diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/.github/workflows/bundle.yml b/.github/workflows/bundle.yml new file mode 100644 index 0000000..439fbb7 --- /dev/null +++ b/.github/workflows/bundle.yml @@ -0,0 +1,23 @@ +name: Create bundles +on: + workflow_dispatch: + +jobs: + bundle: + runs-on: ubuntu-latest + steps: + - name: Checkout sources + uses: actions/checkout@v3 + + - name: Create bundles + run: | + ./create_bundles_in_container.sh + sha512sum *.tar.gz *.tar.xz | tee SHA512SUMS + + - name: Upload bundles + uses: actions/upload-artifact@v3 + with: + name: bundles + path: | + *.tar.* + SHA512SUMS diff --git a/.gitignore b/.gitignore index a533fb5..9a01bf3 100644 --- a/.gitignore +++ b/.gitignore @@ -1,6 +1,5 @@ -/grafana-6.1.4.tar.gz -/grafana_webpack-6.1.4.tar.gz -/grafana-6.1.6.tar.gz -/grafana_webpack-6.1.6.tar.gz -/grafana-6.2.2.tar.gz -/grafana_webpack-6.2.2.tar.gz +/grafana-*.tar.gz +/grafana-*.tar.xz +/grafana-*.tar.xz.manifest +/grafana*/ +*.rpm diff --git a/0001-update-grafana-cli-script-with-distro-specific-paths.patch b/0001-update-grafana-cli-script-with-distro-specific-paths.patch new file mode 100644 index 0000000..837d0ff --- /dev/null +++ b/0001-update-grafana-cli-script-with-distro-specific-paths.patch @@ -0,0 +1,66 @@ +From 1e47ea7adc316e2df3d0081c2c0ebe75ddd6bda0 Mon Sep 17 00:00:00 2001 +From: Andreas Gerstmayr +Date: Wed, 22 Jun 2022 16:57:52 +0200 +Subject: [PATCH] update grafana-cli script with distro-specific paths and + switch to grafana user + + +diff --git a/packaging/wrappers/grafana-cli b/packaging/wrappers/grafana-cli +index 7c6c46aef9..945714642b 100755 +--- a/packaging/wrappers/grafana-cli ++++ b/packaging/wrappers/grafana-cli +@@ -5,7 +5,7 @@ + # the system-wide Grafana configuration that was bundled with the package as we + # use the binary. + +-DEFAULT=/etc/default/grafana ++DEFAULT=/etc/sysconfig/grafana-server + + GRAFANA_HOME="${GRAFANA_HOME:-/usr/share/grafana}" + +@@ -13,11 +13,12 @@ CONF_DIR=/etc/grafana + DATA_DIR=/var/lib/grafana + PLUGINS_DIR=/var/lib/grafana/plugins + LOG_DIR=/var/log/grafana ++LIBEXEC_DIR=/usr/libexec/grafana + + CONF_FILE=$CONF_DIR/grafana.ini + PROVISIONING_CFG_DIR=$CONF_DIR/provisioning + +-EXECUTABLE="$GRAFANA_HOME/bin/grafana" ++EXECUTABLE=$LIBEXEC_DIR/grafana-cli + + if [ ! -x $EXECUTABLE ]; then + echo "$EXECUTABLE not installed or not executable" +@@ -29,14 +30,23 @@ if [ -f "$DEFAULT" ]; then + . "$DEFAULT" + fi + +-OPTS="--homepath=${GRAFANA_HOME} \ +- --config=${CONF_FILE} \ +- --pluginsDir=${PLUGINS_DIR} \ +- --configOverrides='cfg:default.paths.provisioning=$PROVISIONING_CFG_DIR \ +- cfg:default.paths.data=${DATA_DIR} \ +- cfg:default.paths.logs=${LOG_DIR} \ +- cfg:default.paths.plugins=${PLUGINS_DIR}'" ++OPTS=("--homepath=${GRAFANA_HOME}" ++ "--config=${CONF_FILE}" ++ "--pluginsDir=${PLUGINS_DIR}" ++ "--configOverrides=cfg:default.paths.provisioning=$PROVISIONING_CFG_DIR \ ++ cfg:default.paths.data=${DATA_DIR} \ ++ cfg:default.paths.logs=${LOG_DIR} \ ++ cfg:default.paths.plugins=${PLUGINS_DIR}") + + CMD=cli + +-eval $EXECUTABLE "$CMD" "$OPTS" "$@" ++if [ "$(id -u)" -eq 0 -o "$(id -g)" -eq 0 ]; then ++ cd "${GRAFANA_HOME}" ++ exec runuser -u "${GRAFANA_USER}" -- "$EXECUTABLE" "${OPTS[@]}" "$@" ++elif [ "$(id -u -n)" = "${GRAFANA_USER}" ]; then ++ cd "${GRAFANA_HOME}" ++ exec "$EXECUTABLE" "${OPTS[@]}" "$@" ++else ++ echo "$0: please run this script as user \"${GRAFANA_USER}\" or root." ++ exit 5 ++fi diff --git a/0002-add-manpages.patch b/0002-add-manpages.patch new file mode 100644 index 0000000..a059e0a --- /dev/null +++ b/0002-add-manpages.patch @@ -0,0 +1,161 @@ +From 5b6c18f715808f99c32550fc3b670fc5bf600f72 Mon Sep 17 00:00:00 2001 +From: Andreas Gerstmayr +Date: Wed, 22 Jun 2022 17:01:09 +0200 +Subject: [PATCH] add manpages + + +diff --git a/docs/man/man1/grafana-cli.1 b/docs/man/man1/grafana-cli.1 +new file mode 100644 +index 0000000000..39c0d5cee0 +--- /dev/null ++++ b/docs/man/man1/grafana-cli.1 +@@ -0,0 +1,63 @@ ++.TH GRAFANA "1" "September 2022" "Grafana cli version 9.0.9" "User Commands" ++.SH NAME ++grafana-cli \- command line administration for the Grafana metrics dashboard and graph editor ++.SH DESCRIPTION ++.SS "NAME:" ++.IP ++grafana-cli ++.SS "USAGE:" ++.IP ++\fBgrafana\-cli\fP [\fIglobal options\fP] \fIcommand\fP [\fIcommand options\fP] [\fIarguments\fP...] ++.SS "COMMANDS:" ++.TP ++plugins ++Manage plugins for grafana ++.TP ++admin ++Grafana admin commands ++.TP ++cue ++Cue validation commands ++.TP ++help, h ++Shows a list of commands or help for one command ++.SS "GLOBAL OPTIONS:" ++.TP ++\fB\-\-pluginsDir\fR value ++path to the grafana plugin directory (default: "/var/lib/grafana/plugins") [$GF_PLUGIN_DIR] ++.TP ++\fB\-\-repo\fR value ++url to the plugin repository (default: "https://grafana.com/api/plugins") [$GF_PLUGIN_REPO] ++.TP ++\fB\-\-pluginUrl\fR value ++Full url to the plugin zip file instead of downloading the plugin from grafana.com/api [$GF_PLUGIN_URL] ++.TP ++\fB\-\-insecure\fR ++Skip TLS verification (insecure) (default: false) ++.TP ++\fB\-\-debug\fR ++Enable debug logging (default: false) ++.TP ++\fB\-\-configOverrides\fR value ++Configuration options to override defaults as a string. e.g. cfg:default.paths.log=/dev/null ++.TP ++\fB\-\-homepath\fR value ++Path to Grafana install/home path, defaults to working directory ++.TP ++\fB\-\-config\fR value ++Path to config file ++.TP ++\fB\-\-help\fR, \fB\-h\fR ++show help ++.TP ++\fB\-\-version\fR, \fB\-v\fR ++print the version ++.SH "SEE ALSO" ++Additional documentation for ++.B grafana-cli ++is available on-line at ++.BR http://docs.grafana.org/administration/cli/ . ++The full documentation for ++.B Grafana ++is available on-line at ++.BR http://docs.grafana.org/ . +diff --git a/docs/man/man1/grafana-server.1 b/docs/man/man1/grafana-server.1 +new file mode 100644 +index 0000000000..683a2369cc +--- /dev/null ++++ b/docs/man/man1/grafana-server.1 +@@ -0,0 +1,80 @@ ++.TH VERSION "1" "September 2022" "Version 9.0.9" "User Commands" ++.SH NAME ++grafana-server \- back-end server for the Grafana metrics dashboard and graph editor ++.SH DESCRIPTION ++.B grafana-server ++is the back-end server for the Grafana metrics dashboard and graph editor. ++The ++.B grafana-server ++program should not normally be run from the command line, ++except when testing or for development purposes. ++Rather it should be managed by ++.BR systemd . ++After installing Grafana, the systemd service should be enabled and started as follows: ++.P ++.in 1i ++.B systemctl daemon-reload ++.br ++.B systemctl enable grafana-server.service ++.br ++.B systemctl start grafana-server.service ++.in ++.P ++.SH OPTIONS ++The ++.B grafana-server ++configuration is specified in ++.BR /etc/grafana/grafana.ini ++and is well documented with comments. ++The command-line options listed below override options of ++the same (or similar) name in the configuration file. ++.P ++.HP ++\fB\-config\fR string ++.IP ++path to config file ++.HP ++\fB\-homepath\fR string ++.IP ++path to grafana install/home path, defaults to working directory ++.HP ++\fB\-packaging\fR string ++.IP ++describes the way Grafana was installed (default "unknown") ++.HP ++\fB\-pidfile\fR string ++.IP ++path to pid file ++.HP ++\fB\-profile\fR ++.IP ++Turn on pprof profiling ++.HP ++\fB\-profile\-addr\fR string ++.IP ++Define custom address for profiling (default "localhost") ++.HP ++\fB\-profile\-port\fR uint ++.IP ++Define custom port for profiling (default 6060) ++.HP ++\fB\-tracing\fR ++.IP ++Turn on tracing ++.HP ++\fB\-tracing\-file\fR string ++.IP ++Define tracing output file (default "trace.out") ++.TP ++\fB\-v\fR ++.IP ++prints current version and exits ++.TP ++\fB\-vv\fR ++.IP ++prints current version, all dependencies and exits ++.SH "SEE ALSO" ++The full documentation for ++.B Grafana ++is available on-line at ++.BR http://docs.grafana.org/ . diff --git a/0003-update-default-configuration.patch b/0003-update-default-configuration.patch new file mode 100644 index 0000000..dfe119b --- /dev/null +++ b/0003-update-default-configuration.patch @@ -0,0 +1,72 @@ +From 026c4f235fd3bfc741304a5e12e13bd1c7b85eac Mon Sep 17 00:00:00 2001 +From: Andreas Gerstmayr +Date: Wed, 22 Jun 2022 17:05:48 +0200 +Subject: [PATCH] update default configuration + + +diff --git a/conf/defaults.ini b/conf/defaults.ini +index 9f7cf4a90b..e1e5468bfa 100644 +--- a/conf/defaults.ini ++++ b/conf/defaults.ini +@@ -240,7 +240,7 @@ user_agent = + # No ip addresses are being tracked, only simple counters to track + # running instances, dashboard and error counts. It is very helpful to us. + # Change this option to false to disable reporting. +-reporting_enabled = true ++reporting_enabled = false + + # The name of the distributor of the Grafana instance. Ex hosted-grafana, grafana-labs + reporting_distributor = grafana-labs +@@ -249,8 +249,8 @@ reporting_distributor = grafana-labs + # for new versions of grafana. The check is used + # in some UI views to notify that a grafana update exists. + # This option does not cause any auto updates, nor send any information +-# only a GET request to https://grafana.com/api/grafana/versions/stable to get the latest version. +-check_for_updates = true ++# only a GET request to https://raw.githubusercontent.com/grafana/grafana/main/latest.json to get the latest version. ++check_for_updates = false + + # Set to false to disable all checks to https://grafana.com + # for new versions of plugins. The check is used +diff --git a/conf/sample.ini b/conf/sample.ini +index 916de769f9..2f270d4940 100644 +--- a/conf/sample.ini ++++ b/conf/sample.ini +@@ -247,7 +247,7 @@ + # No ip addresses are being tracked, only simple counters to track + # running instances, dashboard and error counts. It is very helpful to us. + # Change this option to false to disable reporting. +-;reporting_enabled = true ++;reporting_enabled = false + + # The name of the distributor of the Grafana instance. Ex hosted-grafana, grafana-labs + ;reporting_distributor = grafana-labs +@@ -256,8 +256,8 @@ + # for new versions of grafana. The check is used + # in some UI views to notify that a grafana update exists. + # This option does not cause any auto updates, nor send any information +-# only a GET request to https://grafana.com/api/grafana/versions/stable to get the latest version. +-;check_for_updates = true ++# only a GET request to https://raw.githubusercontent.com/grafana/grafana/main/latest.json to get the latest version. ++;check_for_updates = false + + # Set to false to disable all checks to https://grafana.com + # for new versions of plugins. The check is used +@@ -427,7 +427,7 @@ + + # Minimum dashboard refresh interval. When set, this will restrict users to set the refresh interval of a dashboard lower than given interval. Per default this is 5 seconds. + # The interval string is a possibly signed sequence of decimal numbers, followed by a unit suffix (ms, s, m, h, d), e.g. 30s or 1m. +-;min_refresh_interval = 5s ++min_refresh_interval = 1s + + # Path to the default home dashboard. If this value is empty, then Grafana uses StaticRootPath + "dashboards/home.json" + ;default_home_dashboard_path = +@@ -1411,7 +1411,7 @@ + ;enable_alpha = false + ;app_tls_skip_verify_insecure = false + # Enter a comma-separated list of plugin identifiers to identify plugins to load even if they are unsigned. Plugins with modified signatures are never loaded. +-;allow_loading_unsigned_plugins = ++allow_loading_unsigned_plugins = performancecopilot-pcp-app,pcp-valkey-datasource,pcp-vector-datasource,pcp-bpftrace-datasource,pcp-flamegraph-panel,pcp-breadcrumbs-panel,pcp-troubleshooting-panel,performancecopilot-valkey-datasource,performancecopilot-vector-datasource,performancecopilot-bpftrace-datasource,performancecopilot-flamegraph-panel,performancecopilot-breadcrumbs-panel,performancecopilot-troubleshooting-panel + # Enable or disable installing / uninstalling / updating plugins directly from within Grafana. + ;plugin_admin_enabled = false + ;plugin_admin_external_manage_enabled = false diff --git a/0004-remove-unused-backend-dependencies.patch b/0004-remove-unused-backend-dependencies.patch new file mode 100644 index 0000000..1569748 --- /dev/null +++ b/0004-remove-unused-backend-dependencies.patch @@ -0,0 +1,62 @@ +From 076177ff583b8e6d92948e0a4ddde0e8992d09a3 Mon Sep 17 00:00:00 2001 +From: Andreas Gerstmayr +Date: Wed, 22 Jun 2022 17:18:56 +0200 +Subject: [PATCH] remove unused backend dependencies + +saml and gofpdf are not used in the OSS edition of Grafana +after editing `pkg/extensions/main.go`, run `go mod tidy` + +diff --git a/go.mod b/go.mod +index fcbc09da5e..82fdf39842 100644 +--- a/go.mod ++++ b/go.mod +@@ -45,7 +45,6 @@ require ( + github.com/blang/semver/v4 v4.0.0 // @grafana/grafana-release-guild + github.com/bradfitz/gomemcache v0.0.0-20190913173617-a41fca850d0b // @grafana/backend-platform + github.com/centrifugal/centrifuge v0.30.2 // @grafana/grafana-app-platform-squad +- github.com/crewjam/saml v0.4.13 // @grafana/grafana-authnz-team + github.com/fatih/color v1.15.0 // @grafana/backend-platform + github.com/gchaincl/sqlhooks v1.3.0 // @grafana/backend-platform + github.com/go-ldap/ldap/v3 v3.4.4 // @grafana/grafana-authnz-team +@@ -187,7 +186,6 @@ require ( + github.com/josharian/intern v1.0.0 // indirect + github.com/jpillora/backoff v1.0.0 // indirect + github.com/mailru/easyjson v0.7.7 // indirect +- github.com/mattermost/xml-roundtrip-validator v0.1.0 // indirect + github.com/mattetti/filebuffer v1.0.1 // indirect + github.com/mattn/go-runewidth v0.0.13 // indirect + github.com/miekg/dns v1.1.51 // indirect +diff --git a/go.sum b/go.sum +index d05dfb55fd..b160387abe 100644 +--- a/go.sum ++++ b/go.sum +@@ -1826,8 +1826,6 @@ github.com/grafana/pyroscope/api v0.3.0/go.mod h1:JggA80ToAAUACYGfwL49XoFk5aN5ec + github.com/grafana/regexp v0.0.0-20221122212121-6b5c0a4cb7fd/go.mod h1:M5qHK+eWfAv8VR/265dIuEpL3fNfeC21tXXp9itM24A= + github.com/grafana/regexp v0.0.0-20221123153739-15dc172cd2db h1:7aN5cccjIqCLTzedH7MZzRZt5/lsAHch6Z3L2ZGn5FA= + github.com/grafana/regexp v0.0.0-20221123153739-15dc172cd2db/go.mod h1:M5qHK+eWfAv8VR/265dIuEpL3fNfeC21tXXp9itM24A= +-github.com/grafana/saml v0.4.15-0.20231025143828-a6c0e9b86a4c h1:1pHLC1ZTz7N5QI3jzCs5sqmVvAKe+JwGnpp9lQ+iUjY= +-github.com/grafana/saml v0.4.15-0.20231025143828-a6c0e9b86a4c/go.mod h1:S4+611dxnKt8z/ulbvaJzcgSHsuhjVc1QHNTcr1R7Fw= + github.com/grafana/sqlds/v2 v2.3.10 h1:HWKhE0vR6LoEiE+Is8CSZOgaB//D1yqb2ntkass9Fd4= + github.com/grafana/sqlds/v2 v2.3.10/go.mod h1:c6ibxnxRVGxV/0YkEgvy7QpQH/lyifFyV7K/14xvdIs= + github.com/grafana/tempo v1.5.1-0.20230524121406-1dc1bfe7085b h1:mDlkqgTEJuK7vjPG44f3ZMtId5AAYLWHvBVbiGqIOOQ= +@@ -2222,8 +2220,6 @@ github.com/markbates/sigtx v1.0.0/go.mod h1:QF1Hv6Ic6Ca6W+T+DL0Y/ypborFKyvUY9Hmu + github.com/markbates/willie v1.0.9/go.mod h1:fsrFVWl91+gXpx/6dv715j7i11fYPfZ9ZGfH0DQzY7w= + github.com/matryer/is v1.4.0 h1:sosSmIWwkYITGrxZ25ULNDeKiMNzFSr4V/eqBQP0PeE= + github.com/matryer/is v1.4.0/go.mod h1:8I/i5uYgLzgsgEloJE1U6xx5HkBQpAZvepWuujKwMRU= +-github.com/mattermost/xml-roundtrip-validator v0.1.0 h1:RXbVD2UAl7A7nOTR4u7E3ILa4IbtvKBHw64LDsmu9hU= +-github.com/mattermost/xml-roundtrip-validator v0.1.0/go.mod h1:qccnGMcpgwcNaBnxqpJpWWUiPNr5H3O8eDgGV9gT5To= + github.com/mattetti/filebuffer v1.0.1 h1:gG7pyfnSIZCxdoKq+cPa8T0hhYtD9NxCdI4D7PTjRLM= + github.com/mattetti/filebuffer v1.0.1/go.mod h1:YdMURNDOttIiruleeVr6f56OrMc+MydEnTcXwtkxNVs= + github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU= +diff --git a/pkg/extensions/main.go b/pkg/extensions/main.go +index 327e208221..426aad2a21 100644 +--- a/pkg/extensions/main.go ++++ b/pkg/extensions/main.go +@@ -11,7 +11,6 @@ import ( + _ "github.com/beevik/etree" + _ "github.com/blugelabs/bluge" + _ "github.com/blugelabs/bluge_segment_api" +- _ "github.com/crewjam/saml" + _ "github.com/go-jose/go-jose/v3" + _ "github.com/gobwas/glob" + _ "github.com/googleapis/gax-go/v2" diff --git a/0005-remove-unused-frontend-crypto.patch b/0005-remove-unused-frontend-crypto.patch new file mode 100644 index 0000000..268eadb --- /dev/null +++ b/0005-remove-unused-frontend-crypto.patch @@ -0,0 +1,333 @@ +From ddd615152004e0bc5985a574c05d31778351dfa3 Mon Sep 17 00:00:00 2001 +From: Andreas Gerstmayr +Date: Wed, 22 Jun 2022 17:36:47 +0200 +Subject: [PATCH] remove unused frontend crypto + +update `package.json` and then run `yarn install` to update the +`yarn.lock` lockfile + +diff --git a/package.json b/package.json +index 38deb6d7de..aad5e88bf0 100644 +--- a/package.json ++++ b/package.json +@@ -425,6 +425,9 @@ + "resolutions": { + "underscore": "1.13.6", + "@types/slate": "0.47.11", ++ "crypto-browserify": "https://registry.yarnpkg.com/@favware/skip-dependency/-/skip-dependency-1.1.3.tgz", ++ "selfsigned": "https://registry.yarnpkg.com/@favware/skip-dependency/-/skip-dependency-1.1.3.tgz", ++ "http-signature": "https://registry.yarnpkg.com/@favware/skip-dependency/-/skip-dependency-1.1.3.tgz", + "ngtemplate-loader/loader-utils": "^2.0.0", + "semver@~7.0.0": "7.5.4", + "semver@7.3.4": "7.5.4", +diff --git a/yarn.lock b/yarn.lock +index bf22ba52a1..1552ddc052 100644 +--- a/yarn.lock ++++ b/yarn.lock +@@ -10935,22 +10935,6 @@ __metadata: + languageName: node + linkType: hard + +-"asn1@npm:~0.2.3": +- version: 0.2.6 +- resolution: "asn1@npm:0.2.6" +- dependencies: +- safer-buffer: "npm:~2.1.0" +- checksum: cf629291fee6c1a6f530549939433ebf32200d7849f38b810ff26ee74235e845c0c12b2ed0f1607ac17383d19b219b69cefa009b920dab57924c5c544e495078 +- languageName: node +- linkType: hard +- +-"assert-plus@npm:1.0.0, assert-plus@npm:^1.0.0": +- version: 1.0.0 +- resolution: "assert-plus@npm:1.0.0" +- checksum: f4f991ae2df849cc678b1afba52d512a7cbf0d09613ba111e72255409ff9158550c775162a47b12d015d1b82b3c273e8e25df0e4783d3ddb008a293486d00a07 +- languageName: node +- linkType: hard +- + "assert@npm:2.0.0, assert@npm:^2.0.0": + version: 2.0.0 + resolution: "assert@npm:2.0.0" +@@ -11427,15 +11411,6 @@ __metadata: + languageName: node + linkType: hard + +-"bcrypt-pbkdf@npm:^1.0.0": +- version: 1.0.2 +- resolution: "bcrypt-pbkdf@npm:1.0.2" +- dependencies: +- tweetnacl: "npm:^0.14.3" +- checksum: 13a4cde058250dbf1fa77a4f1b9a07d32ae2e3b9e28e88a0c7a1827835bc3482f3e478c4a0cfd4da6ff0c46dae07da1061123a995372b32cc563d9975f975404 +- languageName: node +- linkType: hard +- + "before-after-hook@npm:^2.2.0": + version: 2.2.2 + resolution: "before-after-hook@npm:2.2.2" +@@ -12929,13 +12904,6 @@ __metadata: + languageName: node + linkType: hard + +-"core-util-is@npm:1.0.2": +- version: 1.0.2 +- resolution: "core-util-is@npm:1.0.2" +- checksum: d0f7587346b44a1fe6c269267e037dd34b4787191e473c3e685f507229d88561c40eb18872fabfff02977301815d474300b7bfbd15396c13c5377393f7e87ec3 +- languageName: node +- linkType: hard +- + "core-util-is@npm:~1.0.0": + version: 1.0.3 + resolution: "core-util-is@npm:1.0.3" +@@ -13857,15 +13825,6 @@ __metadata: + languageName: node + linkType: hard + +-"dashdash@npm:^1.12.0": +- version: 1.14.1 +- resolution: "dashdash@npm:1.14.1" +- dependencies: +- assert-plus: "npm:^1.0.0" +- checksum: 137b287fa021201ce100cef772c8eeeaaafdd2aa7282864022acf3b873021e54cb809e9c060fa164840bf54ff72d00d6e2d8da1ee5a86d7200eeefa1123a8f7f +- languageName: node +- linkType: hard +- + "data-urls@npm:^3.0.2": + version: 3.0.2 + resolution: "data-urls@npm:3.0.2" +@@ -14573,16 +14532,6 @@ __metadata: + languageName: node + linkType: hard + +-"ecc-jsbn@npm:~0.1.1": +- version: 0.1.2 +- resolution: "ecc-jsbn@npm:0.1.2" +- dependencies: +- jsbn: "npm:~0.1.0" +- safer-buffer: "npm:^2.1.0" +- checksum: d43591f2396196266e186e6d6928038cc11c76c3699a912cb9c13757060f7bbc7f17f47c4cb16168cdeacffc7965aef021142577e646fb3cb88810c15173eb57 +- languageName: node +- linkType: hard +- + "ee-first@npm:1.1.1": + version: 1.1.1 + resolution: "ee-first@npm:1.1.1" +@@ -15991,20 +15940,6 @@ __metadata: + languageName: node + linkType: hard + +-"extsprintf@npm:1.3.0": +- version: 1.3.0 +- resolution: "extsprintf@npm:1.3.0" +- checksum: 26967d6c7ecbfb5bc5b7a6c43503dc5fafd9454802037e9fa1665e41f615da4ff5918bd6cb871a3beabed01a31eca1ccd0bdfb41231f50ad50d405a430f78377 +- languageName: node +- linkType: hard +- +-"extsprintf@npm:^1.2.0": +- version: 1.4.1 +- resolution: "extsprintf@npm:1.4.1" +- checksum: bfd6d55f3c0c04d826fe0213264b383c03f32825af6b1ff777f3f2dc49467e599361993568d75b7b19a8ea1bb08c8e7cd8c3d87d179ced91bb0dcf81ca6938e0 +- languageName: node +- linkType: hard +- + "fast-deep-equal@npm:^3.1.1, fast-deep-equal@npm:^3.1.3": + version: 3.1.3 + resolution: "fast-deep-equal@npm:3.1.3" +@@ -16916,15 +16851,6 @@ __metadata: + languageName: node + linkType: hard + +-"getpass@npm:^0.1.1": +- version: 0.1.7 +- resolution: "getpass@npm:0.1.7" +- dependencies: +- assert-plus: "npm:^1.0.0" +- checksum: ab18d55661db264e3eac6012c2d3daeafaab7a501c035ae0ccb193c3c23e9849c6e29b6ac762b9c2adae460266f925d55a3a2a3a3c8b94be2f222df94d70c046 +- languageName: node +- linkType: hard +- + "giget@npm:^1.0.0": + version: 1.1.2 + resolution: "giget@npm:1.1.2" +@@ -18263,25 +18189,10 @@ __metadata: + languageName: node + linkType: hard + +-"http-signature@npm:~1.2.0": +- version: 1.2.0 +- resolution: "http-signature@npm:1.2.0" +- dependencies: +- assert-plus: "npm:^1.0.0" +- jsprim: "npm:^1.2.2" +- sshpk: "npm:^1.7.0" +- checksum: 2ff7112e6b0d8f08b382dfe705078c655501f2ddd76cf589d108445a9dd388a0a9be928c37108261519a7f53e6bbd1651048d74057b804807cce1ec49e87a95b +- languageName: node +- linkType: hard +- +-"http-signature@npm:~1.3.6": +- version: 1.3.6 +- resolution: "http-signature@npm:1.3.6" +- dependencies: +- assert-plus: "npm:^1.0.0" +- jsprim: "npm:^2.0.2" +- sshpk: "npm:^1.14.1" +- checksum: 5f08e0c82174999da97114facb0d0d47e268d60b6fc10f92cb87b99d5ccccd36f79b9508c29dda0b4f4e3a1b2f7bcaf847e68ecd5da2f1fc465fcd1d054b7884 ++"http-signature@https://registry.yarnpkg.com/@favware/skip-dependency/-/skip-dependency-1.1.3.tgz": ++ version: 1.1.3 ++ resolution: "http-signature@https://registry.yarnpkg.com/@favware/skip-dependency/-/skip-dependency-1.1.3.tgz" ++ checksum: 78b64605540e2d25bede2d74ec9e7740ab9a466c9a562ae3a8ccc7e07e26e601a013859c94adf890679403cd337b9690f598d64bc4fbc1d2eaa2f27241ca08a1 + languageName: node + linkType: hard + +@@ -20609,13 +20520,6 @@ __metadata: + languageName: node + linkType: hard + +-"jsbn@npm:~0.1.0": +- version: 0.1.1 +- resolution: "jsbn@npm:0.1.1" +- checksum: 5450133242845100e694f0ef9175f44c012691a9b770b2571e677314e6f70600abb10777cdfc9a0c6a9f2ac6d134577403633de73e2fcd0f97875a67744e2d14 +- languageName: node +- linkType: hard +- + "jscodeshift@npm:^0.14.0": + version: 0.14.0 + resolution: "jscodeshift@npm:0.14.0" +@@ -20767,13 +20671,6 @@ __metadata: + languageName: node + linkType: hard + +-"json-schema@npm:0.4.0": +- version: 0.4.0 +- resolution: "json-schema@npm:0.4.0" +- checksum: 8b3b64eff4a807dc2a3045b104ed1b9335cd8d57aa74c58718f07f0f48b8baa3293b00af4dcfbdc9144c3aafea1e97982cc27cc8e150fc5d93c540649507a458 +- languageName: node +- linkType: hard +- + "json-source-map@npm:0.6.1": + version: 0.6.1 + resolution: "json-source-map@npm:0.6.1" +@@ -20886,30 +20783,6 @@ __metadata: + languageName: node + linkType: hard + +-"jsprim@npm:^1.2.2": +- version: 1.4.2 +- resolution: "jsprim@npm:1.4.2" +- dependencies: +- assert-plus: "npm:1.0.0" +- extsprintf: "npm:1.3.0" +- json-schema: "npm:0.4.0" +- verror: "npm:1.10.0" +- checksum: df2bf234eab1b5078d01bcbff3553d50a243f7b5c10a169745efeda6344d62798bd1d85bcca6a8446f3b5d0495e989db45f9de8dae219f0f9796e70e0c776089 +- languageName: node +- linkType: hard +- +-"jsprim@npm:^2.0.2": +- version: 2.0.2 +- resolution: "jsprim@npm:2.0.2" +- dependencies: +- assert-plus: "npm:1.0.0" +- extsprintf: "npm:1.3.0" +- json-schema: "npm:0.4.0" +- verror: "npm:1.10.0" +- checksum: fcfca5b55f83e1b8be5f932c71754bd37afd2611f81685abd05689e8ce718a91155ff7bd5b94c65ce483a787b5c43c6d0c18c1d2259fca5bb61a3f8ea2e29c0a +- languageName: node +- linkType: hard +- + "jsurl@npm:^0.1.5": + version: 0.1.5 + resolution: "jsurl@npm:0.1.5" +@@ -22734,7 +22607,7 @@ __metadata: + languageName: node + linkType: hard + +-"node-forge@npm:^1, node-forge@npm:^1.3.1": ++"node-forge@npm:^1.3.1": + version: 1.3.1 + resolution: "node-forge@npm:1.3.1" + checksum: 05bab6868633bf9ad4c3b1dd50ec501c22ffd69f556cdf169a00998ca1d03e8107a6032ba013852f202035372021b845603aeccd7dfcb58cdb7430013b3daa8d +@@ -27151,7 +27024,7 @@ __metadata: + languageName: node + linkType: hard + +-"safer-buffer@npm:>= 2.1.2 < 3, safer-buffer@npm:>= 2.1.2 < 3.0.0, safer-buffer@npm:^2.0.2, safer-buffer@npm:^2.1.0, safer-buffer@npm:~2.1.0": ++"safer-buffer@npm:>= 2.1.2 < 3, safer-buffer@npm:>= 2.1.2 < 3.0.0": + version: 2.1.2 + resolution: "safer-buffer@npm:2.1.2" + checksum: 7eaf7a0cf37cc27b42fb3ef6a9b1df6e93a1c6d98c6c6702b02fe262d5fcbd89db63320793b99b21cb5348097d0a53de81bd5f4e8b86e20cc9412e3f1cfb4e83 +@@ -27282,12 +27155,10 @@ __metadata: + languageName: node + linkType: hard + +-"selfsigned@npm:^2.1.1": +- version: 2.1.1 +- resolution: "selfsigned@npm:2.1.1" +- dependencies: +- node-forge: "npm:^1" +- checksum: 6005206e0d005448274aceceaded5195b944f67a42b72d212a6169d2e5f4bdc87c15a3fe45732c544db8c7175702091aaf95403ad6632585294a6ec8cca63638 ++"selfsigned@https://registry.yarnpkg.com/@favware/skip-dependency/-/skip-dependency-1.1.3.tgz": ++ version: 1.1.3 ++ resolution: "selfsigned@https://registry.yarnpkg.com/@favware/skip-dependency/-/skip-dependency-1.1.3.tgz" ++ checksum: 4988a0dbdf123fb808194a6198f5951e2df711de6fd967d72a8876baccaa23d5c260efb8f1dbfbc5bf1f852e81f897ad09267908977ab94862867ef971a3d48d + languageName: node + linkType: hard + +@@ -28053,27 +27924,6 @@ __metadata: + languageName: node + linkType: hard + +-"sshpk@npm:^1.14.1, sshpk@npm:^1.7.0": +- version: 1.17.0 +- resolution: "sshpk@npm:1.17.0" +- dependencies: +- asn1: "npm:~0.2.3" +- assert-plus: "npm:^1.0.0" +- bcrypt-pbkdf: "npm:^1.0.0" +- dashdash: "npm:^1.12.0" +- ecc-jsbn: "npm:~0.1.1" +- getpass: "npm:^0.1.1" +- jsbn: "npm:~0.1.0" +- safer-buffer: "npm:^2.0.2" +- tweetnacl: "npm:~0.14.0" +- bin: +- sshpk-conv: bin/sshpk-conv +- sshpk-sign: bin/sshpk-sign +- sshpk-verify: bin/sshpk-verify +- checksum: 668c2a279a6ce66fd739ce5684e37927dd75427cc020c828a208f85890a4c400705d4ba09f32fa44efca894339dc6931941664f6f6ba36dfa543de6d006cbe9c +- languageName: node +- linkType: hard +- + "ssri@npm:^10.0.0, ssri@npm:^10.0.1": + version: 10.0.5 + resolution: "ssri@npm:10.0.5" +@@ -29479,13 +29329,6 @@ __metadata: + languageName: node + linkType: hard + +-"tweetnacl@npm:^0.14.3, tweetnacl@npm:~0.14.0": +- version: 0.14.5 +- resolution: "tweetnacl@npm:0.14.5" +- checksum: 04ee27901cde46c1c0a64b9584e04c96c5fe45b38c0d74930710751ea991408b405747d01dfae72f80fc158137018aea94f9c38c651cb9c318f0861a310c3679 +- languageName: node +- linkType: hard +- + "type-check@npm:^0.4.0, type-check@npm:~0.4.0": + version: 0.4.0 + resolution: "type-check@npm:0.4.0" +@@ -30199,17 +30042,6 @@ __metadata: + languageName: node + linkType: soft + +-"verror@npm:1.10.0": +- version: 1.10.0 +- resolution: "verror@npm:1.10.0" +- dependencies: +- assert-plus: "npm:^1.0.0" +- core-util-is: "npm:1.0.2" +- extsprintf: "npm:^1.2.0" +- checksum: da548149dd9c130a8a2587c9ee71ea30128d1526925707e2d01ed9c5c45c9e9f86733c66a328247cdd5f7c1516fb25b0f959ba754bfbe15072aa99ff96468a29 +- languageName: node +- linkType: hard +- + "vinyl-fs@npm:^3.0.2": + version: 3.0.3 + resolution: "vinyl-fs@npm:3.0.3" diff --git a/0006-skip-marketplace-plugin-install-test.patch b/0006-skip-marketplace-plugin-install-test.patch new file mode 100644 index 0000000..3180726 --- /dev/null +++ b/0006-skip-marketplace-plugin-install-test.patch @@ -0,0 +1,21 @@ +From ed8a438d72a667844ae07804491b568ad2f5dcdd Mon Sep 17 00:00:00 2001 +From: Andreas Gerstmayr +Date: Thu, 23 Jun 2022 17:00:46 +0200 +Subject: [PATCH] skip marketplace plugin install test + +This test (tries to) install a plugin from the Grafana marketplace. +Network connectivity is disabled in the build environment for security +reasons, therefore we need to disable this test. + +diff --git a/pkg/tests/api/plugins/api_plugins_test.go b/pkg/tests/api/plugins/api_plugins_test.go +index 4fc2295ed8..a326c40b04 100644 +--- a/pkg/tests/api/plugins/api_plugins_test.go ++++ b/pkg/tests/api/plugins/api_plugins_test.go +@@ -71,6 +71,7 @@ func TestIntegrationPlugins(t *testing.T) { + }) + + t.Run("Request is not forbidden if from an admin", func(t *testing.T) { ++ t.Skip("this test requires connectivity to the Grafana plugin marketplace (fetching metadata)") + statusCode, body := makePostRequest(t, grafanaAPIURL(usernameAdmin, grafanaListedAddr, "plugins/test/install")) + + assert.Equal(t, 404, statusCode) diff --git a/0007-redact-weak-ciphers.patch b/0007-redact-weak-ciphers.patch new file mode 100644 index 0000000..1b7148a --- /dev/null +++ b/0007-redact-weak-ciphers.patch @@ -0,0 +1,30 @@ +From 7ac26d6beb2175f0d6001ca0df322ce610401cce Mon Sep 17 00:00:00 2001 +From: Stan Cox +Date: Wed, 22 Jun 2022 17:05:48 +0200 +Subject: [PATCH] redact weak ciphers + + +diff --git a/pkg/api/http_server.go b/pkg/api/http_server.go +index da04044683..8a29270d4d 100644 +--- a/pkg/api/http_server.go ++++ b/pkg/api/http_server.go +@@ -820,13 +820,13 @@ func (hs *HTTPServer) getDefaultCiphers(tlsVersion uint16, protocol string) []ui + tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, + tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, + tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, +- tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, ++ // tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, + tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, +- tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, +- tls.TLS_RSA_WITH_AES_128_GCM_SHA256, +- tls.TLS_RSA_WITH_AES_256_GCM_SHA384, +- tls.TLS_RSA_WITH_AES_128_CBC_SHA, +- tls.TLS_RSA_WITH_AES_256_CBC_SHA, ++ // tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, ++ // tls.TLS_RSA_WITH_AES_128_GCM_SHA256, ++ // tls.TLS_RSA_WITH_AES_256_GCM_SHA384, ++ // tls.TLS_RSA_WITH_AES_128_CBC_SHA, ++ // tls.TLS_RSA_WITH_AES_256_CBC_SHA, + } + } + if protocol == "h2" { diff --git a/0008-replace-faulty-slices-sort.patch b/0008-replace-faulty-slices-sort.patch new file mode 100644 index 0000000..b9cea8c --- /dev/null +++ b/0008-replace-faulty-slices-sort.patch @@ -0,0 +1,40 @@ +From 3f45f26993ed94837001bb9760d7859e7a057649 Mon Sep 17 00:00:00 2001 +From: Sam Feifer +Date: Fri, 1 Mar 2024 15:00:55 -0500 +Subject: [PATCH] replace faulty slices sort + + +diff --git a/pkg/services/sqlstore/migrator/dialect.go b/pkg/services/sqlstore/migrator/dialect.go +index 183b619de8..da21edeafa 100644 +--- a/pkg/services/sqlstore/migrator/dialect.go ++++ b/pkg/services/sqlstore/migrator/dialect.go +@@ -368,7 +368,8 @@ func (b *BaseDialect) InsertQuery(tableName string, row map[string]any) (string, + for col := range row { + keys = append(keys, col) + } +- slices.Sort[string](keys) ++ slices.Sort(keys) ++ //slices.Sort[string](keys) + + // build query and values + for _, col := range keys { +@@ -398,7 +399,8 @@ func (b *BaseDialect) UpdateQuery(tableName string, row map[string]any, where ma + for col := range row { + keys = append(keys, col) + } +- slices.Sort[string](keys) ++ slices.Sort(keys) ++ //slices.Sort[string](keys) + + // build update query and values + for _, col := range keys { +@@ -411,7 +413,8 @@ func (b *BaseDialect) UpdateQuery(tableName string, row map[string]any, where ma + for col := range where { + keys = append(keys, col) + } +- slices.Sort[string](keys) ++ slices.Sort(keys) ++ //slices.Sort[string](keys) + + // build where clause and values + for _, col := range keys { diff --git a/0009-update-wrappers-and-systemd-with-distro-paths.patch b/0009-update-wrappers-and-systemd-with-distro-paths.patch new file mode 100644 index 0000000..5331ddf --- /dev/null +++ b/0009-update-wrappers-and-systemd-with-distro-paths.patch @@ -0,0 +1,76 @@ +From 5fe02f961e67af04907dc57beda42456128ab1c8 Mon Sep 17 00:00:00 2001 +From: Sam Feifer +Date: Fri, 1 Mar 2024 15:05:24 -0500 +Subject: [PATCH] update wrappers and systemd with distro paths + + +diff --git a/packaging/rpm/systemd/grafana-server.service b/packaging/rpm/systemd/grafana-server.service +index e3adc3f469..b2e4aced06 100644 +--- a/packaging/rpm/systemd/grafana-server.service ++++ b/packaging/rpm/systemd/grafana-server.service +@@ -14,7 +14,7 @@ Restart=on-failure + WorkingDirectory=/usr/share/grafana + RuntimeDirectory=grafana + RuntimeDirectoryMode=0750 +-ExecStart=/usr/share/grafana/bin/grafana server \ ++ExecStart=/usr/sbin/grafana server \ + --config=${CONF_FILE} \ + --pidfile=${PID_FILE_DIR}/grafana-server.pid \ + --packaging=rpm \ +diff --git a/packaging/wrappers/grafana b/packaging/wrappers/grafana +index 86e0fc9faa..5c88bae4c3 100755 +--- a/packaging/wrappers/grafana ++++ b/packaging/wrappers/grafana +@@ -5,7 +5,7 @@ + # the system-wide Grafana configuration that was bundled with the package as we + # use the binary. + +-DEFAULT=/etc/default/grafana ++DEFAULT=/etc/sysconfig/grafana-server + + GRAFANA_HOME="${GRAFANA_HOME:-/usr/share/grafana}" + +@@ -13,11 +13,12 @@ CONF_DIR=/etc/grafana + DATA_DIR=/var/lib/grafana + PLUGINS_DIR=/var/lib/grafana/plugins + LOG_DIR=/var/log/grafana +++LIBEXEC_DIR=/usr/libexec/grafana + + CONF_FILE=$CONF_DIR/grafana.ini + PROVISIONING_CFG_DIR=$CONF_DIR/provisioning + +-EXECUTABLE="$GRAFANA_HOME/bin/grafana" +++EXECUTABLE=$LIBEXEC_DIR/grafana + + if [ ! -x $EXECUTABLE ]; then + echo "$EXECUTABLE not installed or not executable" +@@ -46,4 +47,13 @@ if [ "$CMD" = cli ]; then + --pluginsDir=${PLUGINS_DIR}" + fi + +-eval $EXECUTABLE "$CMD" "$OPTS" "$@" ++if [ "$(id -u)" -eq 0 -o "$(id -g)" -eq 0 ]; then ++ cd "${GRAFANA_HOME}" ++ exec runuser -u "${GRAFANA_USER}" -- "$EXECUTABLE" "$CMD" "${OPTS[@]}" "$@" ++elif [ "$(id -u -n)" = "${GRAFANA_USER}" ]; then ++ cd "${GRAFANA_HOME}" ++ exec "$EXECUTABLE" "$CMD" "${OPTS[@]}" "$@" ++else ++ echo "$0: please run this script as user \"${GRAFANA_USER}\" or root." ++ exit 5 ++fi +\ No newline at end of file +diff --git a/packaging/wrappers/grafana-server b/packaging/wrappers/grafana-server +index 466b0d7c69..6be356f562 100755 +--- a/packaging/wrappers/grafana-server ++++ b/packaging/wrappers/grafana-server +@@ -7,7 +7,8 @@ + + GRAFANA_HOME="${GRAFANA_HOME:-/usr/share/grafana}" + +-EXECUTABLE="$GRAFANA_HOME/bin/grafana" ++LIBEXEC_DIR=/usr/libexec/grafana ++EXECUTABLE=$LIBEXEC_DIR/grafana + + if [ ! -x $EXECUTABLE ]; then + echo "$EXECUTABLE not installed or not executable" diff --git a/001-login-oauth-use-oauth2-exchange.patch b/001-login-oauth-use-oauth2-exchange.patch deleted file mode 100644 index d62067d..0000000 --- a/001-login-oauth-use-oauth2-exchange.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/pkg/api/login_oauth.go b/pkg/api/login_oauth.go -index a3599bc7a..0c6579847 100644 ---- a/pkg/api/login_oauth.go -+++ b/pkg/api/login_oauth.go -@@ -125,7 +125,7 @@ func (hs *HTTPServer) OAuthLogin(ctx *m.ReqContext) { - oauthCtx := context.WithValue(context.Background(), oauth2.HTTPClient, oauthClient) - - // get token from provider -- token, err := connect.Exchange(oauthCtx, code) -+ token, err := connect.Exchange(oauthCtx, code, oauth2.AccessTypeOnline) - if err != nil { - ctx.Handle(500, "login.OAuthLogin(NewTransportWithCode)", err) - return diff --git a/0010-remove-bcrypt-references.patch b/0010-remove-bcrypt-references.patch new file mode 100644 index 0000000..d617c85 --- /dev/null +++ b/0010-remove-bcrypt-references.patch @@ -0,0 +1,108 @@ +From eb711315d4c8a81ff52984293758a47372c21b8d Mon Sep 17 00:00:00 2001 +From: Sam Feifer +Date: Fri, 1 Mar 2024 15:07:22 -0500 +Subject: [PATCH] remove bcrypt references + + +diff --git a/pkg/services/extsvcauth/oauthserver/oasimpl/service.go b/pkg/services/extsvcauth/oauthserver/oasimpl/service.go +index 8c5a90248d..43f6d11e08 100644 +--- a/pkg/services/extsvcauth/oauthserver/oasimpl/service.go ++++ b/pkg/services/extsvcauth/oauthserver/oasimpl/service.go +@@ -19,7 +19,6 @@ import ( + "github.com/ory/fosite/compose" + "github.com/ory/fosite/storage" + "github.com/ory/fosite/token/jwt" +- "golang.org/x/crypto/bcrypt" + + "github.com/grafana/grafana/pkg/api/routing" + "github.com/grafana/grafana/pkg/bus" +@@ -235,88 +234,7 @@ func (s *OAuth2ServiceImpl) RemoveExternalService(ctx context.Context, name stri + // it ensures that the associated service account has the correct permissions. + // Database consistency is not guaranteed, consider changing this in the future. + func (s *OAuth2ServiceImpl) SaveExternalService(ctx context.Context, registration *extsvcauth.ExternalServiceRegistration) (*extsvcauth.ExternalService, error) { +- if registration == nil { +- s.logger.Warn("RegisterExternalService called without registration") +- return nil, nil +- } +- slug := registration.Name +- s.logger.Info("Registering external service", "external service", slug) +- +- // Check if the client already exists in store +- client, errFetchExtSvc := s.sqlstore.GetExternalServiceByName(ctx, slug) +- if errFetchExtSvc != nil && !errors.Is(errFetchExtSvc, oauthserver.ErrClientNotFound) { +- s.logger.Error("Error fetching service", "external service", slug, "error", errFetchExtSvc) +- return nil, errFetchExtSvc +- } +- // Otherwise, create a new client +- if client == nil { +- s.logger.Debug("External service does not yet exist", "external service", slug) +- client = &oauthserver.OAuthExternalService{ +- Name: slug, +- ServiceAccountID: oauthserver.NoServiceAccountID, +- Audiences: s.cfg.AppURL, +- } +- } +- +- // Parse registration form to compute required permissions for the client +- client.SelfPermissions, client.ImpersonatePermissions = s.handleRegistrationPermissions(registration) +- +- if registration.OAuthProviderCfg == nil { +- return nil, errors.New("missing oauth provider configuration") +- } +- +- if registration.OAuthProviderCfg.RedirectURI != nil { +- client.RedirectURI = *registration.OAuthProviderCfg.RedirectURI +- } +- +- var errGenCred error +- client.ClientID, client.Secret, errGenCred = s.genCredentials() +- if errGenCred != nil { +- s.logger.Error("Error generating credentials", "client", client.LogID(), "error", errGenCred) +- return nil, errGenCred +- } +- +- grantTypes := s.computeGrantTypes(registration.Self.Enabled, registration.Impersonation.Enabled) +- client.GrantTypes = strings.Join(grantTypes, ",") +- +- // Handle key options +- s.logger.Debug("Handle key options") +- keys, err := s.handleKeyOptions(ctx, registration.OAuthProviderCfg.Key) +- if err != nil { +- s.logger.Error("Error handling key options", "client", client.LogID(), "error", err) +- return nil, err +- } +- if keys != nil { +- client.PublicPem = []byte(keys.PublicPem) +- } +- dto := client.ToExternalService(keys) +- +- hashedSecret, err := bcrypt.GenerateFromPassword([]byte(client.Secret), bcrypt.DefaultCost) +- if err != nil { +- s.logger.Error("Error hashing secret", "client", client.LogID(), "error", err) +- return nil, err +- } +- client.Secret = string(hashedSecret) +- +- s.logger.Debug("Save service account") +- saID, errSaveServiceAccount := s.saService.ManageExtSvcAccount(ctx, &serviceaccounts.ManageExtSvcAccountCmd{ +- ExtSvcSlug: slugify.Slugify(client.Name), +- Enabled: registration.Self.Enabled, +- OrgID: oauthserver.TmpOrgID, +- Permissions: client.SelfPermissions, +- }) +- if errSaveServiceAccount != nil { +- return nil, errSaveServiceAccount +- } +- client.ServiceAccountID = saID +- +- err = s.sqlstore.SaveExternalService(ctx, client) +- if err != nil { +- s.logger.Error("Error saving external service", "client", client.LogID(), "error", err) +- return nil, err +- } +- s.logger.Debug("Registered", "client", client.LogID()) +- return dto, nil ++ panic("bcrypt cipher not available") + } + + // randString generates a a cryptographically secure random string of n bytes diff --git a/0011-fix-dompurify-CVE.patch b/0011-fix-dompurify-CVE.patch new file mode 100644 index 0000000..47f906e --- /dev/null +++ b/0011-fix-dompurify-CVE.patch @@ -0,0 +1,58 @@ +From: Sam Feifer +Subject: [PATCH] fix dompurify CVE + +diff --git a/package.json b/package.json +index 38deb6d7dee..010a24fb451 100644 +--- a/package.json ++++ b/package.json +@@ -432,7 +432,8 @@ + "react-split-pane@0.1.92": "patch:react-split-pane@npm:0.1.92#.yarn/patches/react-split-pane-npm-0.1.92-93dbf51dff.patch", + "@storybook/blocks@7.4.5": "patch:@storybook/blocks@npm%3A7.4.5#./.yarn/patches/@storybook-blocks-npm-7.4.5-5a2374564a.patch", + "history@4.10.1": "patch:history@npm%3A4.10.1#./.yarn/patches/history-npm-4.10.1-ee217563ae.patch", +- "history@^4.9.0": "patch:history@npm%3A4.10.1#./.yarn/patches/history-npm-4.10.1-ee217563ae.patch" ++ "history@^4.9.0": "patch:history@npm%3A4.10.1#./.yarn/patches/history-npm-4.10.1-ee217563ae.patch", ++ "dompurify": "^2.5.0" + }, + "workspaces": { + "packages": [ +diff --git a/packages/grafana-data/package.json b/packages/grafana-data/package.json +index 2182744e61b..4201ef58dda 100644 +--- a/packages/grafana-data/package.json ++++ b/packages/grafana-data/package.json +@@ -41,7 +41,7 @@ + "@types/string-hash": "1.1.1", + "d3-interpolate": "3.0.1", + "date-fns": "2.30.0", +- "dompurify": "^2.4.3", ++ "dompurify": "^2.5.0", + "eventemitter3": "5.0.1", + "fast_array_intersect": "1.1.0", + "history": "4.10.1", +diff --git a/yarn.lock b/yarn.lock +index bf22ba52a17..88fc4d3fbfb 100644 +--- a/yarn.lock ++++ b/yarn.lock +@@ -2953,7 +2953,7 @@ __metadata: + "@types/tinycolor2": "npm:1.4.3" + d3-interpolate: "npm:3.0.1" + date-fns: "npm:2.30.0" +- dompurify: "npm:^2.4.3" ++ dompurify: "npm:^2.5.0" + esbuild: "npm:0.18.12" + eventemitter3: "npm:5.0.1" + fast_array_intersect: "npm:1.1.0" +@@ -14478,10 +14478,10 @@ __metadata: + languageName: node + linkType: hard + +-"dompurify@npm:^2.2.0, dompurify@npm:^2.4.3": +- version: 2.4.5 +- resolution: "dompurify@npm:2.4.5" +- checksum: d764c2ff126b3749dad35bc34eed40f51141d7dfd620e938c92f08d68c32beeb259d06abadeee91f6e2a8c8737ce670e2124ac9a257ba3bcdc666598cebcde01 ++"dompurify@npm:^2.5.0": ++ version: 2.5.7 ++ resolution: "dompurify@npm:2.5.7" ++ checksum: b150ca1e28083252cd51097162dc96cb45203f7e2af1fbaa8ef32b4f4d6b605e4aa8915190d38bd0635cbbf14d13a200138cd3ec1b084096819b14c718355122 + languageName: node + linkType: hard + diff --git a/0012-fix-jwt-CVE.patch b/0012-fix-jwt-CVE.patch new file mode 100644 index 0000000..a937bb1 --- /dev/null +++ b/0012-fix-jwt-CVE.patch @@ -0,0 +1,31 @@ +From: Sam Feifer +Subject: [PATCH] fix jwt CVE + +diff --git a/go.mod b/go.mod +index fcbc09da5e6..1771902bc1c 100644 +--- a/go.mod ++++ b/go.mod +@@ -164,7 +164,7 @@ require ( + github.com/go-openapi/spec v0.20.9 // indirect + github.com/go-openapi/swag v0.22.4 // indirect + github.com/go-openapi/validate v0.22.1 // indirect +- github.com/golang-jwt/jwt/v4 v4.5.0 // @grafana/backend-platform ++ github.com/golang-jwt/jwt/v4 v4.5.2 // @grafana/backend-platform + github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect + github.com/golang/glog v1.1.2 // indirect + github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect +diff --git a/go.sum b/go.sum +index d05dfb55fd4..3a045f712eb 100644 +--- a/go.sum ++++ b/go.sum +@@ -1593,8 +1593,9 @@ github.com/golang-jwt/jwt/v4 v4.0.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzw + github.com/golang-jwt/jwt/v4 v4.2.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg= + github.com/golang-jwt/jwt/v4 v4.4.1/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0= + github.com/golang-jwt/jwt/v4 v4.4.3/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0= +-github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg= + github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0= ++github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI= ++github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0= + github.com/golang-migrate/migrate/v4 v4.7.0 h1:gONcHxHApDTKXDyLH/H97gEHmpu1zcnnbAaq2zgrPrs= + github.com/golang-migrate/migrate/v4 v4.7.0/go.mod h1:Qvut3N4xKWjoH3sokBccML6WyHSnggXm/DvMMnTsQIc= + github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0= diff --git a/0013-fix-CVE-2025-4123.patch b/0013-fix-CVE-2025-4123.patch new file mode 100644 index 0000000..5204e37 --- /dev/null +++ b/0013-fix-CVE-2025-4123.patch @@ -0,0 +1,32 @@ +From 2d4314b5ca1e527a3420fad11d3f1a25351700d4 Mon Sep 17 00:00:00 2001 +From: Sam Feifer +Date: Wed, 7 May 2025 16:27:08 -0400 +Subject: [PATCH] fix CVE-2025-4123 + + +diff --git a/conf/defaults.ini b/conf/defaults.ini +index e1e5468bfa3..4221144bf54 100644 +--- a/conf/defaults.ini ++++ b/conf/defaults.ini +@@ -363,7 +363,7 @@ x_xss_protection = true + + # Enable adding the Content-Security-Policy header to your requests. + # CSP allows to control resources the user agent is allowed to load and helps prevent XSS attacks. +-content_security_policy = false ++content_security_policy = true + + # Set Content Security Policy template used when adding the Content-Security-Policy header to your requests. + # $NONCE in the template includes a random nonce. +diff --git a/conf/sample.ini b/conf/sample.ini +index 51d2b6c512b..fd588b48225 100644 +--- a/conf/sample.ini ++++ b/conf/sample.ini +@@ -364,7 +364,7 @@ + + # Enable adding the Content-Security-Policy header to your requests. + # CSP allows to control resources the user agent is allowed to load and helps prevent XSS attacks. +-;content_security_policy = false ++;content_security_policy = true + + # Set Content Security Policy template used when adding the Content-Security-Policy header to your requests. + # $NONCE in the template includes a random nonce. diff --git a/002-remove-jaeger-tracing.patch b/002-remove-jaeger-tracing.patch deleted file mode 100644 index 1f624cc..0000000 --- a/002-remove-jaeger-tracing.patch +++ /dev/null @@ -1,189 +0,0 @@ -diff --git a/pkg/cmd/grafana-server/server.go b/pkg/cmd/grafana-server/server.go -index 2ac326ed3..20943918c 100644 ---- a/pkg/cmd/grafana-server/server.go -+++ b/pkg/cmd/grafana-server/server.go -@@ -21,7 +21,6 @@ import ( - _ "github.com/grafana/grafana/pkg/infra/metrics" - _ "github.com/grafana/grafana/pkg/infra/remotecache" - _ "github.com/grafana/grafana/pkg/infra/serverlock" -- _ "github.com/grafana/grafana/pkg/infra/tracing" - _ "github.com/grafana/grafana/pkg/infra/usagestats" - "github.com/grafana/grafana/pkg/log" - "github.com/grafana/grafana/pkg/login" -diff --git a/pkg/infra/tracing/tracing.go b/pkg/infra/tracing/tracing.go -deleted file mode 100644 -index fd7258b7a..000000000 ---- a/pkg/infra/tracing/tracing.go -+++ /dev/null -@@ -1,129 +0,0 @@ --package tracing -- --import ( -- "context" -- "io" -- "strings" -- -- "github.com/grafana/grafana/pkg/log" -- "github.com/grafana/grafana/pkg/registry" -- "github.com/grafana/grafana/pkg/setting" -- -- opentracing "github.com/opentracing/opentracing-go" -- jaegercfg "github.com/uber/jaeger-client-go/config" --) -- --func init() { -- registry.RegisterService(&TracingService{}) --} -- --type TracingService struct { -- enabled bool -- address string -- customTags map[string]string -- samplerType string -- samplerParam float64 -- log log.Logger -- closer io.Closer -- -- Cfg *setting.Cfg `inject:""` --} -- --func (ts *TracingService) Init() error { -- ts.log = log.New("tracing") -- ts.parseSettings() -- -- if ts.enabled { -- ts.initGlobalTracer() -- } -- -- return nil --} -- --func (ts *TracingService) parseSettings() { -- var section, err = ts.Cfg.Raw.GetSection("tracing.jaeger") -- if err != nil { -- return -- } -- -- ts.address = section.Key("address").MustString("") -- if ts.address != "" { -- ts.enabled = true -- } -- -- ts.customTags = splitTagSettings(section.Key("always_included_tag").MustString("")) -- ts.samplerType = section.Key("sampler_type").MustString("") -- ts.samplerParam = section.Key("sampler_param").MustFloat64(1) --} -- --func (ts *TracingService) initGlobalTracer() error { -- cfg := jaegercfg.Configuration{ -- ServiceName: "grafana", -- Disabled: !ts.enabled, -- Sampler: &jaegercfg.SamplerConfig{ -- Type: ts.samplerType, -- Param: ts.samplerParam, -- }, -- Reporter: &jaegercfg.ReporterConfig{ -- LogSpans: false, -- LocalAgentHostPort: ts.address, -- }, -- } -- -- jLogger := &jaegerLogWrapper{logger: log.New("jaeger")} -- -- options := []jaegercfg.Option{} -- options = append(options, jaegercfg.Logger(jLogger)) -- -- for tag, value := range ts.customTags { -- options = append(options, jaegercfg.Tag(tag, value)) -- } -- -- tracer, closer, err := cfg.NewTracer(options...) -- if err != nil { -- return err -- } -- -- opentracing.InitGlobalTracer(tracer) -- -- ts.closer = closer -- -- return nil --} -- --func (ts *TracingService) Run(ctx context.Context) error { -- <-ctx.Done() -- -- if ts.closer != nil { -- ts.log.Info("Closing tracing") -- ts.closer.Close() -- } -- -- return nil --} -- --func splitTagSettings(input string) map[string]string { -- res := map[string]string{} -- -- tags := strings.Split(input, ",") -- for _, v := range tags { -- kv := strings.Split(v, ":") -- if len(kv) > 1 { -- res[kv[0]] = kv[1] -- } -- } -- -- return res --} -- --type jaegerLogWrapper struct { -- logger log.Logger --} -- --func (jlw *jaegerLogWrapper) Error(msg string) { -- jlw.logger.Error(msg) --} -- --func (jlw *jaegerLogWrapper) Infof(msg string, args ...interface{}) { -- jlw.logger.Info(msg, args) --} -diff --git a/pkg/infra/tracing/tracing_test.go b/pkg/infra/tracing/tracing_test.go -deleted file mode 100644 -index 27e4de777..000000000 ---- a/pkg/infra/tracing/tracing_test.go -+++ /dev/null -@@ -1,36 +0,0 @@ --package tracing -- --import "testing" -- --func TestGroupSplit(t *testing.T) { -- tests := []struct { -- input string -- expected map[string]string -- }{ -- { -- input: "tag1:value1,tag2:value2", -- expected: map[string]string{ -- "tag1": "value1", -- "tag2": "value2", -- }, -- }, -- { -- input: "", -- expected: map[string]string{}, -- }, -- { -- input: "tag1", -- expected: map[string]string{}, -- }, -- } -- -- for _, test := range tests { -- tags := splitTagSettings(test.input) -- for k, v := range test.expected { -- value, exists := tags[k] -- if !exists || value != v { -- t.Errorf("tags does not match %v ", test) -- } -- } -- } --} diff --git a/003-new-files.patch b/003-new-files.patch deleted file mode 100644 index 0701856..0000000 --- a/003-new-files.patch +++ /dev/null @@ -1,1627 +0,0 @@ -diff --git a/conf/distro-defaults.ini b/conf/distro-defaults.ini -new file mode 100644 -index 000000000..eeb974369 ---- /dev/null -+++ b/conf/distro-defaults.ini -@@ -0,0 +1,601 @@ -+##################### Grafana Configuration Defaults for distros ##################### -+# -+# Do not modify this file in grafana installs -+# -+ -+# possible values : production, development -+app_mode = production -+ -+# instance name, defaults to HOSTNAME environment variable value or hostname if HOSTNAME var is empty -+instance_name = ${HOSTNAME} -+ -+#################################### Paths ############################### -+[paths] -+# Path to where grafana can store temp files, sessions, and the sqlite3 db (if that is used) -+data = /var/lib/grafana -+ -+# Temporary files in `data` directory older than given duration will be removed -+temp_data_lifetime = 24h -+ -+# Directory where grafana can store logs -+logs = /var/log/grafana -+ -+# Directory where grafana will automatically scan and look for plugins -+plugins = /var/lib/grafana/plugins -+ -+# folder that contains provisioning config files that grafana will apply on startup and while running. -+provisioning = conf/provisioning -+ -+#################################### Server ############################## -+[server] -+# Protocol (http, https, socket) -+protocol = http -+ -+# The ip address to bind to, empty will bind to all interfaces -+http_addr = -+ -+# The http port to use -+http_port = 3000 -+ -+# The public facing domain name used to access grafana from a browser -+domain = localhost -+ -+# Redirect to correct domain if host header does not match domain -+# Prevents DNS rebinding attacks -+enforce_domain = false -+ -+# The full public facing url -+root_url = %(protocol)s://%(domain)s:%(http_port)s/ -+ -+# Log web requests -+router_logging = false -+ -+# the path relative working path -+static_root_path = public -+ -+# enable gzip -+enable_gzip = false -+ -+# https certs & key file -+cert_file = -+cert_key = -+ -+# Unix socket path -+socket = /tmp/grafana.sock -+ -+#################################### Database ############################ -+[database] -+# You can configure the database connection by specifying type, host, name, user and password -+# as separate properties or as on string using the url property. -+ -+# Either "mysql", "postgres" or "sqlite3", it's your choice -+type = sqlite3 -+host = 127.0.0.1:3306 -+name = grafana -+user = root -+# If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;""" -+password = -+# Use either URL or the previous fields to configure the database -+# Example: mysql://user:secret@host:port/database -+url = -+ -+# Max idle conn setting default is 2 -+max_idle_conn = 2 -+ -+# Max conn setting default is 0 (mean not set) -+max_open_conn = -+ -+# Connection Max Lifetime default is 14400 (means 14400 seconds or 4 hours) -+conn_max_lifetime = 14400 -+ -+# Set to true to log the sql calls and execution times. -+log_queries = -+ -+# For "postgres", use either "disable", "require" or "verify-full" -+# For "mysql", use either "true", "false", or "skip-verify". -+ssl_mode = disable -+ -+ca_cert_path = -+client_key_path = -+client_cert_path = -+server_cert_name = -+ -+# For "sqlite3" only, path relative to data_path setting -+path = grafana.db -+ -+# For "sqlite3" only. cache mode setting used for connecting to the database -+cache_mode = private -+ -+#################################### Cache server ############################# -+[remote_cache] -+# Either "redis", "memcached" or "database" default is "database" -+type = database -+ -+# cache connectionstring options -+# database: will use Grafana primary database. -+# redis: config like redis server e.g. `addr=127.0.0.1:6379,pool_size=100,db=grafana` -+# memcache: 127.0.0.1:11211 -+connstr = -+ -+#################################### Data proxy ########################### -+[dataproxy] -+ -+# This enables data proxy logging, default is false -+logging = false -+ -+# How long the data proxy should wait before timing out default is 30 (seconds) -+timeout = 30 -+ -+# If enabled and user is not anonymous, data proxy will add X-Grafana-User header with username into the request, default is false. -+send_user_header = false -+ -+#################################### Analytics ########################### -+[analytics] -+# Server reporting, sends usage counters to stats.grafana.org every 24 hours. -+# No ip addresses are being tracked, only simple counters to track -+# running instances, dashboard and error counts. It is very helpful to us. -+# Change this option to false to disable reporting. -+reporting_enabled = false -+ -+# Set to false to disable all checks to https://grafana.com -+# for new versions (grafana itself and plugins), check is used -+# in some UI views to notify that grafana or plugin update exists -+# This option does not cause any auto updates, nor send any information -+# only a GET request to https://grafana.com to get latest versions -+check_for_updates = false -+ -+# Google Analytics universal tracking code, only enabled if you specify an id here -+google_analytics_ua_id = -+ -+# Google Tag Manager ID, only enabled if you specify an id here -+google_tag_manager_id = -+ -+#################################### Security ############################ -+[security] -+# default admin user, created on startup -+admin_user = admin -+ -+# default admin password, can be changed before first start of grafana, or in profile settings -+admin_password = admin -+ -+# used for signing -+secret_key = SW2YcwTIb9zpOOhoPsMm -+ -+# disable gravatar profile images -+disable_gravatar = false -+ -+# data source proxy whitelist (ip_or_domain:port separated by spaces) -+data_source_proxy_whitelist = -+ -+# disable protection against brute force login attempts -+disable_brute_force_login_protection = false -+ -+# set to true if you host Grafana behind HTTPS. default is false. -+cookie_secure = false -+ -+# set cookie SameSite attribute. defaults to `lax`. can be set to "lax", "strict" and "none" -+cookie_samesite = lax -+ -+# set to true if you want to allow browsers to render Grafana in a ,