler.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/internal/proxy/handler.go b/internal/proxy/handler.go
index e20e33f..0a4982f 100644
--- a/internal/proxy/handler.go
+++ b/internal/proxy/handler.go
@@ -15,6 +15,7 @@
 package proxy
 
 import (
+	"crypto/tls"
 	"errors"
 	"io"
 	"net/http"
@@ -104,6 +105,10 @@ func NewUpstreamTransport(enableKeepAlive bool) *http.Transport {
 		MaxIdleConns:          DefaultMaxIdleConns,
 		IdleConnTimeout:       DefaultIdleConnTimeout,
 		DisableCompression:    false,
+		// Disable HTTP/2: upstream mirrors use plain HTTP/1.1.
+		// HTTP/2 HPACK encoder has a known race that panics under
+		// concurrent use (golang/go#70380).
+		TLSNextProto: make(map[string]func(string, *tls.Conn) http.RoundTripper),
 	}
 }