From e42fa7a2086789f00958e4ec52310ea48a247a36 Mon Sep 17 00:00:00 2001
From: wu21-web <wu2196674@icloud.com>
Date: Thu, 13 Aug 2026 22:10:54 +0900
Subject: [PATCH 01/11] rewrite mirrored install shell script

---
 install.mirror.sh | 109 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 109 insertions(+)
 create mode 100755 install.mirror.sh

diff --git a/install.mirror.sh b/install.mirror.sh
new file mode 100755
index 00000000..5b940872
--- /dev/null
+++ b/install.mirror.sh
@@ -0,0 +1,109 @@
+#!/bin/sh
+
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 alibaba/open-code-review Contributors
+
+# Install the ocr (Open Code Review) CLI from GitHub releases.
+#   curl -fsSL https://raw.githubusercontent.com/alibaba/open-code-review/main/install.sh | sh
+# Prefer to inspect first:
+#   curl -fsSL https://raw.githubusercontent.com/alibaba/open-code-review/main/install.sh -o install.sh
+#   less install.sh && sh install.sh
+# Env: OCR_INSTALL_DIR (default /usr/local/bin), OCR_VERSION (default latest),
+# Use GITHUB_MIRROR_DOMAIN_PREFIX to set a mirror domain for Github releases.
+set -eu
+
+main() {
+  REPO="alibaba/open-code-review"
+  BIN="ocr"
+  ASSET_PREFIX="opencodereview"
+  INSTALL_DIR="${OCR_INSTALL_DIR:-/usr/local/bin}"
+  VERSION="${OCR_VERSION:-}"
+
+  command -v curl >/dev/null 2>&1 || err "curl is required"
+
+  os="$(uname -s | tr '[:upper:]' '[:lower:]')"
+  case "$os" in
+    darwin|linux) ;;
+    *) err "unsupported OS: $os (on Windows use: irm https://raw.githubusercontent.com/alibaba/open-code-review/main/install.ps1 | iex)" ;;
+  esac
+
+  arch="$(uname -m)"
+  case "$arch" in
+    x86_64|amd64) arch="amd64" ;;
+    arm64|aarch64) arch="arm64" ;;
+    *) err "unsupported architecture: $arch" ;;
+  esac
+
+  if [ -z "$VERSION" ]; then
+    release_json="$(curl -fsSL "https://api.github.com/repos/$REPO/releases/latest")" ||
+      err "failed to fetch latest release info from github api"
+    VERSION="$(printf '%s' "$release_json" |
+      sed -n 's/.*"tag_name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n1)"
+    [ -n "$VERSION" ] || err "could not resolve latest release tag"
+  fi
+
+  asset="${ASSET_PREFIX}-${os}-${arch}"
+  if [ -n "${GITHUB_MIRROR_DOMAIN_PREFIX:-}" ]; then
+    base="https://${GITHUB_MIRROR_DOMAIN_PREFIX}github.com/$REPO/releases/download/$VERSION"
+  else
+    base="https://github.com/$REPO/releases/download/$VERSION"
+  fi
+  tmp="$(mktemp -d)"
+  trap 'rm -rf "$tmp"' INT TERM EXIT
+
+  printf 'downloading %s %s (%s/%s)...\n' "$BIN" "$VERSION" "$os" "$arch"
+  curl -fsSL -o "$tmp/$asset" "$base/$asset" || err "download failed: $base/$asset"
+  curl -fsSL -o "$tmp/sha256sum.txt" "$base/sha256sum.txt" || err "sha256sum.txt download failed"
+
+  want="$(awk -v a="$asset" '$2 == a {print tolower($1)}' "$tmp/sha256sum.txt")"
+  [ -n "$want" ] || err "no checksum entry for $asset in sha256sum.txt"
+  got="$(sha256 "$tmp/$asset" | awk '{print tolower($1)}')"
+  [ "$got" = "$want" ] || err "checksum mismatch for $asset (got $got, want $want)"
+
+  install_binary "$tmp/$asset" "$INSTALL_DIR" "$BIN"
+
+  printf 'installed %s %s -> %s\n' "$BIN" "$VERSION" "$INSTALL_DIR/$BIN"
+  post_install_path_notice "$BIN" "$INSTALL_DIR"
+}
+
+# Install the staged binary (mode 0755), escalating with sudo only when needed.
+# Using install(1) under sudo gives the binary root ownership in system dirs.
+install_binary() {
+  src="$1"
+  dir="$2"
+  bin="$3"
+  if mkdir -p "$dir" 2>/dev/null && [ -w "$dir" ]; then
+    install -m 0755 "$src" "$dir/$bin"
+  elif command -v sudo >/dev/null 2>&1; then
+    printf 'note: %s is not writable; escalating with sudo\n' "$dir"
+    sudo mkdir -p "$dir"
+    sudo install -m 0755 "$src" "$dir/$bin"
+  else
+    err "$dir is not writable and sudo is unavailable; set OCR_INSTALL_DIR to a writable path"
+  fi
+}
+
+post_install_path_notice() {
+  bin="$1"
+  install_dir="$2"
+  case ":$PATH:" in
+    *":$install_dir:"*) ;;
+    *) printf 'note: %s is not on your PATH; add it or run %s/%s directly\n' "$install_dir" "$install_dir" "$bin"; return ;;
+  esac
+  command -v "$bin" >/dev/null 2>&1 || printf 'note: open a new shell so %s resolves on PATH\n' "$bin"
+}
+
+# Print the SHA-256 of a file, preferring shasum (macOS) over sha256sum (Linux).
+sha256() {
+  if command -v shasum >/dev/null 2>&1; then
+    shasum -a 256 "$1"
+  elif command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$1"
+  else
+    err "shasum or sha256sum is required for checksum verification"
+  fi
+}
+
+err() { printf 'error: %s\n' "$1" >&2; exit 1; }
+
+main "$@"

From c9f1755318472f430dd71d5bc54e10ef7c96ff61 Mon Sep 17 00:00:00 2001
From: wu21-web <wu2196674@icloud.com>
Date: Thu, 13 Aug 2026 22:12:43 +0900
Subject: [PATCH 02/11] rewrite mirrored install pwsh script and code cmt

---
 install.mirror.ps1 | 147 +++++++++++++++++++++++++++++++++++++++++++++
 install.mirror.sh  |   2 +-
 2 files changed, 148 insertions(+), 1 deletion(-)
 create mode 100644 install.mirror.ps1

diff --git a/install.mirror.ps1 b/install.mirror.ps1
new file mode 100644
index 00000000..b901732a
--- /dev/null
+++ b/install.mirror.ps1
@@ -0,0 +1,147 @@
+# Install the ocr (Open Code Review) CLI from GitHub releases on Windows.
+#   irm https://raw.githubusercontent.com/alibaba/open-code-review/main/install.ps1 | iex
+# Prefer to inspect first:
+#   irm https://raw.githubusercontent.com/alibaba/open-code-review/main/install.ps1 -OutFile install.ps1
+#   notepad install.ps1   # review, then: .\install.ps1
+# Env: OCR_INSTALL_DIR (default $env:LOCALAPPDATA\Programs\ocr), OCR_VERSION (default latest),
+# Set a GITHUB_MIRROR_DOMAIN_PREFIX to download assests through a mirror domain.
+# Requires PowerShell 5.1+ or PowerShell 7+.
+
+$ErrorActionPreference = 'Stop'
+
+function Err([string]$Message) {
+    [Console]::Error.WriteLine("error: $Message")
+    exit 1
+}
+
+function Get-OcrArch {
+    $arch = $env:PROCESSOR_ARCHITECTURE
+    if ([string]::IsNullOrEmpty($arch)) {
+        Err 'unable to detect architecture (PROCESSOR_ARCHITECTURE is empty); please set it manually'
+    }
+    switch -Regex ($arch) {
+        '^(AMD64|X64|x86_64)$' { return 'amd64' }
+        '^(ARM64|aarch64)$' { return 'arm64' }
+        default { Err "unsupported architecture: $arch (only amd64 and arm64 are supported)" }
+    }
+}
+
+function Resolve-OcrVersion([string]$Repo) {
+    $version = $env:OCR_VERSION
+    if (-not [string]::IsNullOrWhiteSpace($version)) {
+        return $version.Trim()
+    }
+    try {
+        $release = Invoke-RestMethod -Uri "https://api.github.com/repos/$Repo/releases/latest" -UseBasicParsing
+    } catch {
+        Err "failed to fetch latest release info from github api"
+    }
+    if (-not $release.tag_name) {
+        Err 'could not resolve latest release tag'
+    }
+    return [string]$release.tag_name
+}
+
+function Get-ChecksumFromFile([string]$ChecksumFile, [string]$AssetName) {
+    foreach ($line in Get-Content -LiteralPath $ChecksumFile) {
+        if ([string]::IsNullOrWhiteSpace($line)) { continue }
+        $parts = $line.Trim() -split '\s+', 2
+        if ($parts.Count -eq 2 -and $parts[1] -eq $AssetName) {
+            return $parts[0].ToLowerInvariant()
+        }
+    }
+    return $null
+}
+
+function Install-OcrBinary([string]$Source, [string]$InstallDir, [string]$BinName) {
+    try {
+        New-Item -ItemType Directory -Force -Path $InstallDir | Out-Null
+        $dest = Join-Path $InstallDir $BinName
+        Copy-Item -LiteralPath $Source -Destination $dest -Force
+    } catch {
+        Err "$InstallDir is not writable; set OCR_INSTALL_DIR to a writable path"
+    }
+}
+
+function Show-PostInstallPathNotice([string]$BinName, [string]$InstallDir) {
+    $pathEntries = $env:PATH -split ';' | ForEach-Object { $_.TrimEnd('\') }
+    $normalizedInstall = $InstallDir.TrimEnd('\')
+    $onPath = $false
+    foreach ($entry in $pathEntries) {
+        if ($entry -and [string]::Equals($entry, $normalizedInstall, [System.StringComparison]::OrdinalIgnoreCase)) {
+            $onPath = $true
+            break
+        }
+    }
+    if (-not $onPath) {
+        Write-Host "note: $InstallDir is not on your PATH; add it or run $InstallDir\$BinName directly"
+        return
+    }
+    if (-not (Get-Command $BinName -ErrorAction SilentlyContinue)) {
+        Write-Host "note: open a new shell so $BinName resolves on PATH"
+    }
+}
+
+# Ensure TLS 1.2 for Windows PowerShell 5.1 (Invoke-WebRequest / Invoke-RestMethod).
+try {
+    [Net.ServicePointManager]::SecurityProtocol = `
+        [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
+} catch {
+    # Ignore if the runtime already negotiates modern TLS.
+}
+
+$Repo = 'alibaba/open-code-review'
+$Bin = 'ocr.exe'
+$AssetPrefix = 'opencodereview'
+$DefaultInstallDir = Join-Path $env:LOCALAPPDATA 'Programs\ocr'
+$InstallDir = if (-not [string]::IsNullOrWhiteSpace($env:OCR_INSTALL_DIR)) {
+    $env:OCR_INSTALL_DIR.Trim()
+} else {
+    $DefaultInstallDir
+}
+
+$arch = Get-OcrArch
+$os = 'windows'
+$Version = Resolve-OcrVersion $Repo
+$asset = "$AssetPrefix-$os-$arch.exe"
+if (-not [string]::IsNullOrWhiteSpace($env:GITHUB_MIRROR_DOMAIN)) {
+    $base = "https://$($env:GITHUB_MIRROR_DOMAIN.Trim())/github.com/$Repo/releases/download/$Version"
+} else {
+    $base = "https://github.com/$Repo/releases/download/$Version"
+}
+
+$tmp = Join-Path ([System.IO.Path]::GetTempPath()) ("ocr-install-" + [guid]::NewGuid().ToString('N'))
+New-Item -ItemType Directory -Force -Path $tmp | Out-Null
+
+try {
+    $assetPath = Join-Path $tmp $asset
+    $sumPath = Join-Path $tmp 'sha256sum.txt'
+
+    Write-Host "downloading $Bin $Version ($os/$arch)..."
+    try {
+        Invoke-WebRequest -Uri "$base/$asset" -OutFile $assetPath -UseBasicParsing
+    } catch {
+        Err "download failed: $base/$asset"
+    }
+    try {
+        Invoke-WebRequest -Uri "$base/sha256sum.txt" -OutFile $sumPath -UseBasicParsing
+    } catch {
+        Err 'sha256sum.txt download failed'
+    }
+
+    $want = Get-ChecksumFromFile $sumPath $asset
+    if ([string]::IsNullOrEmpty($want)) {
+        Err "no checksum entry for $asset in sha256sum.txt"
+    }
+    $got = (Get-FileHash -LiteralPath $assetPath -Algorithm SHA256).Hash.ToLowerInvariant()
+    if ($got -ne $want) {
+        Err "checksum mismatch for $asset (got $got, want $want)"
+    }
+
+    Install-OcrBinary $assetPath $InstallDir $Bin
+
+    Write-Host "installed $Bin $Version -> $InstallDir\$Bin"
+    Show-PostInstallPathNotice $Bin $InstallDir
+} finally {
+    Remove-Item -LiteralPath $tmp -Recurse -Force -ErrorAction SilentlyContinue
+}
diff --git a/install.mirror.sh b/install.mirror.sh
index 5b940872..394c0e43 100755
--- a/install.mirror.sh
+++ b/install.mirror.sh
@@ -9,7 +9,7 @@
 #   curl -fsSL https://raw.githubusercontent.com/alibaba/open-code-review/main/install.sh -o install.sh
 #   less install.sh && sh install.sh
 # Env: OCR_INSTALL_DIR (default /usr/local/bin), OCR_VERSION (default latest),
-# Use GITHUB_MIRROR_DOMAIN_PREFIX to set a mirror domain for Github releases.
+# Set a GITHUB_MIRROR_DOMAIN_PREFIX to download assests through a mirror domain.
 set -eu
 
 main() {

From c0f451621488f9c44d700064a6c885a9dfb33000 Mon Sep 17 00:00:00 2001
From: wu21-web <wu2196674@icloud.com>
Date: Thu, 13 Aug 2026 22:20:33 +0900
Subject: [PATCH 03/11] scripts updates

---
 install.mirror.ps1 | 4 ++--
 install.mirror.sh  | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/install.mirror.ps1 b/install.mirror.ps1
index b901732a..b8be14dd 100644
--- a/install.mirror.ps1
+++ b/install.mirror.ps1
@@ -104,8 +104,8 @@ $arch = Get-OcrArch
 $os = 'windows'
 $Version = Resolve-OcrVersion $Repo
 $asset = "$AssetPrefix-$os-$arch.exe"
-if (-not [string]::IsNullOrWhiteSpace($env:GITHUB_MIRROR_DOMAIN)) {
-    $base = "https://$($env:GITHUB_MIRROR_DOMAIN.Trim())/github.com/$Repo/releases/download/$Version"
+if (-not [string]::IsNullOrWhiteSpace($env:GITHUB_MIRROR_DOMAIN_PREFIX)) {
+    $base = "https://$($env:GITHUB_MIRROR_DOMAIN_PREFIX.Trim())/github.com/$Repo/releases/download/$Version"
 } else {
     $base = "https://github.com/$Repo/releases/download/$Version"
 }
diff --git a/install.mirror.sh b/install.mirror.sh
index 394c0e43..af8f5bba 100755
--- a/install.mirror.sh
+++ b/install.mirror.sh
@@ -44,7 +44,7 @@ main() {
 
   asset="${ASSET_PREFIX}-${os}-${arch}"
   if [ -n "${GITHUB_MIRROR_DOMAIN_PREFIX:-}" ]; then
-    base="https://${GITHUB_MIRROR_DOMAIN_PREFIX}github.com/$REPO/releases/download/$VERSION"
+    base="https://${GITHUB_MIRROR_DOMAIN_PREFIX}/github.com/$REPO/releases/download/$VERSION"
   else
     base="https://github.com/$REPO/releases/download/$VERSION"
   fi

From 2d29e97d7a5697c1e9639d13107bbff8a6b615f2 Mon Sep 17 00:00:00 2001
From: wu21-web <wu2196674@icloud.com>
Date: Thu, 13 Aug 2026 22:20:57 +0900
Subject: [PATCH 04/11] spelling qwq

---
 install.mirror.ps1 | 2 +-
 install.mirror.sh  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/install.mirror.ps1 b/install.mirror.ps1
index b8be14dd..525f2506 100644
--- a/install.mirror.ps1
+++ b/install.mirror.ps1
@@ -4,7 +4,7 @@
 #   irm https://raw.githubusercontent.com/alibaba/open-code-review/main/install.ps1 -OutFile install.ps1
 #   notepad install.ps1   # review, then: .\install.ps1
 # Env: OCR_INSTALL_DIR (default $env:LOCALAPPDATA\Programs\ocr), OCR_VERSION (default latest),
-# Set a GITHUB_MIRROR_DOMAIN_PREFIX to download assests through a mirror domain.
+# Set a GITHUB_MIRROR_DOMAIN_PREFIX to download assets through a mirror domain.
 # Requires PowerShell 5.1+ or PowerShell 7+.
 
 $ErrorActionPreference = 'Stop'
diff --git a/install.mirror.sh b/install.mirror.sh
index af8f5bba..3237488a 100755
--- a/install.mirror.sh
+++ b/install.mirror.sh
@@ -9,7 +9,7 @@
 #   curl -fsSL https://raw.githubusercontent.com/alibaba/open-code-review/main/install.sh -o install.sh
 #   less install.sh && sh install.sh
 # Env: OCR_INSTALL_DIR (default /usr/local/bin), OCR_VERSION (default latest),
-# Set a GITHUB_MIRROR_DOMAIN_PREFIX to download assests through a mirror domain.
+# Set a GITHUB_MIRROR_DOMAIN_PREFIX to download assets through a mirror domain.
 set -eu
 
 main() {

From 80030d7dd27edef835f94e04cc52347593b40efa Mon Sep 17 00:00:00 2001
From: wu21-web <wu2196674@icloud.com>
Date: Thu, 13 Aug 2026 22:21:35 +0900
Subject: [PATCH 05/11] docs: update

---
 pages/src/content/docs/en/installation.md | 5 +++++
 pages/src/content/docs/ja/installation.md | 5 +++++
 pages/src/content/docs/ru/installation.md | 5 +++++
 pages/src/content/docs/zh/installation.md | 5 +++++
 4 files changed, 20 insertions(+)

diff --git a/pages/src/content/docs/en/installation.md b/pages/src/content/docs/en/installation.md
index f681003c..86d36ac0 100644
--- a/pages/src/content/docs/en/installation.md
+++ b/pages/src/content/docs/en/installation.md
@@ -79,6 +79,11 @@ machines:
 curl -fsSL https://raw.githubusercontent.com/alibaba/open-code-review/main/install.sh | sh
 ```
 
+__In some regions where network access to GitHub is slow, set a GitHub mirror domain to download assets through a mirror.__
+```bash
+export GITHUB_MIRROR_DOMAIN_PREFIX='gh-proxy.com'
+```
+
 It honours two environment variables:
 
 | Variable | Default | Purpose |
diff --git a/pages/src/content/docs/ja/installation.md b/pages/src/content/docs/ja/installation.md
index 04524714..f24abfe1 100644
--- a/pages/src/content/docs/ja/installation.md
+++ b/pages/src/content/docs/ja/installation.md
@@ -77,6 +77,11 @@ GitHub Release バイナリのダウンロード（検証付き）をラップ
 curl -fsSL https://raw.githubusercontent.com/alibaba/open-code-review/main/install.sh | sh
 ```
 
+__一部の地域では GitHub へのネットワークアクセスが遅いため、GitHub ミラードメインを設定すると、ミラー経由でアセットをダウンロードできます。__
+```bash
+export GITHUB_MIRROR_DOMAIN_PREFIX='gh-proxy.com'
+```
+
 2 つの環境変数を認識します。
 
 | 変数 | デフォルト値 | 用途 |
diff --git a/pages/src/content/docs/ru/installation.md b/pages/src/content/docs/ru/installation.md
index a964ee7f..a129cfeb 100644
--- a/pages/src/content/docs/ru/installation.md
+++ b/pages/src/content/docs/ru/installation.md
@@ -77,6 +77,11 @@ sudo port upgrade open-code-review
 curl -fsSL https://raw.githubusercontent.com/alibaba/open-code-review/main/install.sh | sh
 ```
 
+__В некоторых регионах доступ к GitHub может быть медленным. В этом случае задайте домен зеркала GitHub, чтобы загружать артефакты через него.__
+```bash
+export GITHUB_MIRROR_DOMAIN_PREFIX='gh-proxy.com'
+```
+
 Скрипт учитывает две переменные окружения:
 
 | Переменная | По умолчанию | Назначение |
diff --git a/pages/src/content/docs/zh/installation.md b/pages/src/content/docs/zh/installation.md
index 41357e7f..9d211647 100644
--- a/pages/src/content/docs/zh/installation.md
+++ b/pages/src/content/docs/zh/installation.md
@@ -75,6 +75,11 @@ sudo port upgrade open-code-review
 curl -fsSL https://raw.githubusercontent.com/alibaba/open-code-review/main/install.sh | sh
 ```
 
+__在部分网络访问 GitHub 较慢的地区，可以设置一个 GitHub 镜像域名，通过镜像下载资源。__
+```bash
+export GITHUB_MIRROR_DOMAIN_PREFIX='gh-proxy.com'
+```
+
 它识别两个环境变量：
 
 | 变量 | 默认值 | 用途 |

From 23f51cb5369e5e71079e3126c422b3e737495faa Mon Sep 17 00:00:00 2001
From: wu21-web <wu2196674@icloud.com>
Date: Thu, 13 Aug 2026 22:37:54 +0900
Subject: [PATCH 06/11] docs: powershell users

---
 pages/src/content/docs/en/installation.md | 5 +++++
 pages/src/content/docs/ja/installation.md | 5 +++++
 pages/src/content/docs/ru/installation.md | 5 +++++
 pages/src/content/docs/zh/installation.md | 5 +++++
 4 files changed, 20 insertions(+)

diff --git a/pages/src/content/docs/en/installation.md b/pages/src/content/docs/en/installation.md
index 86d36ac0..61093045 100644
--- a/pages/src/content/docs/en/installation.md
+++ b/pages/src/content/docs/en/installation.md
@@ -99,6 +99,11 @@ On Windows (PowerShell 5.1+), use the PowerShell installer instead:
 irm https://raw.githubusercontent.com/alibaba/open-code-review/main/install.ps1 | iex
 ```
 
+__To download through a mirror when GitHub access is slow, set the same mirror domain as a PowerShell environment variable:__
+```powershell
+$env:GITHUB_MIRROR_DOMAIN_PREFIX = 'gh-proxy.com'
+```
+
 It honours the same `OCR_INSTALL_DIR` and `OCR_VERSION` variables (set via
 `$env:OCR_INSTALL_DIR` / `$env:OCR_VERSION`). The default install location is
 `%LOCALAPPDATA%\Programs\ocr`.
diff --git a/pages/src/content/docs/ja/installation.md b/pages/src/content/docs/ja/installation.md
index f24abfe1..6fcddf4f 100644
--- a/pages/src/content/docs/ja/installation.md
+++ b/pages/src/content/docs/ja/installation.md
@@ -97,6 +97,11 @@ Windows（PowerShell 5.1+）では、代わりに PowerShell インストーラ
 irm https://raw.githubusercontent.com/alibaba/open-code-review/main/install.ps1 | iex
 ```
 
+__GitHub へのアクセスが遅い場合は、同じミラードメインを PowerShell の環境変数として設定すると、ミラー経由でダウンロードできます：__
+```powershell
+$env:GITHUB_MIRROR_DOMAIN_PREFIX = 'gh-proxy.com'
+```
+
 同じ `OCR_INSTALL_DIR` と `OCR_VERSION` を認識します（`$env:OCR_INSTALL_DIR` /
 `$env:OCR_VERSION` で設定）。デフォルトのインストール先は
 `%LOCALAPPDATA%\Programs\ocr` です。
diff --git a/pages/src/content/docs/ru/installation.md b/pages/src/content/docs/ru/installation.md
index a129cfeb..1a3f2c18 100644
--- a/pages/src/content/docs/ru/installation.md
+++ b/pages/src/content/docs/ru/installation.md
@@ -97,6 +97,11 @@ export GITHUB_MIRROR_DOMAIN_PREFIX='gh-proxy.com'
 irm https://raw.githubusercontent.com/alibaba/open-code-review/main/install.ps1 | iex
 ```
 
+__Если доступ к GitHub медленный, задайте тот же домен зеркала как переменную окружения PowerShell, чтобы загружать файлы через него:__
+```powershell
+$env:GITHUB_MIRROR_DOMAIN_PREFIX = 'gh-proxy.com'
+```
+
 Установщик учитывает те же переменные `OCR_INSTALL_DIR` и `OCR_VERSION` (через
 `$env:OCR_INSTALL_DIR` / `$env:OCR_VERSION`). По умолчанию файлы устанавливаются
 в `%LOCALAPPDATA%\Programs\ocr`.
diff --git a/pages/src/content/docs/zh/installation.md b/pages/src/content/docs/zh/installation.md
index 9d211647..416e82f0 100644
--- a/pages/src/content/docs/zh/installation.md
+++ b/pages/src/content/docs/zh/installation.md
@@ -95,6 +95,11 @@ export GITHUB_MIRROR_DOMAIN_PREFIX='gh-proxy.com'
 irm https://raw.githubusercontent.com/alibaba/open-code-review/main/install.ps1 | iex
 ```
 
+__访问 GitHub 较慢时，同样可以将镜像域名设为 PowerShell 环境变量，通过镜像下载：__
+```powershell
+$env:GITHUB_MIRROR_DOMAIN_PREFIX = 'gh-proxy.com'
+```
+
 它同样识别 `OCR_INSTALL_DIR` 与 `OCR_VERSION`（通过 `$env:OCR_INSTALL_DIR` /
 `$env:OCR_VERSION` 设置）。默认安装位置为 `%LOCALAPPDATA%\Programs\ocr`。
 

From f7e16ab3b891798ad721014dadbd5d6b986e4cc6 Mon Sep 17 00:00:00 2001
From: wu21-web <wu2196674@icloud.com>
Date: Thu, 13 Aug 2026 22:42:23 +0900
Subject: [PATCH 07/11] merge scripts

---
 install.mirror.ps1 | 147 ---------------------------------------------
 install.mirror.sh  | 109 ---------------------------------
 install.ps1        |   9 ++-
 install.sh         |   9 ++-
 4 files changed, 14 insertions(+), 260 deletions(-)
 delete mode 100644 install.mirror.ps1
 delete mode 100755 install.mirror.sh

diff --git a/install.mirror.ps1 b/install.mirror.ps1
deleted file mode 100644
index 525f2506..00000000
--- a/install.mirror.ps1
+++ /dev/null
@@ -1,147 +0,0 @@
-# Install the ocr (Open Code Review) CLI from GitHub releases on Windows.
-#   irm https://raw.githubusercontent.com/alibaba/open-code-review/main/install.ps1 | iex
-# Prefer to inspect first:
-#   irm https://raw.githubusercontent.com/alibaba/open-code-review/main/install.ps1 -OutFile install.ps1
-#   notepad install.ps1   # review, then: .\install.ps1
-# Env: OCR_INSTALL_DIR (default $env:LOCALAPPDATA\Programs\ocr), OCR_VERSION (default latest),
-# Set a GITHUB_MIRROR_DOMAIN_PREFIX to download assets through a mirror domain.
-# Requires PowerShell 5.1+ or PowerShell 7+.
-
-$ErrorActionPreference = 'Stop'
-
-function Err([string]$Message) {
-    [Console]::Error.WriteLine("error: $Message")
-    exit 1
-}
-
-function Get-OcrArch {
-    $arch = $env:PROCESSOR_ARCHITECTURE
-    if ([string]::IsNullOrEmpty($arch)) {
-        Err 'unable to detect architecture (PROCESSOR_ARCHITECTURE is empty); please set it manually'
-    }
-    switch -Regex ($arch) {
-        '^(AMD64|X64|x86_64)$' { return 'amd64' }
-        '^(ARM64|aarch64)$' { return 'arm64' }
-        default { Err "unsupported architecture: $arch (only amd64 and arm64 are supported)" }
-    }
-}
-
-function Resolve-OcrVersion([string]$Repo) {
-    $version = $env:OCR_VERSION
-    if (-not [string]::IsNullOrWhiteSpace($version)) {
-        return $version.Trim()
-    }
-    try {
-        $release = Invoke-RestMethod -Uri "https://api.github.com/repos/$Repo/releases/latest" -UseBasicParsing
-    } catch {
-        Err "failed to fetch latest release info from github api"
-    }
-    if (-not $release.tag_name) {
-        Err 'could not resolve latest release tag'
-    }
-    return [string]$release.tag_name
-}
-
-function Get-ChecksumFromFile([string]$ChecksumFile, [string]$AssetName) {
-    foreach ($line in Get-Content -LiteralPath $ChecksumFile) {
-        if ([string]::IsNullOrWhiteSpace($line)) { continue }
-        $parts = $line.Trim() -split '\s+', 2
-        if ($parts.Count -eq 2 -and $parts[1] -eq $AssetName) {
-            return $parts[0].ToLowerInvariant()
-        }
-    }
-    return $null
-}
-
-function Install-OcrBinary([string]$Source, [string]$InstallDir, [string]$BinName) {
-    try {
-        New-Item -ItemType Directory -Force -Path $InstallDir | Out-Null
-        $dest = Join-Path $InstallDir $BinName
-        Copy-Item -LiteralPath $Source -Destination $dest -Force
-    } catch {
-        Err "$InstallDir is not writable; set OCR_INSTALL_DIR to a writable path"
-    }
-}
-
-function Show-PostInstallPathNotice([string]$BinName, [string]$InstallDir) {
-    $pathEntries = $env:PATH -split ';' | ForEach-Object { $_.TrimEnd('\') }
-    $normalizedInstall = $InstallDir.TrimEnd('\')
-    $onPath = $false
-    foreach ($entry in $pathEntries) {
-        if ($entry -and [string]::Equals($entry, $normalizedInstall, [System.StringComparison]::OrdinalIgnoreCase)) {
-            $onPath = $true
-            break
-        }
-    }
-    if (-not $onPath) {
-        Write-Host "note: $InstallDir is not on your PATH; add it or run $InstallDir\$BinName directly"
-        return
-    }
-    if (-not (Get-Command $BinName -ErrorAction SilentlyContinue)) {
-        Write-Host "note: open a new shell so $BinName resolves on PATH"
-    }
-}
-
-# Ensure TLS 1.2 for Windows PowerShell 5.1 (Invoke-WebRequest / Invoke-RestMethod).
-try {
-    [Net.ServicePointManager]::SecurityProtocol = `
-        [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
-} catch {
-    # Ignore if the runtime already negotiates modern TLS.
-}
-
-$Repo = 'alibaba/open-code-review'
-$Bin = 'ocr.exe'
-$AssetPrefix = 'opencodereview'
-$DefaultInstallDir = Join-Path $env:LOCALAPPDATA 'Programs\ocr'
-$InstallDir = if (-not [string]::IsNullOrWhiteSpace($env:OCR_INSTALL_DIR)) {
-    $env:OCR_INSTALL_DIR.Trim()
-} else {
-    $DefaultInstallDir
-}
-
-$arch = Get-OcrArch
-$os = 'windows'
-$Version = Resolve-OcrVersion $Repo
-$asset = "$AssetPrefix-$os-$arch.exe"
-if (-not [string]::IsNullOrWhiteSpace($env:GITHUB_MIRROR_DOMAIN_PREFIX)) {
-    $base = "https://$($env:GITHUB_MIRROR_DOMAIN_PREFIX.Trim())/github.com/$Repo/releases/download/$Version"
-} else {
-    $base = "https://github.com/$Repo/releases/download/$Version"
-}
-
-$tmp = Join-Path ([System.IO.Path]::GetTempPath()) ("ocr-install-" + [guid]::NewGuid().ToString('N'))
-New-Item -ItemType Directory -Force -Path $tmp | Out-Null
-
-try {
-    $assetPath = Join-Path $tmp $asset
-    $sumPath = Join-Path $tmp 'sha256sum.txt'
-
-    Write-Host "downloading $Bin $Version ($os/$arch)..."
-    try {
-        Invoke-WebRequest -Uri "$base/$asset" -OutFile $assetPath -UseBasicParsing
-    } catch {
-        Err "download failed: $base/$asset"
-    }
-    try {
-        Invoke-WebRequest -Uri "$base/sha256sum.txt" -OutFile $sumPath -UseBasicParsing
-    } catch {
-        Err 'sha256sum.txt download failed'
-    }
-
-    $want = Get-ChecksumFromFile $sumPath $asset
-    if ([string]::IsNullOrEmpty($want)) {
-        Err "no checksum entry for $asset in sha256sum.txt"
-    }
-    $got = (Get-FileHash -LiteralPath $assetPath -Algorithm SHA256).Hash.ToLowerInvariant()
-    if ($got -ne $want) {
-        Err "checksum mismatch for $asset (got $got, want $want)"
-    }
-
-    Install-OcrBinary $assetPath $InstallDir $Bin
-
-    Write-Host "installed $Bin $Version -> $InstallDir\$Bin"
-    Show-PostInstallPathNotice $Bin $InstallDir
-} finally {
-    Remove-Item -LiteralPath $tmp -Recurse -Force -ErrorAction SilentlyContinue
-}
diff --git a/install.mirror.sh b/install.mirror.sh
deleted file mode 100755
index 3237488a..00000000
--- a/install.mirror.sh
+++ /dev/null
@@ -1,109 +0,0 @@
-#!/bin/sh
-
-# SPDX-License-Identifier: Apache-2.0
-# Copyright 2026 alibaba/open-code-review Contributors
-
-# Install the ocr (Open Code Review) CLI from GitHub releases.
-#   curl -fsSL https://raw.githubusercontent.com/alibaba/open-code-review/main/install.sh | sh
-# Prefer to inspect first:
-#   curl -fsSL https://raw.githubusercontent.com/alibaba/open-code-review/main/install.sh -o install.sh
-#   less install.sh && sh install.sh
-# Env: OCR_INSTALL_DIR (default /usr/local/bin), OCR_VERSION (default latest),
-# Set a GITHUB_MIRROR_DOMAIN_PREFIX to download assets through a mirror domain.
-set -eu
-
-main() {
-  REPO="alibaba/open-code-review"
-  BIN="ocr"
-  ASSET_PREFIX="opencodereview"
-  INSTALL_DIR="${OCR_INSTALL_DIR:-/usr/local/bin}"
-  VERSION="${OCR_VERSION:-}"
-
-  command -v curl >/dev/null 2>&1 || err "curl is required"
-
-  os="$(uname -s | tr '[:upper:]' '[:lower:]')"
-  case "$os" in
-    darwin|linux) ;;
-    *) err "unsupported OS: $os (on Windows use: irm https://raw.githubusercontent.com/alibaba/open-code-review/main/install.ps1 | iex)" ;;
-  esac
-
-  arch="$(uname -m)"
-  case "$arch" in
-    x86_64|amd64) arch="amd64" ;;
-    arm64|aarch64) arch="arm64" ;;
-    *) err "unsupported architecture: $arch" ;;
-  esac
-
-  if [ -z "$VERSION" ]; then
-    release_json="$(curl -fsSL "https://api.github.com/repos/$REPO/releases/latest")" ||
-      err "failed to fetch latest release info from github api"
-    VERSION="$(printf '%s' "$release_json" |
-      sed -n 's/.*"tag_name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n1)"
-    [ -n "$VERSION" ] || err "could not resolve latest release tag"
-  fi
-
-  asset="${ASSET_PREFIX}-${os}-${arch}"
-  if [ -n "${GITHUB_MIRROR_DOMAIN_PREFIX:-}" ]; then
-    base="https://${GITHUB_MIRROR_DOMAIN_PREFIX}/github.com/$REPO/releases/download/$VERSION"
-  else
-    base="https://github.com/$REPO/releases/download/$VERSION"
-  fi
-  tmp="$(mktemp -d)"
-  trap 'rm -rf "$tmp"' INT TERM EXIT
-
-  printf 'downloading %s %s (%s/%s)...\n' "$BIN" "$VERSION" "$os" "$arch"
-  curl -fsSL -o "$tmp/$asset" "$base/$asset" || err "download failed: $base/$asset"
-  curl -fsSL -o "$tmp/sha256sum.txt" "$base/sha256sum.txt" || err "sha256sum.txt download failed"
-
-  want="$(awk -v a="$asset" '$2 == a {print tolower($1)}' "$tmp/sha256sum.txt")"
-  [ -n "$want" ] || err "no checksum entry for $asset in sha256sum.txt"
-  got="$(sha256 "$tmp/$asset" | awk '{print tolower($1)}')"
-  [ "$got" = "$want" ] || err "checksum mismatch for $asset (got $got, want $want)"
-
-  install_binary "$tmp/$asset" "$INSTALL_DIR" "$BIN"
-
-  printf 'installed %s %s -> %s\n' "$BIN" "$VERSION" "$INSTALL_DIR/$BIN"
-  post_install_path_notice "$BIN" "$INSTALL_DIR"
-}
-
-# Install the staged binary (mode 0755), escalating with sudo only when needed.
-# Using install(1) under sudo gives the binary root ownership in system dirs.
-install_binary() {
-  src="$1"
-  dir="$2"
-  bin="$3"
-  if mkdir -p "$dir" 2>/dev/null && [ -w "$dir" ]; then
-    install -m 0755 "$src" "$dir/$bin"
-  elif command -v sudo >/dev/null 2>&1; then
-    printf 'note: %s is not writable; escalating with sudo\n' "$dir"
-    sudo mkdir -p "$dir"
-    sudo install -m 0755 "$src" "$dir/$bin"
-  else
-    err "$dir is not writable and sudo is unavailable; set OCR_INSTALL_DIR to a writable path"
-  fi
-}
-
-post_install_path_notice() {
-  bin="$1"
-  install_dir="$2"
-  case ":$PATH:" in
-    *":$install_dir:"*) ;;
-    *) printf 'note: %s is not on your PATH; add it or run %s/%s directly\n' "$install_dir" "$install_dir" "$bin"; return ;;
-  esac
-  command -v "$bin" >/dev/null 2>&1 || printf 'note: open a new shell so %s resolves on PATH\n' "$bin"
-}
-
-# Print the SHA-256 of a file, preferring shasum (macOS) over sha256sum (Linux).
-sha256() {
-  if command -v shasum >/dev/null 2>&1; then
-    shasum -a 256 "$1"
-  elif command -v sha256sum >/dev/null 2>&1; then
-    sha256sum "$1"
-  else
-    err "shasum or sha256sum is required for checksum verification"
-  fi
-}
-
-err() { printf 'error: %s\n' "$1" >&2; exit 1; }
-
-main "$@"
diff --git a/install.ps1 b/install.ps1
index e74d7e89..525f2506 100644
--- a/install.ps1
+++ b/install.ps1
@@ -3,7 +3,8 @@
 # Prefer to inspect first:
 #   irm https://raw.githubusercontent.com/alibaba/open-code-review/main/install.ps1 -OutFile install.ps1
 #   notepad install.ps1   # review, then: .\install.ps1
-# Env: OCR_INSTALL_DIR (default $env:LOCALAPPDATA\Programs\ocr), OCR_VERSION (default latest).
+# Env: OCR_INSTALL_DIR (default $env:LOCALAPPDATA\Programs\ocr), OCR_VERSION (default latest),
+# Set a GITHUB_MIRROR_DOMAIN_PREFIX to download assets through a mirror domain.
 # Requires PowerShell 5.1+ or PowerShell 7+.
 
 $ErrorActionPreference = 'Stop'
@@ -103,7 +104,11 @@ $arch = Get-OcrArch
 $os = 'windows'
 $Version = Resolve-OcrVersion $Repo
 $asset = "$AssetPrefix-$os-$arch.exe"
-$base = "https://github.com/$Repo/releases/download/$Version"
+if (-not [string]::IsNullOrWhiteSpace($env:GITHUB_MIRROR_DOMAIN_PREFIX)) {
+    $base = "https://$($env:GITHUB_MIRROR_DOMAIN_PREFIX.Trim())/github.com/$Repo/releases/download/$Version"
+} else {
+    $base = "https://github.com/$Repo/releases/download/$Version"
+}
 
 $tmp = Join-Path ([System.IO.Path]::GetTempPath()) ("ocr-install-" + [guid]::NewGuid().ToString('N'))
 New-Item -ItemType Directory -Force -Path $tmp | Out-Null
diff --git a/install.sh b/install.sh
index c85330a7..3237488a 100755
--- a/install.sh
+++ b/install.sh
@@ -8,7 +8,8 @@
 # Prefer to inspect first:
 #   curl -fsSL https://raw.githubusercontent.com/alibaba/open-code-review/main/install.sh -o install.sh
 #   less install.sh && sh install.sh
-# Env: OCR_INSTALL_DIR (default /usr/local/bin), OCR_VERSION (default latest).
+# Env: OCR_INSTALL_DIR (default /usr/local/bin), OCR_VERSION (default latest),
+# Set a GITHUB_MIRROR_DOMAIN_PREFIX to download assets through a mirror domain.
 set -eu
 
 main() {
@@ -42,7 +43,11 @@ main() {
   fi
 
   asset="${ASSET_PREFIX}-${os}-${arch}"
-  base="https://github.com/$REPO/releases/download/$VERSION"
+  if [ -n "${GITHUB_MIRROR_DOMAIN_PREFIX:-}" ]; then
+    base="https://${GITHUB_MIRROR_DOMAIN_PREFIX}/github.com/$REPO/releases/download/$VERSION"
+  else
+    base="https://github.com/$REPO/releases/download/$VERSION"
+  fi
   tmp="$(mktemp -d)"
   trap 'rm -rf "$tmp"' INT TERM EXIT
 

From 1f07adeca7e88c83fcefd941a84fea616c072615 Mon Sep 17 00:00:00 2001
From: wu21-web <wu2196674@icloud.com>
Date: Thu, 13 Aug 2026 22:54:42 +0900
Subject: [PATCH 08/11] warn about security risks & docs

---
 install.ps1                               |  1 +
 install.sh                                |  1 +
 pages/src/content/docs/en/installation.md | 12 ++++++++----
 pages/src/content/docs/ja/installation.md | 10 +++++++---
 pages/src/content/docs/ru/installation.md | 12 ++++++++----
 pages/src/content/docs/zh/installation.md | 10 +++++++---
 6 files changed, 32 insertions(+), 14 deletions(-)

diff --git a/install.ps1 b/install.ps1
index 525f2506..a6a0af5c 100644
--- a/install.ps1
+++ b/install.ps1
@@ -105,6 +105,7 @@ $os = 'windows'
 $Version = Resolve-OcrVersion $Repo
 $asset = "$AssetPrefix-$os-$arch.exe"
 if (-not [string]::IsNullOrWhiteSpace($env:GITHUB_MIRROR_DOMAIN_PREFIX)) {
+    Write-Host "WARNING: Using an official mirror domain, which may lead to SHA256 checksum mismatches and security risks."
     $base = "https://$($env:GITHUB_MIRROR_DOMAIN_PREFIX.Trim())/github.com/$Repo/releases/download/$Version"
 } else {
     $base = "https://github.com/$Repo/releases/download/$Version"
diff --git a/install.sh b/install.sh
index 3237488a..72a9f28f 100755
--- a/install.sh
+++ b/install.sh
@@ -44,6 +44,7 @@ main() {
 
   asset="${ASSET_PREFIX}-${os}-${arch}"
   if [ -n "${GITHUB_MIRROR_DOMAIN_PREFIX:-}" ]; then
+    echo "WARNING: Using an official mirror domain, which may lead to SHA256 checksum mismatches and security risks."
     base="https://${GITHUB_MIRROR_DOMAIN_PREFIX}/github.com/$REPO/releases/download/$VERSION"
   else
     base="https://github.com/$REPO/releases/download/$VERSION"
diff --git a/pages/src/content/docs/en/installation.md b/pages/src/content/docs/en/installation.md
index 61093045..98909ea5 100644
--- a/pages/src/content/docs/en/installation.md
+++ b/pages/src/content/docs/en/installation.md
@@ -84,12 +84,15 @@ __In some regions where network access to GitHub is slow, set a GitHub mirror do
 export GITHUB_MIRROR_DOMAIN_PREFIX='gh-proxy.com'
 ```
 
-It honours two environment variables:
+> **Security note:** The mirror is a third-party service — both the binary and its `sha256sum.txt` are downloaded from the mirror, so a compromised mirror could serve a tampered binary with a matching checksum; the checksum check alone is not a guarantee. For security-critical installs, download directly from GitHub or verify against the upstream `sha256sum.txt` on the [releases page](https://github.com/alibaba/open-code-review/releases).
+
+It honours three environment variables:
 
 | Variable | Default | Purpose |
 |---|---|---|
 | `OCR_INSTALL_DIR` | `/usr/local/bin` | Where to place the `ocr` binary. |
 | `OCR_VERSION` | latest release | Pin a specific release tag (e.g. `v1.2.3`). |
+| `GITHUB_MIRROR_DOMAIN_PREFIX` | *(unset)* | Download release assets through a GitHub mirror domain (e.g. `gh-proxy.com`). |
 
 The script supports `darwin` and `linux` on `amd64` / `arm64`.
 
@@ -104,9 +107,10 @@ __To download through a mirror when GitHub access is slow, set the same mirror d
 $env:GITHUB_MIRROR_DOMAIN_PREFIX = 'gh-proxy.com'
 ```
 
-It honours the same `OCR_INSTALL_DIR` and `OCR_VERSION` variables (set via
-`$env:OCR_INSTALL_DIR` / `$env:OCR_VERSION`). The default install location is
-`%LOCALAPPDATA%\Programs\ocr`.
+It honours the same `OCR_INSTALL_DIR`, `OCR_VERSION`, and
+`GITHUB_MIRROR_DOMAIN_PREFIX` variables (set via `$env:OCR_INSTALL_DIR` /
+`$env:OCR_VERSION` / `$env:GITHUB_MIRROR_DOMAIN_PREFIX`). The default
+install location is `%LOCALAPPDATA%\Programs\ocr`.
 
 ## GitHub Release binary
 
diff --git a/pages/src/content/docs/ja/installation.md b/pages/src/content/docs/ja/installation.md
index 6fcddf4f..04177206 100644
--- a/pages/src/content/docs/ja/installation.md
+++ b/pages/src/content/docs/ja/installation.md
@@ -82,12 +82,15 @@ __一部の地域では GitHub へのネットワークアクセスが遅いた
 export GITHUB_MIRROR_DOMAIN_PREFIX='gh-proxy.com'
 ```
 
-2 つの環境変数を認識します。
+> **セキュリティ上の注意：** ミラーは第三者のサービスです。バイナリと `sha256sum.txt` の両方がミラーから取得されるため、侵害されたミラーは改ざんされたバイナリと一致するチェックサムを配信する可能性があり、チェックサム検証だけでは安全性を保証できません。セキュリティが重要なインストールでは、GitHub から直接ダウンロードするか、[releases ページ](https://github.com/alibaba/open-code-review/releases) のアップストリームの `sha256sum.txt` で検証してください。
+
+3 つの環境変数を認識します。
 
 | 変数 | デフォルト値 | 用途 |
 |---|---|---|
 | `OCR_INSTALL_DIR` | `/usr/local/bin` | `ocr` バイナリを配置する場所。 |
 | `OCR_VERSION` | 最新 release | 特定の release tag に固定します（例：`v1.2.3`）。 |
+| `GITHUB_MIRROR_DOMAIN_PREFIX` | （未設定） | GitHub ミラードメイン経由でリリースアセットをダウンロードします（例：`gh-proxy.com`）。 |
 
 このスクリプトは `darwin` と `linux` の `amd64` / `arm64` をサポートします。
 
@@ -102,8 +105,9 @@ __GitHub へのアクセスが遅い場合は、同じミラードメインを P
 $env:GITHUB_MIRROR_DOMAIN_PREFIX = 'gh-proxy.com'
 ```
 
-同じ `OCR_INSTALL_DIR` と `OCR_VERSION` を認識します（`$env:OCR_INSTALL_DIR` /
-`$env:OCR_VERSION` で設定）。デフォルトのインストール先は
+同じ `OCR_INSTALL_DIR`、`OCR_VERSION`、`GITHUB_MIRROR_DOMAIN_PREFIX` を認識します
+（`$env:OCR_INSTALL_DIR` / `$env:OCR_VERSION` /
+`$env:GITHUB_MIRROR_DOMAIN_PREFIX` で設定）。デフォルトのインストール先は
 `%LOCALAPPDATA%\Programs\ocr` です。
 
 ## GitHub Release バイナリ
diff --git a/pages/src/content/docs/ru/installation.md b/pages/src/content/docs/ru/installation.md
index 1a3f2c18..249e7b8b 100644
--- a/pages/src/content/docs/ru/installation.md
+++ b/pages/src/content/docs/ru/installation.md
@@ -82,12 +82,15 @@ __В некоторых регионах доступ к GitHub может бы
 export GITHUB_MIRROR_DOMAIN_PREFIX='gh-proxy.com'
 ```
 
-Скрипт учитывает две переменные окружения:
+> **Примечание по безопасности:** Зеркало — это сторонний сервис. Поскольку и бинарник, и `sha256sum.txt` загружаются с зеркала, скомпрометированное зеркало может отдать подменённый бинарник вместе с подходящей контрольной суммой — проверка контрольной суммы сама по себе не является гарантией безопасности. Для установок с высокими требованиями к безопасности скачивайте напрямую с GitHub или сверяйтесь с оригинальным `sha256sum.txt` на [странице релизов](https://github.com/alibaba/open-code-review/releases).
+
+Скрипт учитывает три переменные окружения:
 
 | Переменная | По умолчанию | Назначение |
 |---|---|---|
 | `OCR_INSTALL_DIR` | `/usr/local/bin` | Куда положить бинарник `ocr`. |
 | `OCR_VERSION` | последний релиз | Закрепить конкретный тег релиза (например `v1.2.3`). |
+| `GITHUB_MIRROR_DOMAIN_PREFIX` | не задана | Скачивать артефакты релиза через зеркало GitHub (например `gh-proxy.com`). |
 
 Скрипт поддерживает `darwin` и `linux` на `amd64` / `arm64`.
 
@@ -102,9 +105,10 @@ __Если доступ к GitHub медленный, задайте тот же
 $env:GITHUB_MIRROR_DOMAIN_PREFIX = 'gh-proxy.com'
 ```
 
-Установщик учитывает те же переменные `OCR_INSTALL_DIR` и `OCR_VERSION` (через
-`$env:OCR_INSTALL_DIR` / `$env:OCR_VERSION`). По умолчанию файлы устанавливаются
-в `%LOCALAPPDATA%\Programs\ocr`.
+Установщик учитывает те же переменные `OCR_INSTALL_DIR`, `OCR_VERSION` и
+`GITHUB_MIRROR_DOMAIN_PREFIX` (через `$env:OCR_INSTALL_DIR` /
+`$env:OCR_VERSION` / `$env:GITHUB_MIRROR_DOMAIN_PREFIX`). По умолчанию файлы
+устанавливаются в `%LOCALAPPDATA%\Programs\ocr`.
 
 ## Бинарник из GitHub Release
 
diff --git a/pages/src/content/docs/zh/installation.md b/pages/src/content/docs/zh/installation.md
index 416e82f0..6872a3ed 100644
--- a/pages/src/content/docs/zh/installation.md
+++ b/pages/src/content/docs/zh/installation.md
@@ -80,12 +80,15 @@ __在部分网络访问 GitHub 较慢的地区，可以设置一个 GitHub 镜
 export GITHUB_MIRROR_DOMAIN_PREFIX='gh-proxy.com'
 ```
 
-它识别两个环境变量：
+> **安全提示：** 镜像是第三方服务——二进制及其 `sha256sum.txt` 都来自镜像，因此被攻破的镜像可能同时提供被篡改的二进制与匹配的校验和，仅靠校验和校验并不能保证安全。对安全性要求较高的安装，请直接从 GitHub 下载，或对照 [releases 页面](https://github.com/alibaba/open-code-review/releases) 上的上游 `sha256sum.txt` 进行核对。
+
+它识别三个环境变量：
 
 | 变量 | 默认值 | 用途 |
 |---|---|---|
 | `OCR_INSTALL_DIR` | `/usr/local/bin` | 放置 `ocr` 二进制的位置。 |
 | `OCR_VERSION` | 最新 release | 固定到某个 release tag（如 `v1.2.3`）。 |
+| `GITHUB_MIRROR_DOMAIN_PREFIX` | （未设置） | 通过 GitHub 镜像域名下载 release 资源（如 `gh-proxy.com`）。 |
 
 该脚本支持 `darwin` 与 `linux` 的 `amd64` / `arm64`。
 
@@ -100,8 +103,9 @@ __访问 GitHub 较慢时，同样可以将镜像域名设为 PowerShell 环境
 $env:GITHUB_MIRROR_DOMAIN_PREFIX = 'gh-proxy.com'
 ```
 
-它同样识别 `OCR_INSTALL_DIR` 与 `OCR_VERSION`（通过 `$env:OCR_INSTALL_DIR` /
-`$env:OCR_VERSION` 设置）。默认安装位置为 `%LOCALAPPDATA%\Programs\ocr`。
+它同样识别 `OCR_INSTALL_DIR`、`OCR_VERSION` 与 `GITHUB_MIRROR_DOMAIN_PREFIX`
+（通过 `$env:OCR_INSTALL_DIR` / `$env:OCR_VERSION` /
+`$env:GITHUB_MIRROR_DOMAIN_PREFIX` 设置）。默认安装位置为 `%LOCALAPPDATA%\Programs\ocr`。
 
 ## GitHub Release 二进制
 

From ea44a14d3893815cab8f24a68347c921d6993632 Mon Sep 17 00:00:00 2001
From: wu21-web <wu2196674@icloud.com>
Date: Thu, 13 Aug 2026 22:57:08 +0900
Subject: [PATCH 09/11] trim the DOMAIN string

---
 install.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/install.sh b/install.sh
index 72a9f28f..bd6b3930 100755
--- a/install.sh
+++ b/install.sh
@@ -43,9 +43,10 @@ main() {
   fi
 
   asset="${ASSET_PREFIX}-${os}-${arch}"
-  if [ -n "${GITHUB_MIRROR_DOMAIN_PREFIX:-}" ]; then
+  prefix="$(printf '%s' "${GITHUB_MIRROR_DOMAIN_PREFIX:-}" | tr -d '[:space:]')"
+  if [ -n "$prefix" ]; then
     echo "WARNING: Using an official mirror domain, which may lead to SHA256 checksum mismatches and security risks."
-    base="https://${GITHUB_MIRROR_DOMAIN_PREFIX}/github.com/$REPO/releases/download/$VERSION"
+    base="https://${prefix}/github.com/$REPO/releases/download/$VERSION"
   else
     base="https://github.com/$REPO/releases/download/$VERSION"
   fi

From 61dd0c79b0e05d340f267eb54c56713f5a162c4c Mon Sep 17 00:00:00 2001
From: wu21-web <wu2196674@icloud.com>
Date: Thu, 13 Aug 2026 23:06:11 +0900
Subject: [PATCH 10/11] fix spelling

---
 install.ps1 | 2 +-
 install.sh  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/install.ps1 b/install.ps1
index a6a0af5c..a084ff0e 100644
--- a/install.ps1
+++ b/install.ps1
@@ -105,7 +105,7 @@ $os = 'windows'
 $Version = Resolve-OcrVersion $Repo
 $asset = "$AssetPrefix-$os-$arch.exe"
 if (-not [string]::IsNullOrWhiteSpace($env:GITHUB_MIRROR_DOMAIN_PREFIX)) {
-    Write-Host "WARNING: Using an official mirror domain, which may lead to SHA256 checksum mismatches and security risks."
+    Write-Host "WARNING: Using an unofficial mirror domain, which may lead to SHA256 checksum mismatches and security risks."
     $base = "https://$($env:GITHUB_MIRROR_DOMAIN_PREFIX.Trim())/github.com/$Repo/releases/download/$Version"
 } else {
     $base = "https://github.com/$Repo/releases/download/$Version"
diff --git a/install.sh b/install.sh
index bd6b3930..20e36caa 100755
--- a/install.sh
+++ b/install.sh
@@ -45,7 +45,7 @@ main() {
   asset="${ASSET_PREFIX}-${os}-${arch}"
   prefix="$(printf '%s' "${GITHUB_MIRROR_DOMAIN_PREFIX:-}" | tr -d '[:space:]')"
   if [ -n "$prefix" ]; then
-    echo "WARNING: Using an official mirror domain, which may lead to SHA256 checksum mismatches and security risks."
+    echo "WARNING: Using an unofficial mirror domain, which may lead to SHA256 checksum mismatches and security risks."
     base="https://${prefix}/github.com/$REPO/releases/download/$VERSION"
   else
     base="https://github.com/$REPO/releases/download/$VERSION"

From 7867106ddda0af5314620b12e60e26db1649c98f Mon Sep 17 00:00:00 2001
From: wu21-web <wu2196674@icloud.com>
Date: Thu, 13 Aug 2026 23:14:44 +0900
Subject: [PATCH 11/11] docs: update

fix naming
---
 install.ps1                               |  6 +++---
 install.sh                                |  4 ++--
 pages/src/content/docs/en/installation.md | 10 +++++-----
 pages/src/content/docs/ja/installation.md | 10 +++++-----
 pages/src/content/docs/ru/installation.md | 10 +++++-----
 pages/src/content/docs/zh/installation.md | 10 +++++-----
 6 files changed, 25 insertions(+), 25 deletions(-)

diff --git a/install.ps1 b/install.ps1
index a084ff0e..1075dc39 100644
--- a/install.ps1
+++ b/install.ps1
@@ -4,7 +4,7 @@
 #   irm https://raw.githubusercontent.com/alibaba/open-code-review/main/install.ps1 -OutFile install.ps1
 #   notepad install.ps1   # review, then: .\install.ps1
 # Env: OCR_INSTALL_DIR (default $env:LOCALAPPDATA\Programs\ocr), OCR_VERSION (default latest),
-# Set a GITHUB_MIRROR_DOMAIN_PREFIX to download assets through a mirror domain.
+# Set a GITHUB_MIRROR_DOMAIN to download assets through a mirror domain.
 # Requires PowerShell 5.1+ or PowerShell 7+.
 
 $ErrorActionPreference = 'Stop'
@@ -104,9 +104,9 @@ $arch = Get-OcrArch
 $os = 'windows'
 $Version = Resolve-OcrVersion $Repo
 $asset = "$AssetPrefix-$os-$arch.exe"
-if (-not [string]::IsNullOrWhiteSpace($env:GITHUB_MIRROR_DOMAIN_PREFIX)) {
+if (-not [string]::IsNullOrWhiteSpace($env:GITHUB_MIRROR_DOMAIN)) {
     Write-Host "WARNING: Using an unofficial mirror domain, which may lead to SHA256 checksum mismatches and security risks."
-    $base = "https://$($env:GITHUB_MIRROR_DOMAIN_PREFIX.Trim())/github.com/$Repo/releases/download/$Version"
+    $base = "https://$($env:GITHUB_MIRROR_DOMAIN.Trim())/github.com/$Repo/releases/download/$Version"
 } else {
     $base = "https://github.com/$Repo/releases/download/$Version"
 }
diff --git a/install.sh b/install.sh
index 20e36caa..117d4887 100755
--- a/install.sh
+++ b/install.sh
@@ -9,7 +9,7 @@
 #   curl -fsSL https://raw.githubusercontent.com/alibaba/open-code-review/main/install.sh -o install.sh
 #   less install.sh && sh install.sh
 # Env: OCR_INSTALL_DIR (default /usr/local/bin), OCR_VERSION (default latest),
-# Set a GITHUB_MIRROR_DOMAIN_PREFIX to download assets through a mirror domain.
+# Set a GITHUB_MIRROR_DOMAIN to download assets through a mirror domain.
 set -eu
 
 main() {
@@ -43,7 +43,7 @@ main() {
   fi
 
   asset="${ASSET_PREFIX}-${os}-${arch}"
-  prefix="$(printf '%s' "${GITHUB_MIRROR_DOMAIN_PREFIX:-}" | tr -d '[:space:]')"
+  prefix="$(printf '%s' "${GITHUB_MIRROR_DOMAIN:-}" | tr -d '[:space:]')"
   if [ -n "$prefix" ]; then
     echo "WARNING: Using an unofficial mirror domain, which may lead to SHA256 checksum mismatches and security risks."
     base="https://${prefix}/github.com/$REPO/releases/download/$VERSION"
diff --git a/pages/src/content/docs/en/installation.md b/pages/src/content/docs/en/installation.md
index 98909ea5..771931a4 100644
--- a/pages/src/content/docs/en/installation.md
+++ b/pages/src/content/docs/en/installation.md
@@ -81,7 +81,7 @@ curl -fsSL https://raw.githubusercontent.com/alibaba/open-code-review/main/insta
 
 __In some regions where network access to GitHub is slow, set a GitHub mirror domain to download assets through a mirror.__
 ```bash
-export GITHUB_MIRROR_DOMAIN_PREFIX='gh-proxy.com'
+export GITHUB_MIRROR_DOMAIN='YOUR_GITHUB_MIRROR_DOMAIN'
 ```
 
 > **Security note:** The mirror is a third-party service — both the binary and its `sha256sum.txt` are downloaded from the mirror, so a compromised mirror could serve a tampered binary with a matching checksum; the checksum check alone is not a guarantee. For security-critical installs, download directly from GitHub or verify against the upstream `sha256sum.txt` on the [releases page](https://github.com/alibaba/open-code-review/releases).
@@ -92,7 +92,7 @@ It honours three environment variables:
 |---|---|---|
 | `OCR_INSTALL_DIR` | `/usr/local/bin` | Where to place the `ocr` binary. |
 | `OCR_VERSION` | latest release | Pin a specific release tag (e.g. `v1.2.3`). |
-| `GITHUB_MIRROR_DOMAIN_PREFIX` | *(unset)* | Download release assets through a GitHub mirror domain (e.g. `gh-proxy.com`). |
+| `GITHUB_MIRROR_DOMAIN` | *(unset)* | Download release assets through a GitHub mirror domain (e.g. `gh-proxy.com`). |
 
 The script supports `darwin` and `linux` on `amd64` / `arm64`.
 
@@ -104,12 +104,12 @@ irm https://raw.githubusercontent.com/alibaba/open-code-review/main/install.ps1
 
 __To download through a mirror when GitHub access is slow, set the same mirror domain as a PowerShell environment variable:__
 ```powershell
-$env:GITHUB_MIRROR_DOMAIN_PREFIX = 'gh-proxy.com'
+$env:GITHUB_MIRROR_DOMAIN = 'YOUR_GITHUB_MIRROR_DOMAIN'
 ```
 
 It honours the same `OCR_INSTALL_DIR`, `OCR_VERSION`, and
-`GITHUB_MIRROR_DOMAIN_PREFIX` variables (set via `$env:OCR_INSTALL_DIR` /
-`$env:OCR_VERSION` / `$env:GITHUB_MIRROR_DOMAIN_PREFIX`). The default
+`GITHUB_MIRROR_DOMAIN` variables (set via `$env:OCR_INSTALL_DIR` /
+`$env:OCR_VERSION` / `$env:GITHUB_MIRROR_DOMAIN`). The default
 install location is `%LOCALAPPDATA%\Programs\ocr`.
 
 ## GitHub Release binary
diff --git a/pages/src/content/docs/ja/installation.md b/pages/src/content/docs/ja/installation.md
index 04177206..af112037 100644
--- a/pages/src/content/docs/ja/installation.md
+++ b/pages/src/content/docs/ja/installation.md
@@ -79,7 +79,7 @@ curl -fsSL https://raw.githubusercontent.com/alibaba/open-code-review/main/insta
 
 __一部の地域では GitHub へのネットワークアクセスが遅いため、GitHub ミラードメインを設定すると、ミラー経由でアセットをダウンロードできます。__
 ```bash
-export GITHUB_MIRROR_DOMAIN_PREFIX='gh-proxy.com'
+export GITHUB_MIRROR_DOMAIN='YOUR_GITHUB_MIRROR_DOMAIN'
 ```
 
 > **セキュリティ上の注意：** ミラーは第三者のサービスです。バイナリと `sha256sum.txt` の両方がミラーから取得されるため、侵害されたミラーは改ざんされたバイナリと一致するチェックサムを配信する可能性があり、チェックサム検証だけでは安全性を保証できません。セキュリティが重要なインストールでは、GitHub から直接ダウンロードするか、[releases ページ](https://github.com/alibaba/open-code-review/releases) のアップストリームの `sha256sum.txt` で検証してください。
@@ -90,7 +90,7 @@ export GITHUB_MIRROR_DOMAIN_PREFIX='gh-proxy.com'
 |---|---|---|
 | `OCR_INSTALL_DIR` | `/usr/local/bin` | `ocr` バイナリを配置する場所。 |
 | `OCR_VERSION` | 最新 release | 特定の release tag に固定します（例：`v1.2.3`）。 |
-| `GITHUB_MIRROR_DOMAIN_PREFIX` | （未設定） | GitHub ミラードメイン経由でリリースアセットをダウンロードします（例：`gh-proxy.com`）。 |
+| `GITHUB_MIRROR_DOMAIN` | （未設定） | GitHub ミラードメイン経由でリリースアセットをダウンロードします（例：`gh-proxy.com`）。 |
 
 このスクリプトは `darwin` と `linux` の `amd64` / `arm64` をサポートします。
 
@@ -102,12 +102,12 @@ irm https://raw.githubusercontent.com/alibaba/open-code-review/main/install.ps1
 
 __GitHub へのアクセスが遅い場合は、同じミラードメインを PowerShell の環境変数として設定すると、ミラー経由でダウンロードできます：__
 ```powershell
-$env:GITHUB_MIRROR_DOMAIN_PREFIX = 'gh-proxy.com'
+$env:GITHUB_MIRROR_DOMAIN = 'YOUR_GITHUB_MIRROR_DOMAIN'
 ```
 
-同じ `OCR_INSTALL_DIR`、`OCR_VERSION`、`GITHUB_MIRROR_DOMAIN_PREFIX` を認識します
+同じ `OCR_INSTALL_DIR`、`OCR_VERSION`、`GITHUB_MIRROR_DOMAIN` を認識します
 （`$env:OCR_INSTALL_DIR` / `$env:OCR_VERSION` /
-`$env:GITHUB_MIRROR_DOMAIN_PREFIX` で設定）。デフォルトのインストール先は
+`$env:GITHUB_MIRROR_DOMAIN` で設定）。デフォルトのインストール先は
 `%LOCALAPPDATA%\Programs\ocr` です。
 
 ## GitHub Release バイナリ
diff --git a/pages/src/content/docs/ru/installation.md b/pages/src/content/docs/ru/installation.md
index 249e7b8b..e0ca39de 100644
--- a/pages/src/content/docs/ru/installation.md
+++ b/pages/src/content/docs/ru/installation.md
@@ -79,7 +79,7 @@ curl -fsSL https://raw.githubusercontent.com/alibaba/open-code-review/main/insta
 
 __В некоторых регионах доступ к GitHub может быть медленным. В этом случае задайте домен зеркала GitHub, чтобы загружать артефакты через него.__
 ```bash
-export GITHUB_MIRROR_DOMAIN_PREFIX='gh-proxy.com'
+export GITHUB_MIRROR_DOMAIN='YOUR_GITHUB_MIRROR_DOMAIN'
 ```
 
 > **Примечание по безопасности:** Зеркало — это сторонний сервис. Поскольку и бинарник, и `sha256sum.txt` загружаются с зеркала, скомпрометированное зеркало может отдать подменённый бинарник вместе с подходящей контрольной суммой — проверка контрольной суммы сама по себе не является гарантией безопасности. Для установок с высокими требованиями к безопасности скачивайте напрямую с GitHub или сверяйтесь с оригинальным `sha256sum.txt` на [странице релизов](https://github.com/alibaba/open-code-review/releases).
@@ -90,7 +90,7 @@ export GITHUB_MIRROR_DOMAIN_PREFIX='gh-proxy.com'
 |---|---|---|
 | `OCR_INSTALL_DIR` | `/usr/local/bin` | Куда положить бинарник `ocr`. |
 | `OCR_VERSION` | последний релиз | Закрепить конкретный тег релиза (например `v1.2.3`). |
-| `GITHUB_MIRROR_DOMAIN_PREFIX` | не задана | Скачивать артефакты релиза через зеркало GitHub (например `gh-proxy.com`). |
+| `GITHUB_MIRROR_DOMAIN` | не задана | Скачивать артефакты релиза через зеркало GitHub (например `gh-proxy.com`). |
 
 Скрипт поддерживает `darwin` и `linux` на `amd64` / `arm64`.
 
@@ -102,12 +102,12 @@ irm https://raw.githubusercontent.com/alibaba/open-code-review/main/install.ps1
 
 __Если доступ к GitHub медленный, задайте тот же домен зеркала как переменную окружения PowerShell, чтобы загружать файлы через него:__
 ```powershell
-$env:GITHUB_MIRROR_DOMAIN_PREFIX = 'gh-proxy.com'
+$env:GITHUB_MIRROR_DOMAIN = 'YOUR_GITHUB_MIRROR_DOMAIN'
 ```
 
 Установщик учитывает те же переменные `OCR_INSTALL_DIR`, `OCR_VERSION` и
-`GITHUB_MIRROR_DOMAIN_PREFIX` (через `$env:OCR_INSTALL_DIR` /
-`$env:OCR_VERSION` / `$env:GITHUB_MIRROR_DOMAIN_PREFIX`). По умолчанию файлы
+`GITHUB_MIRROR_DOMAIN` (через `$env:OCR_INSTALL_DIR` /
+`$env:OCR_VERSION` / `$env:GITHUB_MIRROR_DOMAIN`). По умолчанию файлы
 устанавливаются в `%LOCALAPPDATA%\Programs\ocr`.
 
 ## Бинарник из GitHub Release
diff --git a/pages/src/content/docs/zh/installation.md b/pages/src/content/docs/zh/installation.md
index 6872a3ed..27fa168d 100644
--- a/pages/src/content/docs/zh/installation.md
+++ b/pages/src/content/docs/zh/installation.md
@@ -77,7 +77,7 @@ curl -fsSL https://raw.githubusercontent.com/alibaba/open-code-review/main/insta
 
 __在部分网络访问 GitHub 较慢的地区，可以设置一个 GitHub 镜像域名，通过镜像下载资源。__
 ```bash
-export GITHUB_MIRROR_DOMAIN_PREFIX='gh-proxy.com'
+export GITHUB_MIRROR_DOMAIN='YOUR_GITHUB_MIRROR_DOMAIN'
 ```
 
 > **安全提示：** 镜像是第三方服务——二进制及其 `sha256sum.txt` 都来自镜像，因此被攻破的镜像可能同时提供被篡改的二进制与匹配的校验和，仅靠校验和校验并不能保证安全。对安全性要求较高的安装，请直接从 GitHub 下载，或对照 [releases 页面](https://github.com/alibaba/open-code-review/releases) 上的上游 `sha256sum.txt` 进行核对。
@@ -88,7 +88,7 @@ export GITHUB_MIRROR_DOMAIN_PREFIX='gh-proxy.com'
 |---|---|---|
 | `OCR_INSTALL_DIR` | `/usr/local/bin` | 放置 `ocr` 二进制的位置。 |
 | `OCR_VERSION` | 最新 release | 固定到某个 release tag（如 `v1.2.3`）。 |
-| `GITHUB_MIRROR_DOMAIN_PREFIX` | （未设置） | 通过 GitHub 镜像域名下载 release 资源（如 `gh-proxy.com`）。 |
+| `GITHUB_MIRROR_DOMAIN` | （未设置） | 通过 GitHub 镜像域名下载 release 资源（如 `gh-proxy.com`）。 |
 
 该脚本支持 `darwin` 与 `linux` 的 `amd64` / `arm64`。
 
@@ -100,12 +100,12 @@ irm https://raw.githubusercontent.com/alibaba/open-code-review/main/install.ps1
 
 __访问 GitHub 较慢时，同样可以将镜像域名设为 PowerShell 环境变量，通过镜像下载：__
 ```powershell
-$env:GITHUB_MIRROR_DOMAIN_PREFIX = 'gh-proxy.com'
+$env:GITHUB_MIRROR_DOMAIN = 'YOUR_GITHUB_MIRROR_DOMAIN'
 ```
 
-它同样识别 `OCR_INSTALL_DIR`、`OCR_VERSION` 与 `GITHUB_MIRROR_DOMAIN_PREFIX`
+它同样识别 `OCR_INSTALL_DIR`、`OCR_VERSION` 与 `GITHUB_MIRROR_DOMAIN`
 （通过 `$env:OCR_INSTALL_DIR` / `$env:OCR_VERSION` /
-`$env:GITHUB_MIRROR_DOMAIN_PREFIX` 设置）。默认安装位置为 `%LOCALAPPDATA%\Programs\ocr`。
+`$env:GITHUB_MIRROR_DOMAIN` 设置）。默认安装位置为 `%LOCALAPPDATA%\Programs\ocr`。
 
 ## GitHub Release 二进制