From c769b60aaa1e7f7d1bd79772cb278f843ad3a8bc Mon Sep 17 00:00:00 2001
From: hectorzhao <hectorzhao@example.com>
Date: Wed, 26 Aug 2026 14:33:44 +0800
Subject: [PATCH] fix: allow verified offline monitoring releases

---
 tools/monitoring/README.md                        |  2 ++
 tools/monitoring/install-prometheus-monitoring.sh | 10 ++++++++--
 tools/monitoring/install-service-exporters.sh     | 10 ++++++++--
 3 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/tools/monitoring/README.md b/tools/monitoring/README.md
index 479c0af..4d2cad7 100644
--- a/tools/monitoring/README.md
+++ b/tools/monitoring/README.md
@@ -12,6 +12,8 @@ bash tools/monitoring/install-service-exporters.sh
 
 Debian/Ubuntu 使用系统包；Alibaba Cloud Linux 4 ARM64 使用脚本中锁定版本和 SHA-256 的官方 release 二进制。第一个脚本安装 Prometheus 与 Node Exporter，备份已有配置并校验规则；第二个脚本安装 PostgreSQL、Redis 和 Nginx Exporter，开启 MinIO 回环原生指标。API 指标仅监听 `127.0.0.1:9464`，Gateway 指标复用回环控制端口 `8090`。9090、9100、9187、9121、9113 和 9464 均不得对公网开放。两个脚本均会打印恢复资产路径。
 
+目标服务器无法稳定访问 GitHub 时，可先把脚本中锁定版本的 tar.gz 上传到只允许 root 写入的目录，再为两个脚本设置 `MONITORING_RELEASE_CACHE_DIR=/path/to/cache`。脚本仍会使用内置 SHA-256 二次校验缓存文件，不会信任未校验的上传内容。
+
 安装后将下列配置写入`/etc/cmpp-platform/cmpp-platform.env`，再按正常发布窗口重启API：
 
 ```dotenv
diff --git a/tools/monitoring/install-prometheus-monitoring.sh b/tools/monitoring/install-prometheus-monitoring.sh
index b471e59..14ce015 100644
--- a/tools/monitoring/install-prometheus-monitoring.sh
+++ b/tools/monitoring/install-prometheus-monitoring.sh
@@ -8,6 +8,7 @@ PROMETHEUS_VERSION="3.14.0"
 PROMETHEUS_SHA256_ARM64="077f3781ab7245dc04c9a3c9b78ba120fc8e41aa0dc97489b0af67247e50ba83"
 NODE_EXPORTER_VERSION="1.12.1"
 NODE_EXPORTER_SHA256_ARM64="ad35b605f9954b9f1ffddf5ba054bdc5a98d790b9eae5291e1eeb83f1ecbd0e7"
+MONITORING_RELEASE_CACHE_DIR="${MONITORING_RELEASE_CACHE_DIR:-}"
 
 if [[ "$(id -u)" -ne 0 ]]; then
   echo "Run as root." >&2
@@ -17,10 +18,15 @@ log() { printf '\n[%s] %s\n' "$(date '+%F %T')" "$*"; }
 
 install_release_binary() {
   local url="$1" expected_sha256="$2" archive_member="$3" destination="$4"
-  local work_dir archive
+  local work_dir archive asset_name
   work_dir="$(mktemp -d /tmp/cmpp-monitoring.XXXXXX)"
   archive="$work_dir/release.tar.gz"
-  curl -fL --retry 5 --retry-delay 2 --connect-timeout 15 -o "$archive" "$url"
+  asset_name="${url##*/}"
+  if [[ -n "$MONITORING_RELEASE_CACHE_DIR" && -f "$MONITORING_RELEASE_CACHE_DIR/$asset_name" ]]; then
+    cp "$MONITORING_RELEASE_CACHE_DIR/$asset_name" "$archive"
+  else
+    curl -fL --retry 5 --retry-delay 2 --connect-timeout 15 -o "$archive" "$url"
+  fi
   printf '%s  %s\n' "$expected_sha256" "$archive" | sha256sum -c -
   tar -xzf "$archive" -C "$work_dir"
   install -o root -g root -m 0755 "$work_dir/$archive_member" "$destination"
diff --git a/tools/monitoring/install-service-exporters.sh b/tools/monitoring/install-service-exporters.sh
index 3ff4195..d24541d 100644
--- a/tools/monitoring/install-service-exporters.sh
+++ b/tools/monitoring/install-service-exporters.sh
@@ -7,6 +7,7 @@ REDIS_EXPORTER_VERSION="1.89.0"
 REDIS_EXPORTER_SHA256_ARM64="1a70d42cd1d96a9388f8b528f55ad5bdc2c3cbd911c1dff3875fcb9ac01fa28a"
 NGINX_EXPORTER_VERSION="1.5.3"
 NGINX_EXPORTER_SHA256_ARM64="a0b1a5f5bba09483bd2e04c759c1a75fffe46ca72c0314ee2bb925d1742ff23b"
+MONITORING_RELEASE_CACHE_DIR="${MONITORING_RELEASE_CACHE_DIR:-}"
 
 if [[ "$(id -u)" -ne 0 ]]; then echo "Run as root." >&2; exit 1; fi
 for command_name in systemctl nginx curl install ss; do command -v "$command_name" >/dev/null || { echo "Missing command: $command_name" >&2; exit 1; }; done
@@ -15,10 +16,15 @@ log() { printf '\n[%s] %s\n' "$(date '+%F %T')" "$*"; }
 
 install_release_binary() {
   local url="$1" expected_sha256="$2" archive_member="$3" destination="$4"
-  local work_dir archive
+  local work_dir archive asset_name
   work_dir="$(mktemp -d /tmp/cmpp-monitoring.XXXXXX)"
   archive="$work_dir/release.tar.gz"
-  curl -fL --retry 5 --retry-delay 2 --connect-timeout 15 -o "$archive" "$url"
+  asset_name="${url##*/}"
+  if [[ -n "$MONITORING_RELEASE_CACHE_DIR" && -f "$MONITORING_RELEASE_CACHE_DIR/$asset_name" ]]; then
+    cp "$MONITORING_RELEASE_CACHE_DIR/$asset_name" "$archive"
+  else
+    curl -fL --retry 5 --retry-delay 2 --connect-timeout 15 -o "$archive" "$url"
+  fi
   printf '%s  %s\n' "$expected_sha256" "$archive" | sha256sum -c -
   tar -xzf "$archive" -C "$work_dir"
   install -o root -g root -m 0755 "$work_dir/$archive_member" "$destination"