diff --git a/.fmf/version b/.fmf/version deleted file mode 100644 index d00491f..0000000 --- a/.fmf/version +++ /dev/null @@ -1 +0,0 @@ -1 diff --git a/.github/workflows/bundle.yml b/.github/workflows/bundle.yml deleted file mode 100644 index 439fbb7..0000000 --- a/.github/workflows/bundle.yml +++ /dev/null @@ -1,23 +0,0 @@ -name: Create bundles -on: - workflow_dispatch: - -jobs: - bundle: - runs-on: ubuntu-latest - steps: - - name: Checkout sources - uses: actions/checkout@v3 - - - name: Create bundles - run: | - ./create_bundles_in_container.sh - sha512sum *.tar.gz *.tar.xz | tee SHA512SUMS - - - name: Upload bundles - uses: actions/upload-artifact@v3 - with: - name: bundles - path: | - *.tar.* - SHA512SUMS diff --git a/.gitignore b/.gitignore index 9a01bf3..b3c93c5 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,12 @@ -/grafana-*.tar.gz -/grafana-*.tar.xz -/grafana-*.tar.xz.manifest -/grafana*/ -*.rpm +/grafana-6.1.4.tar.gz +/grafana_webpack-6.1.4.tar.gz +/grafana-6.1.6.tar.gz +/grafana_webpack-6.1.6.tar.gz +/grafana-6.2.2.tar.gz +/grafana_webpack-6.2.2.tar.gz +/grafana-6.2.5.tar.gz +/grafana_webpack-6.2.5.tar.gz +/grafana-6.3.4.tar.gz +/grafana_webpack-6.3.4.tar.gz +/grafana-6.3.6.tar.gz +/grafana_webpack-6.3.6.tar.gz diff --git a/0001-update-grafana-cli-script-with-distro-specific-paths.patch b/0001-update-grafana-cli-script-with-distro-specific-paths.patch deleted file mode 100644 index 837d0ff..0000000 --- a/0001-update-grafana-cli-script-with-distro-specific-paths.patch +++ /dev/null @@ -1,66 +0,0 @@ -From 1e47ea7adc316e2df3d0081c2c0ebe75ddd6bda0 Mon Sep 17 00:00:00 2001 -From: Andreas Gerstmayr -Date: Wed, 22 Jun 2022 16:57:52 +0200 -Subject: [PATCH] update grafana-cli script with distro-specific paths and - switch to grafana user - - -diff --git a/packaging/wrappers/grafana-cli b/packaging/wrappers/grafana-cli -index 7c6c46aef9..945714642b 100755 ---- a/packaging/wrappers/grafana-cli -+++ b/packaging/wrappers/grafana-cli -@@ -5,7 +5,7 @@ - # the system-wide Grafana configuration that was bundled with the package as we - # use the binary. - --DEFAULT=/etc/default/grafana -+DEFAULT=/etc/sysconfig/grafana-server - - GRAFANA_HOME="${GRAFANA_HOME:-/usr/share/grafana}" - -@@ -13,11 +13,12 @@ CONF_DIR=/etc/grafana - DATA_DIR=/var/lib/grafana - PLUGINS_DIR=/var/lib/grafana/plugins - LOG_DIR=/var/log/grafana -+LIBEXEC_DIR=/usr/libexec/grafana - - CONF_FILE=$CONF_DIR/grafana.ini - PROVISIONING_CFG_DIR=$CONF_DIR/provisioning - --EXECUTABLE="$GRAFANA_HOME/bin/grafana" -+EXECUTABLE=$LIBEXEC_DIR/grafana-cli - - if [ ! -x $EXECUTABLE ]; then - echo "$EXECUTABLE not installed or not executable" -@@ -29,14 +30,23 @@ if [ -f "$DEFAULT" ]; then - . "$DEFAULT" - fi - --OPTS="--homepath=${GRAFANA_HOME} \ -- --config=${CONF_FILE} \ -- --pluginsDir=${PLUGINS_DIR} \ -- --configOverrides='cfg:default.paths.provisioning=$PROVISIONING_CFG_DIR \ -- cfg:default.paths.data=${DATA_DIR} \ -- cfg:default.paths.logs=${LOG_DIR} \ -- cfg:default.paths.plugins=${PLUGINS_DIR}'" -+OPTS=("--homepath=${GRAFANA_HOME}" -+ "--config=${CONF_FILE}" -+ "--pluginsDir=${PLUGINS_DIR}" -+ "--configOverrides=cfg:default.paths.provisioning=$PROVISIONING_CFG_DIR \ -+ cfg:default.paths.data=${DATA_DIR} \ -+ cfg:default.paths.logs=${LOG_DIR} \ -+ cfg:default.paths.plugins=${PLUGINS_DIR}") - - CMD=cli - --eval $EXECUTABLE "$CMD" "$OPTS" "$@" -+if [ "$(id -u)" -eq 0 -o "$(id -g)" -eq 0 ]; then -+ cd "${GRAFANA_HOME}" -+ exec runuser -u "${GRAFANA_USER}" -- "$EXECUTABLE" "${OPTS[@]}" "$@" -+elif [ "$(id -u -n)" = "${GRAFANA_USER}" ]; then -+ cd "${GRAFANA_HOME}" -+ exec "$EXECUTABLE" "${OPTS[@]}" "$@" -+else -+ echo "$0: please run this script as user \"${GRAFANA_USER}\" or root." -+ exit 5 -+fi diff --git a/0002-add-manpages.patch b/0002-add-manpages.patch deleted file mode 100644 index a059e0a..0000000 --- a/0002-add-manpages.patch +++ /dev/null @@ -1,161 +0,0 @@ -From 5b6c18f715808f99c32550fc3b670fc5bf600f72 Mon Sep 17 00:00:00 2001 -From: Andreas Gerstmayr -Date: Wed, 22 Jun 2022 17:01:09 +0200 -Subject: [PATCH] add manpages - - -diff --git a/docs/man/man1/grafana-cli.1 b/docs/man/man1/grafana-cli.1 -new file mode 100644 -index 0000000000..39c0d5cee0 ---- /dev/null -+++ b/docs/man/man1/grafana-cli.1 -@@ -0,0 +1,63 @@ -+.TH GRAFANA "1" "September 2022" "Grafana cli version 9.0.9" "User Commands" -+.SH NAME -+grafana-cli \- command line administration for the Grafana metrics dashboard and graph editor -+.SH DESCRIPTION -+.SS "NAME:" -+.IP -+grafana-cli -+.SS "USAGE:" -+.IP -+\fBgrafana\-cli\fP [\fIglobal options\fP] \fIcommand\fP [\fIcommand options\fP] [\fIarguments\fP...] -+.SS "COMMANDS:" -+.TP -+plugins -+Manage plugins for grafana -+.TP -+admin -+Grafana admin commands -+.TP -+cue -+Cue validation commands -+.TP -+help, h -+Shows a list of commands or help for one command -+.SS "GLOBAL OPTIONS:" -+.TP -+\fB\-\-pluginsDir\fR value -+path to the grafana plugin directory (default: "/var/lib/grafana/plugins") [$GF_PLUGIN_DIR] -+.TP -+\fB\-\-repo\fR value -+url to the plugin repository (default: "https://grafana.com/api/plugins") [$GF_PLUGIN_REPO] -+.TP -+\fB\-\-pluginUrl\fR value -+Full url to the plugin zip file instead of downloading the plugin from grafana.com/api [$GF_PLUGIN_URL] -+.TP -+\fB\-\-insecure\fR -+Skip TLS verification (insecure) (default: false) -+.TP -+\fB\-\-debug\fR -+Enable debug logging (default: false) -+.TP -+\fB\-\-configOverrides\fR value -+Configuration options to override defaults as a string. e.g. cfg:default.paths.log=/dev/null -+.TP -+\fB\-\-homepath\fR value -+Path to Grafana install/home path, defaults to working directory -+.TP -+\fB\-\-config\fR value -+Path to config file -+.TP -+\fB\-\-help\fR, \fB\-h\fR -+show help -+.TP -+\fB\-\-version\fR, \fB\-v\fR -+print the version -+.SH "SEE ALSO" -+Additional documentation for -+.B grafana-cli -+is available on-line at -+.BR http://docs.grafana.org/administration/cli/ . -+The full documentation for -+.B Grafana -+is available on-line at -+.BR http://docs.grafana.org/ . -diff --git a/docs/man/man1/grafana-server.1 b/docs/man/man1/grafana-server.1 -new file mode 100644 -index 0000000000..683a2369cc ---- /dev/null -+++ b/docs/man/man1/grafana-server.1 -@@ -0,0 +1,80 @@ -+.TH VERSION "1" "September 2022" "Version 9.0.9" "User Commands" -+.SH NAME -+grafana-server \- back-end server for the Grafana metrics dashboard and graph editor -+.SH DESCRIPTION -+.B grafana-server -+is the back-end server for the Grafana metrics dashboard and graph editor. -+The -+.B grafana-server -+program should not normally be run from the command line, -+except when testing or for development purposes. -+Rather it should be managed by -+.BR systemd . -+After installing Grafana, the systemd service should be enabled and started as follows: -+.P -+.in 1i -+.B systemctl daemon-reload -+.br -+.B systemctl enable grafana-server.service -+.br -+.B systemctl start grafana-server.service -+.in -+.P -+.SH OPTIONS -+The -+.B grafana-server -+configuration is specified in -+.BR /etc/grafana/grafana.ini -+and is well documented with comments. -+The command-line options listed below override options of -+the same (or similar) name in the configuration file. -+.P -+.HP -+\fB\-config\fR string -+.IP -+path to config file -+.HP -+\fB\-homepath\fR string -+.IP -+path to grafana install/home path, defaults to working directory -+.HP -+\fB\-packaging\fR string -+.IP -+describes the way Grafana was installed (default "unknown") -+.HP -+\fB\-pidfile\fR string -+.IP -+path to pid file -+.HP -+\fB\-profile\fR -+.IP -+Turn on pprof profiling -+.HP -+\fB\-profile\-addr\fR string -+.IP -+Define custom address for profiling (default "localhost") -+.HP -+\fB\-profile\-port\fR uint -+.IP -+Define custom port for profiling (default 6060) -+.HP -+\fB\-tracing\fR -+.IP -+Turn on tracing -+.HP -+\fB\-tracing\-file\fR string -+.IP -+Define tracing output file (default "trace.out") -+.TP -+\fB\-v\fR -+.IP -+prints current version and exits -+.TP -+\fB\-vv\fR -+.IP -+prints current version, all dependencies and exits -+.SH "SEE ALSO" -+The full documentation for -+.B Grafana -+is available on-line at -+.BR http://docs.grafana.org/ . diff --git a/0003-update-default-configuration.patch b/0003-update-default-configuration.patch deleted file mode 100644 index dfe119b..0000000 --- a/0003-update-default-configuration.patch +++ /dev/null @@ -1,72 +0,0 @@ -From 026c4f235fd3bfc741304a5e12e13bd1c7b85eac Mon Sep 17 00:00:00 2001 -From: Andreas Gerstmayr -Date: Wed, 22 Jun 2022 17:05:48 +0200 -Subject: [PATCH] update default configuration - - -diff --git a/conf/defaults.ini b/conf/defaults.ini -index 9f7cf4a90b..e1e5468bfa 100644 ---- a/conf/defaults.ini -+++ b/conf/defaults.ini -@@ -240,7 +240,7 @@ user_agent = - # No ip addresses are being tracked, only simple counters to track - # running instances, dashboard and error counts. It is very helpful to us. - # Change this option to false to disable reporting. --reporting_enabled = true -+reporting_enabled = false - - # The name of the distributor of the Grafana instance. Ex hosted-grafana, grafana-labs - reporting_distributor = grafana-labs -@@ -249,8 +249,8 @@ reporting_distributor = grafana-labs - # for new versions of grafana. The check is used - # in some UI views to notify that a grafana update exists. - # This option does not cause any auto updates, nor send any information --# only a GET request to https://grafana.com/api/grafana/versions/stable to get the latest version. --check_for_updates = true -+# only a GET request to https://raw.githubusercontent.com/grafana/grafana/main/latest.json to get the latest version. -+check_for_updates = false - - # Set to false to disable all checks to https://grafana.com - # for new versions of plugins. The check is used -diff --git a/conf/sample.ini b/conf/sample.ini -index 916de769f9..2f270d4940 100644 ---- a/conf/sample.ini -+++ b/conf/sample.ini -@@ -247,7 +247,7 @@ - # No ip addresses are being tracked, only simple counters to track - # running instances, dashboard and error counts. It is very helpful to us. - # Change this option to false to disable reporting. --;reporting_enabled = true -+;reporting_enabled = false - - # The name of the distributor of the Grafana instance. Ex hosted-grafana, grafana-labs - ;reporting_distributor = grafana-labs -@@ -256,8 +256,8 @@ - # for new versions of grafana. The check is used - # in some UI views to notify that a grafana update exists. - # This option does not cause any auto updates, nor send any information --# only a GET request to https://grafana.com/api/grafana/versions/stable to get the latest version. --;check_for_updates = true -+# only a GET request to https://raw.githubusercontent.com/grafana/grafana/main/latest.json to get the latest version. -+;check_for_updates = false - - # Set to false to disable all checks to https://grafana.com - # for new versions of plugins. The check is used -@@ -427,7 +427,7 @@ - - # Minimum dashboard refresh interval. When set, this will restrict users to set the refresh interval of a dashboard lower than given interval. Per default this is 5 seconds. - # The interval string is a possibly signed sequence of decimal numbers, followed by a unit suffix (ms, s, m, h, d), e.g. 30s or 1m. --;min_refresh_interval = 5s -+min_refresh_interval = 1s - - # Path to the default home dashboard. If this value is empty, then Grafana uses StaticRootPath + "dashboards/home.json" - ;default_home_dashboard_path = -@@ -1411,7 +1411,7 @@ - ;enable_alpha = false - ;app_tls_skip_verify_insecure = false - # Enter a comma-separated list of plugin identifiers to identify plugins to load even if they are unsigned. Plugins with modified signatures are never loaded. --;allow_loading_unsigned_plugins = -+allow_loading_unsigned_plugins = performancecopilot-pcp-app,pcp-valkey-datasource,pcp-vector-datasource,pcp-bpftrace-datasource,pcp-flamegraph-panel,pcp-breadcrumbs-panel,pcp-troubleshooting-panel,performancecopilot-valkey-datasource,performancecopilot-vector-datasource,performancecopilot-bpftrace-datasource,performancecopilot-flamegraph-panel,performancecopilot-breadcrumbs-panel,performancecopilot-troubleshooting-panel - # Enable or disable installing / uninstalling / updating plugins directly from within Grafana. - ;plugin_admin_enabled = false - ;plugin_admin_external_manage_enabled = false diff --git a/0004-remove-unused-backend-dependencies.patch b/0004-remove-unused-backend-dependencies.patch deleted file mode 100644 index 1569748..0000000 --- a/0004-remove-unused-backend-dependencies.patch +++ /dev/null @@ -1,62 +0,0 @@ -From 076177ff583b8e6d92948e0a4ddde0e8992d09a3 Mon Sep 17 00:00:00 2001 -From: Andreas Gerstmayr -Date: Wed, 22 Jun 2022 17:18:56 +0200 -Subject: [PATCH] remove unused backend dependencies - -saml and gofpdf are not used in the OSS edition of Grafana -after editing `pkg/extensions/main.go`, run `go mod tidy` - -diff --git a/go.mod b/go.mod -index fcbc09da5e..82fdf39842 100644 ---- a/go.mod -+++ b/go.mod -@@ -45,7 +45,6 @@ require ( - github.com/blang/semver/v4 v4.0.0 // @grafana/grafana-release-guild - github.com/bradfitz/gomemcache v0.0.0-20190913173617-a41fca850d0b // @grafana/backend-platform - github.com/centrifugal/centrifuge v0.30.2 // @grafana/grafana-app-platform-squad -- github.com/crewjam/saml v0.4.13 // @grafana/grafana-authnz-team - github.com/fatih/color v1.15.0 // @grafana/backend-platform - github.com/gchaincl/sqlhooks v1.3.0 // @grafana/backend-platform - github.com/go-ldap/ldap/v3 v3.4.4 // @grafana/grafana-authnz-team -@@ -187,7 +186,6 @@ require ( - github.com/josharian/intern v1.0.0 // indirect - github.com/jpillora/backoff v1.0.0 // indirect - github.com/mailru/easyjson v0.7.7 // indirect -- github.com/mattermost/xml-roundtrip-validator v0.1.0 // indirect - github.com/mattetti/filebuffer v1.0.1 // indirect - github.com/mattn/go-runewidth v0.0.13 // indirect - github.com/miekg/dns v1.1.51 // indirect -diff --git a/go.sum b/go.sum -index d05dfb55fd..b160387abe 100644 ---- a/go.sum -+++ b/go.sum -@@ -1826,8 +1826,6 @@ github.com/grafana/pyroscope/api v0.3.0/go.mod h1:JggA80ToAAUACYGfwL49XoFk5aN5ec - github.com/grafana/regexp v0.0.0-20221122212121-6b5c0a4cb7fd/go.mod h1:M5qHK+eWfAv8VR/265dIuEpL3fNfeC21tXXp9itM24A= - github.com/grafana/regexp v0.0.0-20221123153739-15dc172cd2db h1:7aN5cccjIqCLTzedH7MZzRZt5/lsAHch6Z3L2ZGn5FA= - github.com/grafana/regexp v0.0.0-20221123153739-15dc172cd2db/go.mod h1:M5qHK+eWfAv8VR/265dIuEpL3fNfeC21tXXp9itM24A= --github.com/grafana/saml v0.4.15-0.20231025143828-a6c0e9b86a4c h1:1pHLC1ZTz7N5QI3jzCs5sqmVvAKe+JwGnpp9lQ+iUjY= --github.com/grafana/saml v0.4.15-0.20231025143828-a6c0e9b86a4c/go.mod h1:S4+611dxnKt8z/ulbvaJzcgSHsuhjVc1QHNTcr1R7Fw= - github.com/grafana/sqlds/v2 v2.3.10 h1:HWKhE0vR6LoEiE+Is8CSZOgaB//D1yqb2ntkass9Fd4= - github.com/grafana/sqlds/v2 v2.3.10/go.mod h1:c6ibxnxRVGxV/0YkEgvy7QpQH/lyifFyV7K/14xvdIs= - github.com/grafana/tempo v1.5.1-0.20230524121406-1dc1bfe7085b h1:mDlkqgTEJuK7vjPG44f3ZMtId5AAYLWHvBVbiGqIOOQ= -@@ -2222,8 +2220,6 @@ github.com/markbates/sigtx v1.0.0/go.mod h1:QF1Hv6Ic6Ca6W+T+DL0Y/ypborFKyvUY9Hmu - github.com/markbates/willie v1.0.9/go.mod h1:fsrFVWl91+gXpx/6dv715j7i11fYPfZ9ZGfH0DQzY7w= - github.com/matryer/is v1.4.0 h1:sosSmIWwkYITGrxZ25ULNDeKiMNzFSr4V/eqBQP0PeE= - github.com/matryer/is v1.4.0/go.mod h1:8I/i5uYgLzgsgEloJE1U6xx5HkBQpAZvepWuujKwMRU= --github.com/mattermost/xml-roundtrip-validator v0.1.0 h1:RXbVD2UAl7A7nOTR4u7E3ILa4IbtvKBHw64LDsmu9hU= --github.com/mattermost/xml-roundtrip-validator v0.1.0/go.mod h1:qccnGMcpgwcNaBnxqpJpWWUiPNr5H3O8eDgGV9gT5To= - github.com/mattetti/filebuffer v1.0.1 h1:gG7pyfnSIZCxdoKq+cPa8T0hhYtD9NxCdI4D7PTjRLM= - github.com/mattetti/filebuffer v1.0.1/go.mod h1:YdMURNDOttIiruleeVr6f56OrMc+MydEnTcXwtkxNVs= - github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU= -diff --git a/pkg/extensions/main.go b/pkg/extensions/main.go -index 327e208221..426aad2a21 100644 ---- a/pkg/extensions/main.go -+++ b/pkg/extensions/main.go -@@ -11,7 +11,6 @@ import ( - _ "github.com/beevik/etree" - _ "github.com/blugelabs/bluge" - _ "github.com/blugelabs/bluge_segment_api" -- _ "github.com/crewjam/saml" - _ "github.com/go-jose/go-jose/v3" - _ "github.com/gobwas/glob" - _ "github.com/googleapis/gax-go/v2" diff --git a/0005-remove-unused-frontend-crypto.patch b/0005-remove-unused-frontend-crypto.patch deleted file mode 100644 index 268eadb..0000000 --- a/0005-remove-unused-frontend-crypto.patch +++ /dev/null @@ -1,333 +0,0 @@ -From ddd615152004e0bc5985a574c05d31778351dfa3 Mon Sep 17 00:00:00 2001 -From: Andreas Gerstmayr -Date: Wed, 22 Jun 2022 17:36:47 +0200 -Subject: [PATCH] remove unused frontend crypto - -update `package.json` and then run `yarn install` to update the -`yarn.lock` lockfile - -diff --git a/package.json b/package.json -index 38deb6d7de..aad5e88bf0 100644 ---- a/package.json -+++ b/package.json -@@ -425,6 +425,9 @@ - "resolutions": { - "underscore": "1.13.6", - "@types/slate": "0.47.11", -+ "crypto-browserify": "https://registry.yarnpkg.com/@favware/skip-dependency/-/skip-dependency-1.1.3.tgz", -+ "selfsigned": "https://registry.yarnpkg.com/@favware/skip-dependency/-/skip-dependency-1.1.3.tgz", -+ "http-signature": "https://registry.yarnpkg.com/@favware/skip-dependency/-/skip-dependency-1.1.3.tgz", - "ngtemplate-loader/loader-utils": "^2.0.0", - "semver@~7.0.0": "7.5.4", - "semver@7.3.4": "7.5.4", -diff --git a/yarn.lock b/yarn.lock -index bf22ba52a1..1552ddc052 100644 ---- a/yarn.lock -+++ b/yarn.lock -@@ -10935,22 +10935,6 @@ __metadata: - languageName: node - linkType: hard - --"asn1@npm:~0.2.3": -- version: 0.2.6 -- resolution: "asn1@npm:0.2.6" -- dependencies: -- safer-buffer: "npm:~2.1.0" -- checksum: cf629291fee6c1a6f530549939433ebf32200d7849f38b810ff26ee74235e845c0c12b2ed0f1607ac17383d19b219b69cefa009b920dab57924c5c544e495078 -- languageName: node -- linkType: hard -- --"assert-plus@npm:1.0.0, assert-plus@npm:^1.0.0": -- version: 1.0.0 -- resolution: "assert-plus@npm:1.0.0" -- checksum: f4f991ae2df849cc678b1afba52d512a7cbf0d09613ba111e72255409ff9158550c775162a47b12d015d1b82b3c273e8e25df0e4783d3ddb008a293486d00a07 -- languageName: node -- linkType: hard -- - "assert@npm:2.0.0, assert@npm:^2.0.0": - version: 2.0.0 - resolution: "assert@npm:2.0.0" -@@ -11427,15 +11411,6 @@ __metadata: - languageName: node - linkType: hard - --"bcrypt-pbkdf@npm:^1.0.0": -- version: 1.0.2 -- resolution: "bcrypt-pbkdf@npm:1.0.2" -- dependencies: -- tweetnacl: "npm:^0.14.3" -- checksum: 13a4cde058250dbf1fa77a4f1b9a07d32ae2e3b9e28e88a0c7a1827835bc3482f3e478c4a0cfd4da6ff0c46dae07da1061123a995372b32cc563d9975f975404 -- languageName: node -- linkType: hard -- - "before-after-hook@npm:^2.2.0": - version: 2.2.2 - resolution: "before-after-hook@npm:2.2.2" -@@ -12929,13 +12904,6 @@ __metadata: - languageName: node - linkType: hard - --"core-util-is@npm:1.0.2": -- version: 1.0.2 -- resolution: "core-util-is@npm:1.0.2" -- checksum: d0f7587346b44a1fe6c269267e037dd34b4787191e473c3e685f507229d88561c40eb18872fabfff02977301815d474300b7bfbd15396c13c5377393f7e87ec3 -- languageName: node -- linkType: hard -- - "core-util-is@npm:~1.0.0": - version: 1.0.3 - resolution: "core-util-is@npm:1.0.3" -@@ -13857,15 +13825,6 @@ __metadata: - languageName: node - linkType: hard - --"dashdash@npm:^1.12.0": -- version: 1.14.1 -- resolution: "dashdash@npm:1.14.1" -- dependencies: -- assert-plus: "npm:^1.0.0" -- checksum: 137b287fa021201ce100cef772c8eeeaaafdd2aa7282864022acf3b873021e54cb809e9c060fa164840bf54ff72d00d6e2d8da1ee5a86d7200eeefa1123a8f7f -- languageName: node -- linkType: hard -- - "data-urls@npm:^3.0.2": - version: 3.0.2 - resolution: "data-urls@npm:3.0.2" -@@ -14573,16 +14532,6 @@ __metadata: - languageName: node - linkType: hard - --"ecc-jsbn@npm:~0.1.1": -- version: 0.1.2 -- resolution: "ecc-jsbn@npm:0.1.2" -- dependencies: -- jsbn: "npm:~0.1.0" -- safer-buffer: "npm:^2.1.0" -- checksum: d43591f2396196266e186e6d6928038cc11c76c3699a912cb9c13757060f7bbc7f17f47c4cb16168cdeacffc7965aef021142577e646fb3cb88810c15173eb57 -- languageName: node -- linkType: hard -- - "ee-first@npm:1.1.1": - version: 1.1.1 - resolution: "ee-first@npm:1.1.1" -@@ -15991,20 +15940,6 @@ __metadata: - languageName: node - linkType: hard - --"extsprintf@npm:1.3.0": -- version: 1.3.0 -- resolution: "extsprintf@npm:1.3.0" -- checksum: 26967d6c7ecbfb5bc5b7a6c43503dc5fafd9454802037e9fa1665e41f615da4ff5918bd6cb871a3beabed01a31eca1ccd0bdfb41231f50ad50d405a430f78377 -- languageName: node -- linkType: hard -- --"extsprintf@npm:^1.2.0": -- version: 1.4.1 -- resolution: "extsprintf@npm:1.4.1" -- checksum: bfd6d55f3c0c04d826fe0213264b383c03f32825af6b1ff777f3f2dc49467e599361993568d75b7b19a8ea1bb08c8e7cd8c3d87d179ced91bb0dcf81ca6938e0 -- languageName: node -- linkType: hard -- - "fast-deep-equal@npm:^3.1.1, fast-deep-equal@npm:^3.1.3": - version: 3.1.3 - resolution: "fast-deep-equal@npm:3.1.3" -@@ -16916,15 +16851,6 @@ __metadata: - languageName: node - linkType: hard - --"getpass@npm:^0.1.1": -- version: 0.1.7 -- resolution: "getpass@npm:0.1.7" -- dependencies: -- assert-plus: "npm:^1.0.0" -- checksum: ab18d55661db264e3eac6012c2d3daeafaab7a501c035ae0ccb193c3c23e9849c6e29b6ac762b9c2adae460266f925d55a3a2a3a3c8b94be2f222df94d70c046 -- languageName: node -- linkType: hard -- - "giget@npm:^1.0.0": - version: 1.1.2 - resolution: "giget@npm:1.1.2" -@@ -18263,25 +18189,10 @@ __metadata: - languageName: node - linkType: hard - --"http-signature@npm:~1.2.0": -- version: 1.2.0 -- resolution: "http-signature@npm:1.2.0" -- dependencies: -- assert-plus: "npm:^1.0.0" -- jsprim: "npm:^1.2.2" -- sshpk: "npm:^1.7.0" -- checksum: 2ff7112e6b0d8f08b382dfe705078c655501f2ddd76cf589d108445a9dd388a0a9be928c37108261519a7f53e6bbd1651048d74057b804807cce1ec49e87a95b -- languageName: node -- linkType: hard -- --"http-signature@npm:~1.3.6": -- version: 1.3.6 -- resolution: "http-signature@npm:1.3.6" -- dependencies: -- assert-plus: "npm:^1.0.0" -- jsprim: "npm:^2.0.2" -- sshpk: "npm:^1.14.1" -- checksum: 5f08e0c82174999da97114facb0d0d47e268d60b6fc10f92cb87b99d5ccccd36f79b9508c29dda0b4f4e3a1b2f7bcaf847e68ecd5da2f1fc465fcd1d054b7884 -+"http-signature@https://registry.yarnpkg.com/@favware/skip-dependency/-/skip-dependency-1.1.3.tgz": -+ version: 1.1.3 -+ resolution: "http-signature@https://registry.yarnpkg.com/@favware/skip-dependency/-/skip-dependency-1.1.3.tgz" -+ checksum: 78b64605540e2d25bede2d74ec9e7740ab9a466c9a562ae3a8ccc7e07e26e601a013859c94adf890679403cd337b9690f598d64bc4fbc1d2eaa2f27241ca08a1 - languageName: node - linkType: hard - -@@ -20609,13 +20520,6 @@ __metadata: - languageName: node - linkType: hard - --"jsbn@npm:~0.1.0": -- version: 0.1.1 -- resolution: "jsbn@npm:0.1.1" -- checksum: 5450133242845100e694f0ef9175f44c012691a9b770b2571e677314e6f70600abb10777cdfc9a0c6a9f2ac6d134577403633de73e2fcd0f97875a67744e2d14 -- languageName: node -- linkType: hard -- - "jscodeshift@npm:^0.14.0": - version: 0.14.0 - resolution: "jscodeshift@npm:0.14.0" -@@ -20767,13 +20671,6 @@ __metadata: - languageName: node - linkType: hard - --"json-schema@npm:0.4.0": -- version: 0.4.0 -- resolution: "json-schema@npm:0.4.0" -- checksum: 8b3b64eff4a807dc2a3045b104ed1b9335cd8d57aa74c58718f07f0f48b8baa3293b00af4dcfbdc9144c3aafea1e97982cc27cc8e150fc5d93c540649507a458 -- languageName: node -- linkType: hard -- - "json-source-map@npm:0.6.1": - version: 0.6.1 - resolution: "json-source-map@npm:0.6.1" -@@ -20886,30 +20783,6 @@ __metadata: - languageName: node - linkType: hard - --"jsprim@npm:^1.2.2": -- version: 1.4.2 -- resolution: "jsprim@npm:1.4.2" -- dependencies: -- assert-plus: "npm:1.0.0" -- extsprintf: "npm:1.3.0" -- json-schema: "npm:0.4.0" -- verror: "npm:1.10.0" -- checksum: df2bf234eab1b5078d01bcbff3553d50a243f7b5c10a169745efeda6344d62798bd1d85bcca6a8446f3b5d0495e989db45f9de8dae219f0f9796e70e0c776089 -- languageName: node -- linkType: hard -- --"jsprim@npm:^2.0.2": -- version: 2.0.2 -- resolution: "jsprim@npm:2.0.2" -- dependencies: -- assert-plus: "npm:1.0.0" -- extsprintf: "npm:1.3.0" -- json-schema: "npm:0.4.0" -- verror: "npm:1.10.0" -- checksum: fcfca5b55f83e1b8be5f932c71754bd37afd2611f81685abd05689e8ce718a91155ff7bd5b94c65ce483a787b5c43c6d0c18c1d2259fca5bb61a3f8ea2e29c0a -- languageName: node -- linkType: hard -- - "jsurl@npm:^0.1.5": - version: 0.1.5 - resolution: "jsurl@npm:0.1.5" -@@ -22734,7 +22607,7 @@ __metadata: - languageName: node - linkType: hard - --"node-forge@npm:^1, node-forge@npm:^1.3.1": -+"node-forge@npm:^1.3.1": - version: 1.3.1 - resolution: "node-forge@npm:1.3.1" - checksum: 05bab6868633bf9ad4c3b1dd50ec501c22ffd69f556cdf169a00998ca1d03e8107a6032ba013852f202035372021b845603aeccd7dfcb58cdb7430013b3daa8d -@@ -27151,7 +27024,7 @@ __metadata: - languageName: node - linkType: hard - --"safer-buffer@npm:>= 2.1.2 < 3, safer-buffer@npm:>= 2.1.2 < 3.0.0, safer-buffer@npm:^2.0.2, safer-buffer@npm:^2.1.0, safer-buffer@npm:~2.1.0": -+"safer-buffer@npm:>= 2.1.2 < 3, safer-buffer@npm:>= 2.1.2 < 3.0.0": - version: 2.1.2 - resolution: "safer-buffer@npm:2.1.2" - checksum: 7eaf7a0cf37cc27b42fb3ef6a9b1df6e93a1c6d98c6c6702b02fe262d5fcbd89db63320793b99b21cb5348097d0a53de81bd5f4e8b86e20cc9412e3f1cfb4e83 -@@ -27282,12 +27155,10 @@ __metadata: - languageName: node - linkType: hard - --"selfsigned@npm:^2.1.1": -- version: 2.1.1 -- resolution: "selfsigned@npm:2.1.1" -- dependencies: -- node-forge: "npm:^1" -- checksum: 6005206e0d005448274aceceaded5195b944f67a42b72d212a6169d2e5f4bdc87c15a3fe45732c544db8c7175702091aaf95403ad6632585294a6ec8cca63638 -+"selfsigned@https://registry.yarnpkg.com/@favware/skip-dependency/-/skip-dependency-1.1.3.tgz": -+ version: 1.1.3 -+ resolution: "selfsigned@https://registry.yarnpkg.com/@favware/skip-dependency/-/skip-dependency-1.1.3.tgz" -+ checksum: 4988a0dbdf123fb808194a6198f5951e2df711de6fd967d72a8876baccaa23d5c260efb8f1dbfbc5bf1f852e81f897ad09267908977ab94862867ef971a3d48d - languageName: node - linkType: hard - -@@ -28053,27 +27924,6 @@ __metadata: - languageName: node - linkType: hard - --"sshpk@npm:^1.14.1, sshpk@npm:^1.7.0": -- version: 1.17.0 -- resolution: "sshpk@npm:1.17.0" -- dependencies: -- asn1: "npm:~0.2.3" -- assert-plus: "npm:^1.0.0" -- bcrypt-pbkdf: "npm:^1.0.0" -- dashdash: "npm:^1.12.0" -- ecc-jsbn: "npm:~0.1.1" -- getpass: "npm:^0.1.1" -- jsbn: "npm:~0.1.0" -- safer-buffer: "npm:^2.0.2" -- tweetnacl: "npm:~0.14.0" -- bin: -- sshpk-conv: bin/sshpk-conv -- sshpk-sign: bin/sshpk-sign -- sshpk-verify: bin/sshpk-verify -- checksum: 668c2a279a6ce66fd739ce5684e37927dd75427cc020c828a208f85890a4c400705d4ba09f32fa44efca894339dc6931941664f6f6ba36dfa543de6d006cbe9c -- languageName: node -- linkType: hard -- - "ssri@npm:^10.0.0, ssri@npm:^10.0.1": - version: 10.0.5 - resolution: "ssri@npm:10.0.5" -@@ -29479,13 +29329,6 @@ __metadata: - languageName: node - linkType: hard - --"tweetnacl@npm:^0.14.3, tweetnacl@npm:~0.14.0": -- version: 0.14.5 -- resolution: "tweetnacl@npm:0.14.5" -- checksum: 04ee27901cde46c1c0a64b9584e04c96c5fe45b38c0d74930710751ea991408b405747d01dfae72f80fc158137018aea94f9c38c651cb9c318f0861a310c3679 -- languageName: node -- linkType: hard -- - "type-check@npm:^0.4.0, type-check@npm:~0.4.0": - version: 0.4.0 - resolution: "type-check@npm:0.4.0" -@@ -30199,17 +30042,6 @@ __metadata: - languageName: node - linkType: soft - --"verror@npm:1.10.0": -- version: 1.10.0 -- resolution: "verror@npm:1.10.0" -- dependencies: -- assert-plus: "npm:^1.0.0" -- core-util-is: "npm:1.0.2" -- extsprintf: "npm:^1.2.0" -- checksum: da548149dd9c130a8a2587c9ee71ea30128d1526925707e2d01ed9c5c45c9e9f86733c66a328247cdd5f7c1516fb25b0f959ba754bfbe15072aa99ff96468a29 -- languageName: node -- linkType: hard -- - "vinyl-fs@npm:^3.0.2": - version: 3.0.3 - resolution: "vinyl-fs@npm:3.0.3" diff --git a/0006-skip-marketplace-plugin-install-test.patch b/0006-skip-marketplace-plugin-install-test.patch deleted file mode 100644 index 3180726..0000000 --- a/0006-skip-marketplace-plugin-install-test.patch +++ /dev/null @@ -1,21 +0,0 @@ -From ed8a438d72a667844ae07804491b568ad2f5dcdd Mon Sep 17 00:00:00 2001 -From: Andreas Gerstmayr -Date: Thu, 23 Jun 2022 17:00:46 +0200 -Subject: [PATCH] skip marketplace plugin install test - -This test (tries to) install a plugin from the Grafana marketplace. -Network connectivity is disabled in the build environment for security -reasons, therefore we need to disable this test. - -diff --git a/pkg/tests/api/plugins/api_plugins_test.go b/pkg/tests/api/plugins/api_plugins_test.go -index 4fc2295ed8..a326c40b04 100644 ---- a/pkg/tests/api/plugins/api_plugins_test.go -+++ b/pkg/tests/api/plugins/api_plugins_test.go -@@ -71,6 +71,7 @@ func TestIntegrationPlugins(t *testing.T) { - }) - - t.Run("Request is not forbidden if from an admin", func(t *testing.T) { -+ t.Skip("this test requires connectivity to the Grafana plugin marketplace (fetching metadata)") - statusCode, body := makePostRequest(t, grafanaAPIURL(usernameAdmin, grafanaListedAddr, "plugins/test/install")) - - assert.Equal(t, 404, statusCode) diff --git a/0007-redact-weak-ciphers.patch b/0007-redact-weak-ciphers.patch deleted file mode 100644 index 1b7148a..0000000 --- a/0007-redact-weak-ciphers.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 7ac26d6beb2175f0d6001ca0df322ce610401cce Mon Sep 17 00:00:00 2001 -From: Stan Cox -Date: Wed, 22 Jun 2022 17:05:48 +0200 -Subject: [PATCH] redact weak ciphers - - -diff --git a/pkg/api/http_server.go b/pkg/api/http_server.go -index da04044683..8a29270d4d 100644 ---- a/pkg/api/http_server.go -+++ b/pkg/api/http_server.go -@@ -820,13 +820,13 @@ func (hs *HTTPServer) getDefaultCiphers(tlsVersion uint16, protocol string) []ui - tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, - tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, - tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, -- tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, -+ // tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, - tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, -- tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, -- tls.TLS_RSA_WITH_AES_128_GCM_SHA256, -- tls.TLS_RSA_WITH_AES_256_GCM_SHA384, -- tls.TLS_RSA_WITH_AES_128_CBC_SHA, -- tls.TLS_RSA_WITH_AES_256_CBC_SHA, -+ // tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, -+ // tls.TLS_RSA_WITH_AES_128_GCM_SHA256, -+ // tls.TLS_RSA_WITH_AES_256_GCM_SHA384, -+ // tls.TLS_RSA_WITH_AES_128_CBC_SHA, -+ // tls.TLS_RSA_WITH_AES_256_CBC_SHA, - } - } - if protocol == "h2" { diff --git a/0008-replace-faulty-slices-sort.patch b/0008-replace-faulty-slices-sort.patch deleted file mode 100644 index b9cea8c..0000000 --- a/0008-replace-faulty-slices-sort.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 3f45f26993ed94837001bb9760d7859e7a057649 Mon Sep 17 00:00:00 2001 -From: Sam Feifer -Date: Fri, 1 Mar 2024 15:00:55 -0500 -Subject: [PATCH] replace faulty slices sort - - -diff --git a/pkg/services/sqlstore/migrator/dialect.go b/pkg/services/sqlstore/migrator/dialect.go -index 183b619de8..da21edeafa 100644 ---- a/pkg/services/sqlstore/migrator/dialect.go -+++ b/pkg/services/sqlstore/migrator/dialect.go -@@ -368,7 +368,8 @@ func (b *BaseDialect) InsertQuery(tableName string, row map[string]any) (string, - for col := range row { - keys = append(keys, col) - } -- slices.Sort[string](keys) -+ slices.Sort(keys) -+ //slices.Sort[string](keys) - - // build query and values - for _, col := range keys { -@@ -398,7 +399,8 @@ func (b *BaseDialect) UpdateQuery(tableName string, row map[string]any, where ma - for col := range row { - keys = append(keys, col) - } -- slices.Sort[string](keys) -+ slices.Sort(keys) -+ //slices.Sort[string](keys) - - // build update query and values - for _, col := range keys { -@@ -411,7 +413,8 @@ func (b *BaseDialect) UpdateQuery(tableName string, row map[string]any, where ma - for col := range where { - keys = append(keys, col) - } -- slices.Sort[string](keys) -+ slices.Sort(keys) -+ //slices.Sort[string](keys) - - // build where clause and values - for _, col := range keys { diff --git a/0009-update-wrappers-and-systemd-with-distro-paths.patch b/0009-update-wrappers-and-systemd-with-distro-paths.patch deleted file mode 100644 index 5331ddf..0000000 --- a/0009-update-wrappers-and-systemd-with-distro-paths.patch +++ /dev/null @@ -1,76 +0,0 @@ -From 5fe02f961e67af04907dc57beda42456128ab1c8 Mon Sep 17 00:00:00 2001 -From: Sam Feifer -Date: Fri, 1 Mar 2024 15:05:24 -0500 -Subject: [PATCH] update wrappers and systemd with distro paths - - -diff --git a/packaging/rpm/systemd/grafana-server.service b/packaging/rpm/systemd/grafana-server.service -index e3adc3f469..b2e4aced06 100644 ---- a/packaging/rpm/systemd/grafana-server.service -+++ b/packaging/rpm/systemd/grafana-server.service -@@ -14,7 +14,7 @@ Restart=on-failure - WorkingDirectory=/usr/share/grafana - RuntimeDirectory=grafana - RuntimeDirectoryMode=0750 --ExecStart=/usr/share/grafana/bin/grafana server \ -+ExecStart=/usr/sbin/grafana server \ - --config=${CONF_FILE} \ - --pidfile=${PID_FILE_DIR}/grafana-server.pid \ - --packaging=rpm \ -diff --git a/packaging/wrappers/grafana b/packaging/wrappers/grafana -index 86e0fc9faa..5c88bae4c3 100755 ---- a/packaging/wrappers/grafana -+++ b/packaging/wrappers/grafana -@@ -5,7 +5,7 @@ - # the system-wide Grafana configuration that was bundled with the package as we - # use the binary. - --DEFAULT=/etc/default/grafana -+DEFAULT=/etc/sysconfig/grafana-server - - GRAFANA_HOME="${GRAFANA_HOME:-/usr/share/grafana}" - -@@ -13,11 +13,12 @@ CONF_DIR=/etc/grafana - DATA_DIR=/var/lib/grafana - PLUGINS_DIR=/var/lib/grafana/plugins - LOG_DIR=/var/log/grafana -++LIBEXEC_DIR=/usr/libexec/grafana - - CONF_FILE=$CONF_DIR/grafana.ini - PROVISIONING_CFG_DIR=$CONF_DIR/provisioning - --EXECUTABLE="$GRAFANA_HOME/bin/grafana" -++EXECUTABLE=$LIBEXEC_DIR/grafana - - if [ ! -x $EXECUTABLE ]; then - echo "$EXECUTABLE not installed or not executable" -@@ -46,4 +47,13 @@ if [ "$CMD" = cli ]; then - --pluginsDir=${PLUGINS_DIR}" - fi - --eval $EXECUTABLE "$CMD" "$OPTS" "$@" -+if [ "$(id -u)" -eq 0 -o "$(id -g)" -eq 0 ]; then -+ cd "${GRAFANA_HOME}" -+ exec runuser -u "${GRAFANA_USER}" -- "$EXECUTABLE" "$CMD" "${OPTS[@]}" "$@" -+elif [ "$(id -u -n)" = "${GRAFANA_USER}" ]; then -+ cd "${GRAFANA_HOME}" -+ exec "$EXECUTABLE" "$CMD" "${OPTS[@]}" "$@" -+else -+ echo "$0: please run this script as user \"${GRAFANA_USER}\" or root." -+ exit 5 -+fi -\ No newline at end of file -diff --git a/packaging/wrappers/grafana-server b/packaging/wrappers/grafana-server -index 466b0d7c69..6be356f562 100755 ---- a/packaging/wrappers/grafana-server -+++ b/packaging/wrappers/grafana-server -@@ -7,7 +7,8 @@ - - GRAFANA_HOME="${GRAFANA_HOME:-/usr/share/grafana}" - --EXECUTABLE="$GRAFANA_HOME/bin/grafana" -+LIBEXEC_DIR=/usr/libexec/grafana -+EXECUTABLE=$LIBEXEC_DIR/grafana - - if [ ! -x $EXECUTABLE ]; then - echo "$EXECUTABLE not installed or not executable" diff --git a/001-login-oauth-use-oauth2-exchange.patch b/001-login-oauth-use-oauth2-exchange.patch new file mode 100644 index 0000000..ff59d44 --- /dev/null +++ b/001-login-oauth-use-oauth2-exchange.patch @@ -0,0 +1,13 @@ +diff --git a/pkg/api/login_oauth.go b/pkg/api/login_oauth.go +index a46c97238..76fc8480c 100644 +--- a/pkg/api/login_oauth.go ++++ b/pkg/api/login_oauth.go +@@ -125,7 +125,7 @@ func (hs *HTTPServer) OAuthLogin(ctx *m.ReqContext) { + oauthCtx := context.WithValue(context.Background(), oauth2.HTTPClient, oauthClient) + + // get token from provider +- token, err := connect.Exchange(oauthCtx, code) ++ token, err := connect.Exchange(oauthCtx, code, oauth2.AccessTypeOnline) + if err != nil { + ctx.Handle(500, "login.OAuthLogin(NewTransportWithCode)", err) + return diff --git a/0010-remove-bcrypt-references.patch b/0010-remove-bcrypt-references.patch deleted file mode 100644 index d617c85..0000000 --- a/0010-remove-bcrypt-references.patch +++ /dev/null @@ -1,108 +0,0 @@ -From eb711315d4c8a81ff52984293758a47372c21b8d Mon Sep 17 00:00:00 2001 -From: Sam Feifer -Date: Fri, 1 Mar 2024 15:07:22 -0500 -Subject: [PATCH] remove bcrypt references - - -diff --git a/pkg/services/extsvcauth/oauthserver/oasimpl/service.go b/pkg/services/extsvcauth/oauthserver/oasimpl/service.go -index 8c5a90248d..43f6d11e08 100644 ---- a/pkg/services/extsvcauth/oauthserver/oasimpl/service.go -+++ b/pkg/services/extsvcauth/oauthserver/oasimpl/service.go -@@ -19,7 +19,6 @@ import ( - "github.com/ory/fosite/compose" - "github.com/ory/fosite/storage" - "github.com/ory/fosite/token/jwt" -- "golang.org/x/crypto/bcrypt" - - "github.com/grafana/grafana/pkg/api/routing" - "github.com/grafana/grafana/pkg/bus" -@@ -235,88 +234,7 @@ func (s *OAuth2ServiceImpl) RemoveExternalService(ctx context.Context, name stri - // it ensures that the associated service account has the correct permissions. - // Database consistency is not guaranteed, consider changing this in the future. - func (s *OAuth2ServiceImpl) SaveExternalService(ctx context.Context, registration *extsvcauth.ExternalServiceRegistration) (*extsvcauth.ExternalService, error) { -- if registration == nil { -- s.logger.Warn("RegisterExternalService called without registration") -- return nil, nil -- } -- slug := registration.Name -- s.logger.Info("Registering external service", "external service", slug) -- -- // Check if the client already exists in store -- client, errFetchExtSvc := s.sqlstore.GetExternalServiceByName(ctx, slug) -- if errFetchExtSvc != nil && !errors.Is(errFetchExtSvc, oauthserver.ErrClientNotFound) { -- s.logger.Error("Error fetching service", "external service", slug, "error", errFetchExtSvc) -- return nil, errFetchExtSvc -- } -- // Otherwise, create a new client -- if client == nil { -- s.logger.Debug("External service does not yet exist", "external service", slug) -- client = &oauthserver.OAuthExternalService{ -- Name: slug, -- ServiceAccountID: oauthserver.NoServiceAccountID, -- Audiences: s.cfg.AppURL, -- } -- } -- -- // Parse registration form to compute required permissions for the client -- client.SelfPermissions, client.ImpersonatePermissions = s.handleRegistrationPermissions(registration) -- -- if registration.OAuthProviderCfg == nil { -- return nil, errors.New("missing oauth provider configuration") -- } -- -- if registration.OAuthProviderCfg.RedirectURI != nil { -- client.RedirectURI = *registration.OAuthProviderCfg.RedirectURI -- } -- -- var errGenCred error -- client.ClientID, client.Secret, errGenCred = s.genCredentials() -- if errGenCred != nil { -- s.logger.Error("Error generating credentials", "client", client.LogID(), "error", errGenCred) -- return nil, errGenCred -- } -- -- grantTypes := s.computeGrantTypes(registration.Self.Enabled, registration.Impersonation.Enabled) -- client.GrantTypes = strings.Join(grantTypes, ",") -- -- // Handle key options -- s.logger.Debug("Handle key options") -- keys, err := s.handleKeyOptions(ctx, registration.OAuthProviderCfg.Key) -- if err != nil { -- s.logger.Error("Error handling key options", "client", client.LogID(), "error", err) -- return nil, err -- } -- if keys != nil { -- client.PublicPem = []byte(keys.PublicPem) -- } -- dto := client.ToExternalService(keys) -- -- hashedSecret, err := bcrypt.GenerateFromPassword([]byte(client.Secret), bcrypt.DefaultCost) -- if err != nil { -- s.logger.Error("Error hashing secret", "client", client.LogID(), "error", err) -- return nil, err -- } -- client.Secret = string(hashedSecret) -- -- s.logger.Debug("Save service account") -- saID, errSaveServiceAccount := s.saService.ManageExtSvcAccount(ctx, &serviceaccounts.ManageExtSvcAccountCmd{ -- ExtSvcSlug: slugify.Slugify(client.Name), -- Enabled: registration.Self.Enabled, -- OrgID: oauthserver.TmpOrgID, -- Permissions: client.SelfPermissions, -- }) -- if errSaveServiceAccount != nil { -- return nil, errSaveServiceAccount -- } -- client.ServiceAccountID = saID -- -- err = s.sqlstore.SaveExternalService(ctx, client) -- if err != nil { -- s.logger.Error("Error saving external service", "client", client.LogID(), "error", err) -- return nil, err -- } -- s.logger.Debug("Registered", "client", client.LogID()) -- return dto, nil -+ panic("bcrypt cipher not available") - } - - // randString generates a a cryptographically secure random string of n bytes diff --git a/0011-fix-dompurify-CVE.patch b/0011-fix-dompurify-CVE.patch deleted file mode 100644 index 47f906e..0000000 --- a/0011-fix-dompurify-CVE.patch +++ /dev/null @@ -1,58 +0,0 @@ -From: Sam Feifer -Subject: [PATCH] fix dompurify CVE - -diff --git a/package.json b/package.json -index 38deb6d7dee..010a24fb451 100644 ---- a/package.json -+++ b/package.json -@@ -432,7 +432,8 @@ - "react-split-pane@0.1.92": "patch:react-split-pane@npm:0.1.92#.yarn/patches/react-split-pane-npm-0.1.92-93dbf51dff.patch", - "@storybook/blocks@7.4.5": "patch:@storybook/blocks@npm%3A7.4.5#./.yarn/patches/@storybook-blocks-npm-7.4.5-5a2374564a.patch", - "history@4.10.1": "patch:history@npm%3A4.10.1#./.yarn/patches/history-npm-4.10.1-ee217563ae.patch", -- "history@^4.9.0": "patch:history@npm%3A4.10.1#./.yarn/patches/history-npm-4.10.1-ee217563ae.patch" -+ "history@^4.9.0": "patch:history@npm%3A4.10.1#./.yarn/patches/history-npm-4.10.1-ee217563ae.patch", -+ "dompurify": "^2.5.0" - }, - "workspaces": { - "packages": [ -diff --git a/packages/grafana-data/package.json b/packages/grafana-data/package.json -index 2182744e61b..4201ef58dda 100644 ---- a/packages/grafana-data/package.json -+++ b/packages/grafana-data/package.json -@@ -41,7 +41,7 @@ - "@types/string-hash": "1.1.1", - "d3-interpolate": "3.0.1", - "date-fns": "2.30.0", -- "dompurify": "^2.4.3", -+ "dompurify": "^2.5.0", - "eventemitter3": "5.0.1", - "fast_array_intersect": "1.1.0", - "history": "4.10.1", -diff --git a/yarn.lock b/yarn.lock -index bf22ba52a17..88fc4d3fbfb 100644 ---- a/yarn.lock -+++ b/yarn.lock -@@ -2953,7 +2953,7 @@ __metadata: - "@types/tinycolor2": "npm:1.4.3" - d3-interpolate: "npm:3.0.1" - date-fns: "npm:2.30.0" -- dompurify: "npm:^2.4.3" -+ dompurify: "npm:^2.5.0" - esbuild: "npm:0.18.12" - eventemitter3: "npm:5.0.1" - fast_array_intersect: "npm:1.1.0" -@@ -14478,10 +14478,10 @@ __metadata: - languageName: node - linkType: hard - --"dompurify@npm:^2.2.0, dompurify@npm:^2.4.3": -- version: 2.4.5 -- resolution: "dompurify@npm:2.4.5" -- checksum: d764c2ff126b3749dad35bc34eed40f51141d7dfd620e938c92f08d68c32beeb259d06abadeee91f6e2a8c8737ce670e2124ac9a257ba3bcdc666598cebcde01 -+"dompurify@npm:^2.5.0": -+ version: 2.5.7 -+ resolution: "dompurify@npm:2.5.7" -+ checksum: b150ca1e28083252cd51097162dc96cb45203f7e2af1fbaa8ef32b4f4d6b605e4aa8915190d38bd0635cbbf14d13a200138cd3ec1b084096819b14c718355122 - languageName: node - linkType: hard - diff --git a/0012-fix-jwt-CVE.patch b/0012-fix-jwt-CVE.patch deleted file mode 100644 index a937bb1..0000000 --- a/0012-fix-jwt-CVE.patch +++ /dev/null @@ -1,31 +0,0 @@ -From: Sam Feifer -Subject: [PATCH] fix jwt CVE - -diff --git a/go.mod b/go.mod -index fcbc09da5e6..1771902bc1c 100644 ---- a/go.mod -+++ b/go.mod -@@ -164,7 +164,7 @@ require ( - github.com/go-openapi/spec v0.20.9 // indirect - github.com/go-openapi/swag v0.22.4 // indirect - github.com/go-openapi/validate v0.22.1 // indirect -- github.com/golang-jwt/jwt/v4 v4.5.0 // @grafana/backend-platform -+ github.com/golang-jwt/jwt/v4 v4.5.2 // @grafana/backend-platform - github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect - github.com/golang/glog v1.1.2 // indirect - github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect -diff --git a/go.sum b/go.sum -index d05dfb55fd4..3a045f712eb 100644 ---- a/go.sum -+++ b/go.sum -@@ -1593,8 +1593,9 @@ github.com/golang-jwt/jwt/v4 v4.0.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzw - github.com/golang-jwt/jwt/v4 v4.2.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg= - github.com/golang-jwt/jwt/v4 v4.4.1/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0= - github.com/golang-jwt/jwt/v4 v4.4.3/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0= --github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg= - github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0= -+github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI= -+github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0= - github.com/golang-migrate/migrate/v4 v4.7.0 h1:gONcHxHApDTKXDyLH/H97gEHmpu1zcnnbAaq2zgrPrs= - github.com/golang-migrate/migrate/v4 v4.7.0/go.mod h1:Qvut3N4xKWjoH3sokBccML6WyHSnggXm/DvMMnTsQIc= - github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0= diff --git a/0013-fix-CVE-2025-4123.patch b/0013-fix-CVE-2025-4123.patch deleted file mode 100644 index 5204e37..0000000 --- a/0013-fix-CVE-2025-4123.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 2d4314b5ca1e527a3420fad11d3f1a25351700d4 Mon Sep 17 00:00:00 2001 -From: Sam Feifer -Date: Wed, 7 May 2025 16:27:08 -0400 -Subject: [PATCH] fix CVE-2025-4123 - - -diff --git a/conf/defaults.ini b/conf/defaults.ini -index e1e5468bfa3..4221144bf54 100644 ---- a/conf/defaults.ini -+++ b/conf/defaults.ini -@@ -363,7 +363,7 @@ x_xss_protection = true - - # Enable adding the Content-Security-Policy header to your requests. - # CSP allows to control resources the user agent is allowed to load and helps prevent XSS attacks. --content_security_policy = false -+content_security_policy = true - - # Set Content Security Policy template used when adding the Content-Security-Policy header to your requests. - # $NONCE in the template includes a random nonce. -diff --git a/conf/sample.ini b/conf/sample.ini -index 51d2b6c512b..fd588b48225 100644 ---- a/conf/sample.ini -+++ b/conf/sample.ini -@@ -364,7 +364,7 @@ - - # Enable adding the Content-Security-Policy header to your requests. - # CSP allows to control resources the user agent is allowed to load and helps prevent XSS attacks. --;content_security_policy = false -+;content_security_policy = true - - # Set Content Security Policy template used when adding the Content-Security-Policy header to your requests. - # $NONCE in the template includes a random nonce. diff --git a/002-remove-jaeger-tracing.patch b/002-remove-jaeger-tracing.patch new file mode 100644 index 0000000..0d20b5e --- /dev/null +++ b/002-remove-jaeger-tracing.patch @@ -0,0 +1,208 @@ +diff --git a/pkg/cmd/grafana-server/server.go b/pkg/cmd/grafana-server/server.go +index 85d6db43e..6de99b58b 100644 +--- a/pkg/cmd/grafana-server/server.go ++++ b/pkg/cmd/grafana-server/server.go +@@ -23,7 +23,6 @@ import ( + _ "github.com/grafana/grafana/pkg/infra/metrics" + _ "github.com/grafana/grafana/pkg/infra/remotecache" + _ "github.com/grafana/grafana/pkg/infra/serverlock" +- _ "github.com/grafana/grafana/pkg/infra/tracing" + _ "github.com/grafana/grafana/pkg/infra/usagestats" + "github.com/grafana/grafana/pkg/login" + "github.com/grafana/grafana/pkg/login/social" +diff --git a/pkg/infra/tracing/tracing.go b/pkg/infra/tracing/tracing.go +deleted file mode 100644 +index d1511a533..000000000 +--- a/pkg/infra/tracing/tracing.go ++++ /dev/null +@@ -1,148 +0,0 @@ +-package tracing +- +-import ( +- "context" +- "fmt" +- "io" +- "strings" +- +- "github.com/grafana/grafana/pkg/infra/log" +- "github.com/grafana/grafana/pkg/registry" +- "github.com/grafana/grafana/pkg/setting" +- +- opentracing "github.com/opentracing/opentracing-go" +- jaegercfg "github.com/uber/jaeger-client-go/config" +- "github.com/uber/jaeger-client-go/zipkin" +-) +- +-func init() { +- registry.RegisterService(&TracingService{}) +-} +- +-type TracingService struct { +- enabled bool +- address string +- customTags map[string]string +- samplerType string +- samplerParam float64 +- log log.Logger +- closer io.Closer +- zipkinPropagation bool +- disableSharedZipkinSpans bool +- +- Cfg *setting.Cfg `inject:""` +-} +- +-func (ts *TracingService) Init() error { +- ts.log = log.New("tracing") +- ts.parseSettings() +- +- if ts.enabled { +- ts.initGlobalTracer() +- } +- +- return nil +-} +- +-func (ts *TracingService) parseSettings() { +- var section, err = ts.Cfg.Raw.GetSection("tracing.jaeger") +- if err != nil { +- return +- } +- +- ts.address = section.Key("address").MustString("") +- if ts.address != "" { +- ts.enabled = true +- } +- +- ts.customTags = splitTagSettings(section.Key("always_included_tag").MustString("")) +- ts.samplerType = section.Key("sampler_type").MustString("") +- ts.samplerParam = section.Key("sampler_param").MustFloat64(1) +- ts.zipkinPropagation = section.Key("zipkin_propagation").MustBool(false) +- ts.disableSharedZipkinSpans = section.Key("disable_shared_zipkin_spans").MustBool(false) +-} +- +-func (ts *TracingService) initGlobalTracer() error { +- cfg := jaegercfg.Configuration{ +- ServiceName: "grafana", +- Disabled: !ts.enabled, +- Sampler: &jaegercfg.SamplerConfig{ +- Type: ts.samplerType, +- Param: ts.samplerParam, +- }, +- Reporter: &jaegercfg.ReporterConfig{ +- LogSpans: false, +- LocalAgentHostPort: ts.address, +- }, +- } +- +- jLogger := &jaegerLogWrapper{logger: log.New("jaeger")} +- +- options := []jaegercfg.Option{} +- options = append(options, jaegercfg.Logger(jLogger)) +- +- for tag, value := range ts.customTags { +- options = append(options, jaegercfg.Tag(tag, value)) +- } +- +- if ts.zipkinPropagation { +- zipkinPropagator := zipkin.NewZipkinB3HTTPHeaderPropagator() +- options = append(options, +- jaegercfg.Injector(opentracing.HTTPHeaders, zipkinPropagator), +- jaegercfg.Extractor(opentracing.HTTPHeaders, zipkinPropagator), +- ) +- +- if !ts.disableSharedZipkinSpans { +- options = append(options, jaegercfg.ZipkinSharedRPCSpan(true)) +- } +- } +- +- tracer, closer, err := cfg.NewTracer(options...) +- if err != nil { +- return err +- } +- +- opentracing.InitGlobalTracer(tracer) +- +- ts.closer = closer +- +- return nil +-} +- +-func (ts *TracingService) Run(ctx context.Context) error { +- <-ctx.Done() +- +- if ts.closer != nil { +- ts.log.Info("Closing tracing") +- ts.closer.Close() +- } +- +- return nil +-} +- +-func splitTagSettings(input string) map[string]string { +- res := map[string]string{} +- +- tags := strings.Split(input, ",") +- for _, v := range tags { +- kv := strings.Split(v, ":") +- if len(kv) > 1 { +- res[kv[0]] = kv[1] +- } +- } +- +- return res +-} +- +-type jaegerLogWrapper struct { +- logger log.Logger +-} +- +-func (jlw *jaegerLogWrapper) Error(msg string) { +- jlw.logger.Error(msg) +-} +- +-func (jlw *jaegerLogWrapper) Infof(format string, args ...interface{}) { +- msg := fmt.Sprintf(format, args...) +- jlw.logger.Info(msg) +-} +diff --git a/pkg/infra/tracing/tracing_test.go b/pkg/infra/tracing/tracing_test.go +deleted file mode 100644 +index 27e4de777..000000000 +--- a/pkg/infra/tracing/tracing_test.go ++++ /dev/null +@@ -1,36 +0,0 @@ +-package tracing +- +-import "testing" +- +-func TestGroupSplit(t *testing.T) { +- tests := []struct { +- input string +- expected map[string]string +- }{ +- { +- input: "tag1:value1,tag2:value2", +- expected: map[string]string{ +- "tag1": "value1", +- "tag2": "value2", +- }, +- }, +- { +- input: "", +- expected: map[string]string{}, +- }, +- { +- input: "tag1", +- expected: map[string]string{}, +- }, +- } +- +- for _, test := range tests { +- tags := splitTagSettings(test.input) +- for k, v := range test.expected { +- value, exists := tags[k] +- if !exists || value != v { +- t.Errorf("tags does not match %v ", test) +- } +- } +- } +-} diff --git a/003-new-files.patch b/003-new-files.patch new file mode 100644 index 0000000..2cac75d --- /dev/null +++ b/003-new-files.patch @@ -0,0 +1,1762 @@ +diff --git a/conf/distro-defaults.ini b/conf/distro-defaults.ini +new file mode 100644 +index 0000000000..e337ba0b57 +--- /dev/null ++++ b/conf/distro-defaults.ini +@@ -0,0 +1,685 @@ ++##################### Grafana Configuration Defaults for distros ##################### ++# ++# Do not modify this file in grafana installs ++# ++ ++# possible values : production, development ++app_mode = production ++ ++# instance name, defaults to HOSTNAME environment variable value or hostname if HOSTNAME var is empty ++instance_name = ${HOSTNAME} ++ ++#################################### Paths ############################### ++[paths] ++# Path to where grafana can store temp files, sessions, and the sqlite3 db (if that is used) ++data = /var/lib/grafana ++ ++# Temporary files in `data` directory older than given duration will be removed ++temp_data_lifetime = 24h ++ ++# Directory where grafana can store logs ++logs = /var/log/grafana ++ ++# Directory where grafana will automatically scan and look for plugins ++plugins = /var/lib/grafana/plugins ++ ++# folder that contains provisioning config files that grafana will apply on startup and while running. ++provisioning = conf/provisioning ++ ++#################################### Server ############################## ++[server] ++# Protocol (http, https, socket) ++protocol = http ++ ++# The ip address to bind to, empty will bind to all interfaces ++http_addr = ++ ++# The http port to use ++http_port = 3000 ++ ++# The public facing domain name used to access grafana from a browser ++domain = localhost ++ ++# Redirect to correct domain if host header does not match domain ++# Prevents DNS rebinding attacks ++enforce_domain = false ++ ++# The full public facing url ++root_url = %(protocol)s://%(domain)s:%(http_port)s/ ++ ++# Serve Grafana from subpath specified in `root_url` setting. By default it is set to `false` for compatibility reasons. ++serve_from_sub_path = false ++ ++# Log web requests ++router_logging = false ++ ++# the path relative working path ++static_root_path = public ++ ++# enable gzip ++enable_gzip = false ++ ++# https certs & key file ++cert_file = ++cert_key = ++ ++# Unix socket path ++socket = /tmp/grafana.sock ++ ++#################################### Database ############################ ++[database] ++# You can configure the database connection by specifying type, host, name, user and password ++# as separate properties or as on string using the url property. ++ ++# Either "mysql", "postgres" or "sqlite3", it's your choice ++type = sqlite3 ++host = 127.0.0.1:3306 ++name = grafana ++user = root ++# If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;""" ++password = ++# Use either URL or the previous fields to configure the database ++# Example: mysql://user:secret@host:port/database ++url = ++ ++# Max idle conn setting default is 2 ++max_idle_conn = 2 ++ ++# Max conn setting default is 0 (mean not set) ++max_open_conn = ++ ++# Connection Max Lifetime default is 14400 (means 14400 seconds or 4 hours) ++conn_max_lifetime = 14400 ++ ++# Set to true to log the sql calls and execution times. ++log_queries = ++ ++# For "postgres", use either "disable", "require" or "verify-full" ++# For "mysql", use either "true", "false", or "skip-verify". ++ssl_mode = disable ++ ++ca_cert_path = ++client_key_path = ++client_cert_path = ++server_cert_name = ++ ++# For "sqlite3" only, path relative to data_path setting ++path = grafana.db ++ ++# For "sqlite3" only. cache mode setting used for connecting to the database ++cache_mode = private ++ ++#################################### Cache server ############################# ++[remote_cache] ++# Either "redis", "memcached" or "database" default is "database" ++type = database ++ ++# cache connectionstring options ++# database: will use Grafana primary database. ++# redis: config like redis server e.g. `addr=127.0.0.1:6379,pool_size=100,db=0`. Only addr is required. ++# memcache: 127.0.0.1:11211 ++connstr = ++ ++#################################### Data proxy ########################### ++[dataproxy] ++ ++# This enables data proxy logging, default is false ++logging = false ++ ++# How long the data proxy should wait before timing out default is 30 (seconds) ++timeout = 30 ++ ++# If enabled and user is not anonymous, data proxy will add X-Grafana-User header with username into the request, default is false. ++send_user_header = false ++ ++#################################### Analytics ########################### ++[analytics] ++# Server reporting, sends usage counters to stats.grafana.org every 24 hours. ++# No ip addresses are being tracked, only simple counters to track ++# running instances, dashboard and error counts. It is very helpful to us. ++# Change this option to false to disable reporting. ++reporting_enabled = false ++ ++# Set to false to disable all checks to https://grafana.com ++# for new versions (grafana itself and plugins), check is used ++# in some UI views to notify that grafana or plugin update exists ++# This option does not cause any auto updates, nor send any information ++# only a GET request to https://grafana.com to get latest versions ++check_for_updates = false ++ ++# Google Analytics universal tracking code, only enabled if you specify an id here ++google_analytics_ua_id = ++ ++# Google Tag Manager ID, only enabled if you specify an id here ++google_tag_manager_id = ++ ++#################################### Security ############################ ++[security] ++# default admin user, created on startup ++admin_user = admin ++ ++# default admin password, can be changed before first start of grafana, or in profile settings ++admin_password = admin ++ ++# used for signing ++secret_key = SW2YcwTIb9zpOOhoPsMm ++ ++# disable gravatar profile images ++disable_gravatar = false ++ ++# data source proxy whitelist (ip_or_domain:port separated by spaces) ++data_source_proxy_whitelist = ++ ++# disable protection against brute force login attempts ++disable_brute_force_login_protection = false ++ ++# set to true if you host Grafana behind HTTPS. default is false. ++cookie_secure = false ++ ++# set cookie SameSite attribute. defaults to `lax`. can be set to "lax", "strict" and "none" ++cookie_samesite = lax ++ ++# set to true if you want to allow browsers to render Grafana in a ,