20260721 metrics 服务新增 CCR rpki-client 格式检查指标与 Grafana 面板（#125）

docker/ours-rp-metrics.Dockerfile

@@ -85,27 +85,66 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
     mkdir -p /build-out/bin; \
     cp "target/$target_triple/release/rpki_artifact_metrics" /build-out/bin/
 
+FROM --platform=$TARGETPLATFORM ${RUNTIME_IMAGE} AS rpki-client-builder
+
+ARG RPKI_CLIENT_VERSION=9.8
+ARG RPKI_CLIENT_SHA256=42920aac5afd0996173fb9f7848691a2c49dd234e4f10478808c1aa475620861
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+      build-essential \
+      ca-certificates \
+      curl \
+      libexpat1-dev \
+      libssl-dev \
+      libtls-dev \
+      pkg-config \
+      rsync \
+      zlib1g-dev \
+    && rm -rf /var/lib/apt/lists/* \
+    && useradd --system --no-create-home --shell /usr/sbin/nologin _rpki-client
+
+RUN set -eux; \
+    curl -fsSL "https://ftp.openbsd.org/pub/OpenBSD/rpki-client/rpki-client-${RPKI_CLIENT_VERSION}.tar.gz" -o /tmp/rpki-client.tar.gz; \
+    echo "${RPKI_CLIENT_SHA256}  /tmp/rpki-client.tar.gz" | sha256sum -c -; \
+    tar -xzf /tmp/rpki-client.tar.gz -C /tmp; \
+    cd "/tmp/rpki-client-${RPKI_CLIENT_VERSION}"; \
+    ./configure --prefix=/opt/rpki-client; \
+    make -j"$(nproc)"; \
+    make install; \
+    /opt/rpki-client/sbin/rpki-client -V
+
 FROM --platform=$TARGETPLATFORM ${RUNTIME_IMAGE} AS runtime
 
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
       ca-certificates \
+      libexpat1 \
+      libssl3 \
+      libtls26 \
       tzdata \
-    && rm -rf /var/lib/apt/lists/*
+      zlib1g \
+    && rm -rf /var/lib/apt/lists/* \
+    && useradd --system --no-create-home --shell /usr/sbin/nologin _rpki-client \
+    && mkdir -p /opt/rpki-client/var/cache/rpki-client
 
 WORKDIR /opt/ours-rp
 
 COPY --from=builder /build-out/bin/ /opt/ours-rp/bin/
+COPY --from=rpki-client-builder /opt/rpki-client/ /opt/rpki-client/
+COPY --from=rpki-client-builder /opt/rpki-client/sbin/rpki-client /opt/ours-rp/bin/rpki-client
 
 ARG SOURCE_COMMIT=unknown
 ARG SOURCE_DIRTY=unknown
 ARG BUILD_TIMESTAMP_UTC=unknown
+ARG RPKI_CLIENT_VERSION=9.8
 
 LABEL org.opencontainers.image.title="ours-rp-metrics" \
       org.opencontainers.image.description="Ours RP artifact metrics image for multi-arch Docker Compose deployment" \
       org.opencontainers.image.revision="${SOURCE_COMMIT}" \
       org.opencontainers.image.created="${BUILD_TIMESTAMP_UTC}" \
-      org.opencontainers.image.source-dirty="${SOURCE_DIRTY}"
+      org.opencontainers.image.source-dirty="${SOURCE_DIRTY}" \
+      org.opencontainers.image.rpki-client.version="${RPKI_CLIENT_VERSION}"
 
 RUN chmod +x /opt/ours-rp/bin/* \
     && mkdir -p /var/lib/ours-rp/state /var/lib/ours-rp/runs /var/lib/ours-rp/logs