From e683dd92e740f9a398d415091b20d5aab10c3c31 Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Mon, 17 Aug 2026 11:27:25 +0200
Subject: [PATCH] patchmon: fetch only SCAP datastream XMLs (#16565)

* patchmon: fetch only SCAP datastream XMLs, not the full 2.1GB content archive

* Increase default disk size from 4GB to 8GB
---
 ct/patchmon.sh              | 10 +++++++++-
 install/patchmon-install.sh |  8 +++++++-
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/ct/patchmon.sh b/ct/patchmon.sh
index cebc1b017..f0401d83a 100644
--- a/ct/patchmon.sh
+++ b/ct/patchmon.sh
@@ -76,7 +76,15 @@ EOF
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "PatchMon" "PatchMon/PatchMon" "singlefile" "latest" "/opt/patchmon" "patchmon-server-linux-$(arch_resolve)"
     mv /opt/patchmon/PatchMon /opt/patchmon/patchmon-server
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "ssg-content" "ComplianceAsCode/content" "prebuild" "latest" "/opt/patchmon/ssg-content" "scap-security-guide-*.tar.gz"
+
+    msg_info "Updating SCAP Content"
+    RELEASE=$(get_latest_github_release "ComplianceAsCode/content")
+    curl_with_retry "https://github.com/ComplianceAsCode/content/releases/download/v${RELEASE}/scap-security-guide-${RELEASE}.tar.gz" "/tmp/ssg.tar.gz"
+    mkdir -p /opt/patchmon/ssg-content
+    find /opt/patchmon/ssg-content -mindepth 1 -delete
+    tar -xzf /tmp/ssg.tar.gz -C /opt/patchmon/ssg-content --strip-components=1 --wildcards '*/ssg-*-ds.xml'
+    rm -f /tmp/ssg.tar.gz
+    msg_ok "Updated SCAP Content"
 
     restore_backup
 
diff --git a/install/patchmon-install.sh b/install/patchmon-install.sh
index 68bf8a82d..b3627274d 100644
--- a/install/patchmon-install.sh
+++ b/install/patchmon-install.sh
@@ -86,7 +86,13 @@ for arch in "${AGENT_NAME[@]}"; do
 done
 msg_ok "Fetched PatchMon agent binaries"
 
-fetch_and_deploy_gh_release "ssg-content" "ComplianceAsCode/content" "prebuild" "latest" "/opt/patchmon/ssg-content" "scap-security-guide-*.tar.gz"
+msg_info "Fetching SCAP Content"
+RELEASE=$(get_latest_github_release "ComplianceAsCode/content")
+curl_with_retry "https://github.com/ComplianceAsCode/content/releases/download/v${RELEASE}/scap-security-guide-${RELEASE}.tar.gz" "/tmp/ssg.tar.gz"
+mkdir -p /opt/patchmon/ssg-content
+tar -xzf /tmp/ssg.tar.gz -C /opt/patchmon/ssg-content --strip-components=1 --wildcards '*/ssg-*-ds.xml'
+rm -f /tmp/ssg.tar.gz
+msg_ok "Fetched SCAP Content"
 
 msg_info "Creating service"
 cat <<EOF >/etc/systemd/system/patchmon-server.service