Fix recursive macro definition error in rpminspect

Fix grafana-selinux cgroups denials
Use default gating config
2025-12-03 10:13:04 -05:00 · 2025-12-02 15:16:24 -05:00 · 2025-10-15 08:30:55 +00:00 · 2025-10-10 14:37:22 +02:00 · 2025-09-25 07:24:28 +00:00 · 2025-09-25 07:24:28 +00:00
39 changed files with 5410 additions and 2380 deletions
--- a/.fmf/version
+++ b/.fmf/version
@ -0,0 +1 @@
+1
--- a/.github/workflows/bundle.yml
+++ b/.github/workflows/bundle.yml
@ -0,0 +1,23 @@
+name: Create bundles
+on:
+  workflow_dispatch:
+
+jobs:
+  bundle:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@v3
+
+      - name: Create bundles
+        run: |
+          ./create_bundles_in_container.sh
+          sha512sum *.tar.gz *.tar.xz | tee SHA512SUMS
+
+      - name: Upload bundles
+        uses: actions/upload-artifact@v3
+        with:
+          name: bundles
+          path: |
+            *.tar.*
+            SHA512SUMS
--- a/.gitignore
+++ b/.gitignore
@ -1,6 +1,5 @@
-/grafana-6.1.4.tar.gz
-/grafana_webpack-6.1.4.tar.gz
-/grafana-6.1.6.tar.gz
-/grafana_webpack-6.1.6.tar.gz
-/grafana-6.2.2.tar.gz
-/grafana_webpack-6.2.2.tar.gz
+/grafana-*.tar.gz
+/grafana-*.tar.xz
+/grafana-*.tar.xz.manifest
+/grafana*/
+*.rpm
--- a/0001-update-grafana-cli-script-with-distro-specific-paths.patch
+++ b/0001-update-grafana-cli-script-with-distro-specific-paths.patch
@ -0,0 +1,66 @@
+From 1e47ea7adc316e2df3d0081c2c0ebe75ddd6bda0 Mon Sep 17 00:00:00 2001
+From: Andreas Gerstmayr <agerstmayr@redhat.com>
+Date: Wed, 22 Jun 2022 16:57:52 +0200
+Subject: [PATCH] update grafana-cli script with distro-specific paths and
+ switch to grafana user
+
+
+diff --git a/packaging/wrappers/grafana-cli b/packaging/wrappers/grafana-cli
+index 7c6c46aef9..945714642b 100755
+--- a/packaging/wrappers/grafana-cli
+++ b/packaging/wrappers/grafana-cli
+@@ -5,7 +5,7 @@
+ # the system-wide Grafana configuration that was bundled with the package as we
+ # use the binary.
+ 
+-DEFAULT=/etc/default/grafana
+DEFAULT=/etc/sysconfig/grafana-server
+ 
+ GRAFANA_HOME="${GRAFANA_HOME:-/usr/share/grafana}"
+ 
+@@ -13,11 +13,12 @@ CONF_DIR=/etc/grafana
+ DATA_DIR=/var/lib/grafana
+ PLUGINS_DIR=/var/lib/grafana/plugins
+ LOG_DIR=/var/log/grafana
+LIBEXEC_DIR=/usr/libexec/grafana
+ 
+ CONF_FILE=$CONF_DIR/grafana.ini
+ PROVISIONING_CFG_DIR=$CONF_DIR/provisioning
+ 
+-EXECUTABLE="$GRAFANA_HOME/bin/grafana"
+EXECUTABLE=$LIBEXEC_DIR/grafana-cli
+ 
+ if [ ! -x $EXECUTABLE ]; then
+  echo "$EXECUTABLE not installed or not executable"
+@@ -29,14 +30,23 @@ if [ -f "$DEFAULT" ]; then
+   . "$DEFAULT"
+ fi
+ 
+-OPTS="--homepath=${GRAFANA_HOME} \
+-      --config=${CONF_FILE} \
+-      --pluginsDir=${PLUGINS_DIR} \
+-      --configOverrides='cfg:default.paths.provisioning=$PROVISIONING_CFG_DIR \
+-                        cfg:default.paths.data=${DATA_DIR} \
+-                        cfg:default.paths.logs=${LOG_DIR} \
+-                        cfg:default.paths.plugins=${PLUGINS_DIR}'"
+OPTS=("--homepath=${GRAFANA_HOME}"
+      "--config=${CONF_FILE}"
+      "--pluginsDir=${PLUGINS_DIR}"
+      "--configOverrides=cfg:default.paths.provisioning=$PROVISIONING_CFG_DIR \
+                         cfg:default.paths.data=${DATA_DIR} \
+                         cfg:default.paths.logs=${LOG_DIR} \
+                         cfg:default.paths.plugins=${PLUGINS_DIR}")
+ 
+ CMD=cli
+ 
+-eval $EXECUTABLE "$CMD" "$OPTS" "$@"
+if [ "$(id -u)" -eq 0 -o "$(id -g)" -eq 0 ]; then
+  cd "${GRAFANA_HOME}"
+  exec runuser -u "${GRAFANA_USER}" -- "$EXECUTABLE" "${OPTS[@]}" "$@"
+elif [ "$(id -u -n)" = "${GRAFANA_USER}" ]; then
+  cd "${GRAFANA_HOME}"
+  exec "$EXECUTABLE" "${OPTS[@]}" "$@"
+else
+  echo "$0: please run this script as user \"${GRAFANA_USER}\" or root."
+  exit 5
+fi
--- a/0002-add-manpages.patch
+++ b/0002-add-manpages.patch
@ -0,0 +1,161 @@
+From 5b6c18f715808f99c32550fc3b670fc5bf600f72 Mon Sep 17 00:00:00 2001
+From: Andreas Gerstmayr <agerstmayr@redhat.com>
+Date: Wed, 22 Jun 2022 17:01:09 +0200
+Subject: [PATCH] add manpages
+
+
+diff --git a/docs/man/man1/grafana-cli.1 b/docs/man/man1/grafana-cli.1
+new file mode 100644
+index 0000000000..39c0d5cee0
+--- /dev/null
+++ b/docs/man/man1/grafana-cli.1
+@@ -0,0 +1,63 @@
+.TH GRAFANA "1" "September 2022" "Grafana cli version 9.0.9" "User Commands"
+.SH NAME
+grafana-cli \- command line administration for the Grafana metrics dashboard and graph editor
+.SH DESCRIPTION
+.SS "NAME:"
+.IP
+grafana-cli
+.SS "USAGE:"
+.IP
+\fBgrafana\-cli\fP [\fIglobal options\fP] \fIcommand\fP [\fIcommand options\fP] [\fIarguments\fP...]
+.SS "COMMANDS:"
+.TP
+plugins
+Manage plugins for grafana
+.TP
+admin
+Grafana admin commands
+.TP
+cue
+Cue validation commands
+.TP
+help, h
+Shows a list of commands or help for one command
+.SS "GLOBAL OPTIONS:"
+.TP
+\fB\-\-pluginsDir\fR value
+path to the grafana plugin directory (default: "/var/lib/grafana/plugins") [$GF_PLUGIN_DIR]
+.TP
+\fB\-\-repo\fR value
+url to the plugin repository (default: "https://grafana.com/api/plugins") [$GF_PLUGIN_REPO]
+.TP
+\fB\-\-pluginUrl\fR value
+Full url to the plugin zip file instead of downloading the plugin from grafana.com/api [$GF_PLUGIN_URL]
+.TP
+\fB\-\-insecure\fR
+Skip TLS verification (insecure) (default: false)
+.TP
+\fB\-\-debug\fR
+Enable debug logging (default: false)
+.TP
+\fB\-\-configOverrides\fR value
+Configuration options to override defaults as a string. e.g. cfg:default.paths.log=/dev/null
+.TP
+\fB\-\-homepath\fR value
+Path to Grafana install/home path, defaults to working directory
+.TP
+\fB\-\-config\fR value
+Path to config file
+.TP
+\fB\-\-help\fR, \fB\-h\fR
+show help
+.TP
+\fB\-\-version\fR, \fB\-v\fR
+print the version
+.SH "SEE ALSO"
+Additional documentation for
+.B grafana-cli
+is available on-line at
+.BR http://docs.grafana.org/administration/cli/ .
+The full documentation for
+.B Grafana
+is available on-line at
+.BR http://docs.grafana.org/ .
+diff --git a/docs/man/man1/grafana-server.1 b/docs/man/man1/grafana-server.1
+new file mode 100644
+index 0000000000..683a2369cc
+--- /dev/null
+++ b/docs/man/man1/grafana-server.1
+@@ -0,0 +1,80 @@
+.TH VERSION "1" "September 2022" "Version 9.0.9" "User Commands"
+.SH NAME
+grafana-server \- back-end server for the Grafana metrics dashboard and graph editor
+.SH DESCRIPTION
+.B grafana-server
+is the back-end server for the Grafana metrics dashboard and graph editor.
+The
+.B grafana-server
+program should not normally be run from the command line,
+except when testing or for development purposes.
+Rather it should be managed by
+.BR systemd .
+After installing Grafana, the systemd service should be enabled and started as follows:
+.P
+.in 1i
+.B systemctl daemon-reload
+.br
+.B systemctl enable grafana-server.service
+.br
+.B systemctl start grafana-server.service
+.in
+.P
+.SH OPTIONS
+The
+.B grafana-server
+configuration is specified in
+.BR /etc/grafana/grafana.ini
+and is well documented with comments.
+The command-line options listed below override options of
+the same (or similar) name in the configuration file.
+.P
+.HP
+\fB\-config\fR string
+.IP
+path to config file
+.HP
+\fB\-homepath\fR string
+.IP
+path to grafana install/home path, defaults to working directory
+.HP
+\fB\-packaging\fR string
+.IP
+describes the way Grafana was installed (default "unknown")
+.HP
+\fB\-pidfile\fR string
+.IP
+path to pid file
+.HP
+\fB\-profile\fR
+.IP
+Turn on pprof profiling
+.HP
+\fB\-profile\-addr\fR string
+.IP
+Define custom address for profiling (default "localhost")
+.HP
+\fB\-profile\-port\fR uint
+.IP
+Define custom port for profiling (default 6060)
+.HP
+\fB\-tracing\fR
+.IP
+Turn on tracing
+.HP
+\fB\-tracing\-file\fR string
+.IP
+Define tracing output file (default "trace.out")
+.TP
+\fB\-v\fR
+.IP
+prints current version and exits
+.TP
+\fB\-vv\fR
+.IP
+prints current version, all dependencies and exits
+.SH "SEE ALSO"
+The full documentation for
+.B Grafana
+is available on-line at
+.BR http://docs.grafana.org/ .
--- a/0003-update-default-configuration.patch
+++ b/0003-update-default-configuration.patch
@ -0,0 +1,72 @@
+From 026c4f235fd3bfc741304a5e12e13bd1c7b85eac Mon Sep 17 00:00:00 2001
+From: Andreas Gerstmayr <agerstmayr@redhat.com>
+Date: Wed, 22 Jun 2022 17:05:48 +0200
+Subject: [PATCH] update default configuration
+
+
+diff --git a/conf/defaults.ini b/conf/defaults.ini
+index 9f7cf4a90b..e1e5468bfa 100644
+--- a/conf/defaults.ini
+++ b/conf/defaults.ini
+@@ -240,7 +240,7 @@ user_agent =
+ # No ip addresses are being tracked, only simple counters to track
+ # running instances, dashboard and error counts. It is very helpful to us.
+ # Change this option to false to disable reporting.
+-reporting_enabled = true
+reporting_enabled = false
+ 
+ # The name of the distributor of the Grafana instance. Ex hosted-grafana, grafana-labs
+ reporting_distributor = grafana-labs
+@@ -249,8 +249,8 @@ reporting_distributor = grafana-labs
+ # for new versions of grafana. The check is used
+ # in some UI views to notify that a grafana update exists.
+ # This option does not cause any auto updates, nor send any information
+-# only a GET request to https://grafana.com/api/grafana/versions/stable to get the latest version.
+-check_for_updates = true
+# only a GET request to https://raw.githubusercontent.com/grafana/grafana/main/latest.json to get the latest version.
+check_for_updates = false
+ 
+ # Set to false to disable all checks to https://grafana.com
+ # for new versions of plugins. The check is used
+diff --git a/conf/sample.ini b/conf/sample.ini
+index 916de769f9..2f270d4940 100644
+--- a/conf/sample.ini
+++ b/conf/sample.ini
+@@ -247,7 +247,7 @@
+ # No ip addresses are being tracked, only simple counters to track
+ # running instances, dashboard and error counts. It is very helpful to us.
+ # Change this option to false to disable reporting.
+-;reporting_enabled = true
+;reporting_enabled = false
+ 
+ # The name of the distributor of the Grafana instance. Ex hosted-grafana, grafana-labs
+ ;reporting_distributor = grafana-labs
+@@ -256,8 +256,8 @@
+ # for new versions of grafana. The check is used
+ # in some UI views to notify that a grafana update exists.
+ # This option does not cause any auto updates, nor send any information
+-# only a GET request to https://grafana.com/api/grafana/versions/stable to get the latest version.
+-;check_for_updates = true
+# only a GET request to https://raw.githubusercontent.com/grafana/grafana/main/latest.json to get the latest version.
+;check_for_updates = false
+ 
+ # Set to false to disable all checks to https://grafana.com
+ # for new versions of plugins. The check is used
+@@ -427,7 +427,7 @@
+ 
+ # Minimum dashboard refresh interval. When set, this will restrict users to set the refresh interval of a dashboard lower than given interval. Per default this is 5 seconds.
+ # The interval string is a possibly signed sequence of decimal numbers, followed by a unit suffix (ms, s, m, h, d), e.g. 30s or 1m.
+-;min_refresh_interval = 5s
+min_refresh_interval = 1s
+ 
+ # Path to the default home dashboard. If this value is empty, then Grafana uses StaticRootPath + "dashboards/home.json"
+ ;default_home_dashboard_path =
+@@ -1411,7 +1411,7 @@
+ ;enable_alpha = false
+ ;app_tls_skip_verify_insecure = false
+ # Enter a comma-separated list of plugin identifiers to identify plugins to load even if they are unsigned. Plugins with modified signatures are never loaded.
+-;allow_loading_unsigned_plugins =
+allow_loading_unsigned_plugins = performancecopilot-pcp-app,pcp-valkey-datasource,pcp-vector-datasource,pcp-bpftrace-datasource,pcp-flamegraph-panel,pcp-breadcrumbs-panel,pcp-troubleshooting-panel,performancecopilot-valkey-datasource,performancecopilot-vector-datasource,performancecopilot-bpftrace-datasource,performancecopilot-flamegraph-panel,performancecopilot-breadcrumbs-panel,performancecopilot-troubleshooting-panel
+ # Enable or disable installing / uninstalling / updating plugins directly from within Grafana.
+ ;plugin_admin_enabled = false
+ ;plugin_admin_external_manage_enabled = false
--- a/0004-remove-unused-backend-dependencies.patch
+++ b/0004-remove-unused-backend-dependencies.patch
@ -0,0 +1,62 @@
+From 076177ff583b8e6d92948e0a4ddde0e8992d09a3 Mon Sep 17 00:00:00 2001
+From: Andreas Gerstmayr <agerstmayr@redhat.com>
+Date: Wed, 22 Jun 2022 17:18:56 +0200
+Subject: [PATCH] remove unused backend dependencies
+
+saml and gofpdf are not used in the OSS edition of Grafana
+after editing `pkg/extensions/main.go`, run `go mod tidy`
+
+diff --git a/go.mod b/go.mod
+index fcbc09da5e..82fdf39842 100644
+--- a/go.mod
+++ b/go.mod
+@@ -45,7 +45,6 @@ require (
+ 	github.com/blang/semver/v4 v4.0.0 // @grafana/grafana-release-guild
+ 	github.com/bradfitz/gomemcache v0.0.0-20190913173617-a41fca850d0b // @grafana/backend-platform
+ 	github.com/centrifugal/centrifuge v0.30.2 // @grafana/grafana-app-platform-squad
+-	github.com/crewjam/saml v0.4.13 // @grafana/grafana-authnz-team
+ 	github.com/fatih/color v1.15.0 // @grafana/backend-platform
+ 	github.com/gchaincl/sqlhooks v1.3.0 // @grafana/backend-platform
+ 	github.com/go-ldap/ldap/v3 v3.4.4 // @grafana/grafana-authnz-team
+@@ -187,7 +186,6 @@ require (
+ 	github.com/josharian/intern v1.0.0 // indirect
+ 	github.com/jpillora/backoff v1.0.0 // indirect
+ 	github.com/mailru/easyjson v0.7.7 // indirect
+-	github.com/mattermost/xml-roundtrip-validator v0.1.0 // indirect
+ 	github.com/mattetti/filebuffer v1.0.1 // indirect
+ 	github.com/mattn/go-runewidth v0.0.13 // indirect
+ 	github.com/miekg/dns v1.1.51 // indirect
+diff --git a/go.sum b/go.sum
+index d05dfb55fd..b160387abe 100644
+--- a/go.sum
+++ b/go.sum
+@@ -1826,8 +1826,6 @@ github.com/grafana/pyroscope/api v0.3.0/go.mod h1:JggA80ToAAUACYGfwL49XoFk5aN5ec
+ github.com/grafana/regexp v0.0.0-20221122212121-6b5c0a4cb7fd/go.mod h1:M5qHK+eWfAv8VR/265dIuEpL3fNfeC21tXXp9itM24A=
+ github.com/grafana/regexp v0.0.0-20221123153739-15dc172cd2db h1:7aN5cccjIqCLTzedH7MZzRZt5/lsAHch6Z3L2ZGn5FA=
+ github.com/grafana/regexp v0.0.0-20221123153739-15dc172cd2db/go.mod h1:M5qHK+eWfAv8VR/265dIuEpL3fNfeC21tXXp9itM24A=
+-github.com/grafana/saml v0.4.15-0.20231025143828-a6c0e9b86a4c h1:1pHLC1ZTz7N5QI3jzCs5sqmVvAKe+JwGnpp9lQ+iUjY=
+-github.com/grafana/saml v0.4.15-0.20231025143828-a6c0e9b86a4c/go.mod h1:S4+611dxnKt8z/ulbvaJzcgSHsuhjVc1QHNTcr1R7Fw=
+ github.com/grafana/sqlds/v2 v2.3.10 h1:HWKhE0vR6LoEiE+Is8CSZOgaB//D1yqb2ntkass9Fd4=
+ github.com/grafana/sqlds/v2 v2.3.10/go.mod h1:c6ibxnxRVGxV/0YkEgvy7QpQH/lyifFyV7K/14xvdIs=
+ github.com/grafana/tempo v1.5.1-0.20230524121406-1dc1bfe7085b h1:mDlkqgTEJuK7vjPG44f3ZMtId5AAYLWHvBVbiGqIOOQ=
+@@ -2222,8 +2220,6 @@ github.com/markbates/sigtx v1.0.0/go.mod h1:QF1Hv6Ic6Ca6W+T+DL0Y/ypborFKyvUY9Hmu
+ github.com/markbates/willie v1.0.9/go.mod h1:fsrFVWl91+gXpx/6dv715j7i11fYPfZ9ZGfH0DQzY7w=
+ github.com/matryer/is v1.4.0 h1:sosSmIWwkYITGrxZ25ULNDeKiMNzFSr4V/eqBQP0PeE=
+ github.com/matryer/is v1.4.0/go.mod h1:8I/i5uYgLzgsgEloJE1U6xx5HkBQpAZvepWuujKwMRU=
+-github.com/mattermost/xml-roundtrip-validator v0.1.0 h1:RXbVD2UAl7A7nOTR4u7E3ILa4IbtvKBHw64LDsmu9hU=
+-github.com/mattermost/xml-roundtrip-validator v0.1.0/go.mod h1:qccnGMcpgwcNaBnxqpJpWWUiPNr5H3O8eDgGV9gT5To=
+ github.com/mattetti/filebuffer v1.0.1 h1:gG7pyfnSIZCxdoKq+cPa8T0hhYtD9NxCdI4D7PTjRLM=
+ github.com/mattetti/filebuffer v1.0.1/go.mod h1:YdMURNDOttIiruleeVr6f56OrMc+MydEnTcXwtkxNVs=
+ github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
+diff --git a/pkg/extensions/main.go b/pkg/extensions/main.go
+index 327e208221..426aad2a21 100644
+--- a/pkg/extensions/main.go
+++ b/pkg/extensions/main.go
+@@ -11,7 +11,6 @@ import (
+ 	_ "github.com/beevik/etree"
+ 	_ "github.com/blugelabs/bluge"
+ 	_ "github.com/blugelabs/bluge_segment_api"
+-	_ "github.com/crewjam/saml"
+ 	_ "github.com/go-jose/go-jose/v3"
+ 	_ "github.com/gobwas/glob"
+ 	_ "github.com/googleapis/gax-go/v2"
--- a/0005-remove-unused-frontend-crypto.patch
+++ b/0005-remove-unused-frontend-crypto.patch
@ -0,0 +1,333 @@
+From ddd615152004e0bc5985a574c05d31778351dfa3 Mon Sep 17 00:00:00 2001
+From: Andreas Gerstmayr <agerstmayr@redhat.com>
+Date: Wed, 22 Jun 2022 17:36:47 +0200
+Subject: [PATCH] remove unused frontend crypto
+
+update `package.json` and then run `yarn install` to update the
+`yarn.lock` lockfile
+
+diff --git a/package.json b/package.json
+index 38deb6d7de..aad5e88bf0 100644
+--- a/package.json
+++ b/package.json
+@@ -425,6 +425,9 @@
+   "resolutions": {
+     "underscore": "1.13.6",
+     "@types/slate": "0.47.11",
+    "crypto-browserify": "https://registry.yarnpkg.com/@favware/skip-dependency/-/skip-dependency-1.1.3.tgz",
+    "selfsigned": "https://registry.yarnpkg.com/@favware/skip-dependency/-/skip-dependency-1.1.3.tgz",
+    "http-signature": "https://registry.yarnpkg.com/@favware/skip-dependency/-/skip-dependency-1.1.3.tgz",
+     "ngtemplate-loader/loader-utils": "^2.0.0",
+     "semver@~7.0.0": "7.5.4",
+     "semver@7.3.4": "7.5.4",
+diff --git a/yarn.lock b/yarn.lock
+index bf22ba52a1..1552ddc052 100644
+--- a/yarn.lock
+++ b/yarn.lock
+@@ -10935,22 +10935,6 @@ __metadata:
+   languageName: node
+   linkType: hard
+ 
+-"asn1@npm:~0.2.3":
+-  version: 0.2.6
+-  resolution: "asn1@npm:0.2.6"
+-  dependencies:
+-    safer-buffer: "npm:~2.1.0"
+-  checksum: cf629291fee6c1a6f530549939433ebf32200d7849f38b810ff26ee74235e845c0c12b2ed0f1607ac17383d19b219b69cefa009b920dab57924c5c544e495078
+-  languageName: node
+-  linkType: hard
+-
+-"assert-plus@npm:1.0.0, assert-plus@npm:^1.0.0":
+-  version: 1.0.0
+-  resolution: "assert-plus@npm:1.0.0"
+-  checksum: f4f991ae2df849cc678b1afba52d512a7cbf0d09613ba111e72255409ff9158550c775162a47b12d015d1b82b3c273e8e25df0e4783d3ddb008a293486d00a07
+-  languageName: node
+-  linkType: hard
+-
+ "assert@npm:2.0.0, assert@npm:^2.0.0":
+   version: 2.0.0
+   resolution: "assert@npm:2.0.0"
+@@ -11427,15 +11411,6 @@ __metadata:
+   languageName: node
+   linkType: hard
+ 
+-"bcrypt-pbkdf@npm:^1.0.0":
+-  version: 1.0.2
+-  resolution: "bcrypt-pbkdf@npm:1.0.2"
+-  dependencies:
+-    tweetnacl: "npm:^0.14.3"
+-  checksum: 13a4cde058250dbf1fa77a4f1b9a07d32ae2e3b9e28e88a0c7a1827835bc3482f3e478c4a0cfd4da6ff0c46dae07da1061123a995372b32cc563d9975f975404
+-  languageName: node
+-  linkType: hard
+-
+ "before-after-hook@npm:^2.2.0":
+   version: 2.2.2
+   resolution: "before-after-hook@npm:2.2.2"
+@@ -12929,13 +12904,6 @@ __metadata:
+   languageName: node
+   linkType: hard
+ 
+-"core-util-is@npm:1.0.2":
+-  version: 1.0.2
+-  resolution: "core-util-is@npm:1.0.2"
+-  checksum: d0f7587346b44a1fe6c269267e037dd34b4787191e473c3e685f507229d88561c40eb18872fabfff02977301815d474300b7bfbd15396c13c5377393f7e87ec3
+-  languageName: node
+-  linkType: hard
+-
+ "core-util-is@npm:~1.0.0":
+   version: 1.0.3
+   resolution: "core-util-is@npm:1.0.3"
+@@ -13857,15 +13825,6 @@ __metadata:
+   languageName: node
+   linkType: hard
+ 
+-"dashdash@npm:^1.12.0":
+-  version: 1.14.1
+-  resolution: "dashdash@npm:1.14.1"
+-  dependencies:
+-    assert-plus: "npm:^1.0.0"
+-  checksum: 137b287fa021201ce100cef772c8eeeaaafdd2aa7282864022acf3b873021e54cb809e9c060fa164840bf54ff72d00d6e2d8da1ee5a86d7200eeefa1123a8f7f
+-  languageName: node
+-  linkType: hard
+-
+ "data-urls@npm:^3.0.2":
+   version: 3.0.2
+   resolution: "data-urls@npm:3.0.2"
+@@ -14573,16 +14532,6 @@ __metadata:
+   languageName: node
+   linkType: hard
+ 
+-"ecc-jsbn@npm:~0.1.1":
+-  version: 0.1.2
+-  resolution: "ecc-jsbn@npm:0.1.2"
+-  dependencies:
+-    jsbn: "npm:~0.1.0"
+-    safer-buffer: "npm:^2.1.0"
+-  checksum: d43591f2396196266e186e6d6928038cc11c76c3699a912cb9c13757060f7bbc7f17f47c4cb16168cdeacffc7965aef021142577e646fb3cb88810c15173eb57
+-  languageName: node
+-  linkType: hard
+-
+ "ee-first@npm:1.1.1":
+   version: 1.1.1
+   resolution: "ee-first@npm:1.1.1"
+@@ -15991,20 +15940,6 @@ __metadata:
+   languageName: node
+   linkType: hard
+ 
+-"extsprintf@npm:1.3.0":
+-  version: 1.3.0
+-  resolution: "extsprintf@npm:1.3.0"
+-  checksum: 26967d6c7ecbfb5bc5b7a6c43503dc5fafd9454802037e9fa1665e41f615da4ff5918bd6cb871a3beabed01a31eca1ccd0bdfb41231f50ad50d405a430f78377
+-  languageName: node
+-  linkType: hard
+-
+-"extsprintf@npm:^1.2.0":
+-  version: 1.4.1
+-  resolution: "extsprintf@npm:1.4.1"
+-  checksum: bfd6d55f3c0c04d826fe0213264b383c03f32825af6b1ff777f3f2dc49467e599361993568d75b7b19a8ea1bb08c8e7cd8c3d87d179ced91bb0dcf81ca6938e0
+-  languageName: node
+-  linkType: hard
+-
+ "fast-deep-equal@npm:^3.1.1, fast-deep-equal@npm:^3.1.3":
+   version: 3.1.3
+   resolution: "fast-deep-equal@npm:3.1.3"
+@@ -16916,15 +16851,6 @@ __metadata:
+   languageName: node
+   linkType: hard
+ 
+-"getpass@npm:^0.1.1":
+-  version: 0.1.7
+-  resolution: "getpass@npm:0.1.7"
+-  dependencies:
+-    assert-plus: "npm:^1.0.0"
+-  checksum: ab18d55661db264e3eac6012c2d3daeafaab7a501c035ae0ccb193c3c23e9849c6e29b6ac762b9c2adae460266f925d55a3a2a3a3c8b94be2f222df94d70c046
+-  languageName: node
+-  linkType: hard
+-
+ "giget@npm:^1.0.0":
+   version: 1.1.2
+   resolution: "giget@npm:1.1.2"
+@@ -18263,25 +18189,10 @@ __metadata:
+   languageName: node
+   linkType: hard
+ 
+-"http-signature@npm:~1.2.0":
+-  version: 1.2.0
+-  resolution: "http-signature@npm:1.2.0"
+-  dependencies:
+-    assert-plus: "npm:^1.0.0"
+-    jsprim: "npm:^1.2.2"
+-    sshpk: "npm:^1.7.0"
+-  checksum: 2ff7112e6b0d8f08b382dfe705078c655501f2ddd76cf589d108445a9dd388a0a9be928c37108261519a7f53e6bbd1651048d74057b804807cce1ec49e87a95b
+-  languageName: node
+-  linkType: hard
+-
+-"http-signature@npm:~1.3.6":
+-  version: 1.3.6
+-  resolution: "http-signature@npm:1.3.6"
+-  dependencies:
+-    assert-plus: "npm:^1.0.0"
+-    jsprim: "npm:^2.0.2"
+-    sshpk: "npm:^1.14.1"
+-  checksum: 5f08e0c82174999da97114facb0d0d47e268d60b6fc10f92cb87b99d5ccccd36f79b9508c29dda0b4f4e3a1b2f7bcaf847e68ecd5da2f1fc465fcd1d054b7884
+"http-signature@https://registry.yarnpkg.com/@favware/skip-dependency/-/skip-dependency-1.1.3.tgz":
+  version: 1.1.3
+  resolution: "http-signature@https://registry.yarnpkg.com/@favware/skip-dependency/-/skip-dependency-1.1.3.tgz"
+  checksum: 78b64605540e2d25bede2d74ec9e7740ab9a466c9a562ae3a8ccc7e07e26e601a013859c94adf890679403cd337b9690f598d64bc4fbc1d2eaa2f27241ca08a1
+   languageName: node
+   linkType: hard
+ 
+@@ -20609,13 +20520,6 @@ __metadata:
+   languageName: node
+   linkType: hard
+ 
+-"jsbn@npm:~0.1.0":
+-  version: 0.1.1
+-  resolution: "jsbn@npm:0.1.1"
+-  checksum: 5450133242845100e694f0ef9175f44c012691a9b770b2571e677314e6f70600abb10777cdfc9a0c6a9f2ac6d134577403633de73e2fcd0f97875a67744e2d14
+-  languageName: node
+-  linkType: hard
+-
+ "jscodeshift@npm:^0.14.0":
+   version: 0.14.0
+   resolution: "jscodeshift@npm:0.14.0"
+@@ -20767,13 +20671,6 @@ __metadata:
+   languageName: node
+   linkType: hard
+ 
+-"json-schema@npm:0.4.0":
+-  version: 0.4.0
+-  resolution: "json-schema@npm:0.4.0"
+-  checksum: 8b3b64eff4a807dc2a3045b104ed1b9335cd8d57aa74c58718f07f0f48b8baa3293b00af4dcfbdc9144c3aafea1e97982cc27cc8e150fc5d93c540649507a458
+-  languageName: node
+-  linkType: hard
+-
+ "json-source-map@npm:0.6.1":
+   version: 0.6.1
+   resolution: "json-source-map@npm:0.6.1"
+@@ -20886,30 +20783,6 @@ __metadata:
+   languageName: node
+   linkType: hard
+ 
+-"jsprim@npm:^1.2.2":
+-  version: 1.4.2
+-  resolution: "jsprim@npm:1.4.2"
+-  dependencies:
+-    assert-plus: "npm:1.0.0"
+-    extsprintf: "npm:1.3.0"
+-    json-schema: "npm:0.4.0"
+-    verror: "npm:1.10.0"
+-  checksum: df2bf234eab1b5078d01bcbff3553d50a243f7b5c10a169745efeda6344d62798bd1d85bcca6a8446f3b5d0495e989db45f9de8dae219f0f9796e70e0c776089
+-  languageName: node
+-  linkType: hard
+-
+-"jsprim@npm:^2.0.2":
+-  version: 2.0.2
+-  resolution: "jsprim@npm:2.0.2"
+-  dependencies:
+-    assert-plus: "npm:1.0.0"
+-    extsprintf: "npm:1.3.0"
+-    json-schema: "npm:0.4.0"
+-    verror: "npm:1.10.0"
+-  checksum: fcfca5b55f83e1b8be5f932c71754bd37afd2611f81685abd05689e8ce718a91155ff7bd5b94c65ce483a787b5c43c6d0c18c1d2259fca5bb61a3f8ea2e29c0a
+-  languageName: node
+-  linkType: hard
+-
+ "jsurl@npm:^0.1.5":
+   version: 0.1.5
+   resolution: "jsurl@npm:0.1.5"
+@@ -22734,7 +22607,7 @@ __metadata:
+   languageName: node
+   linkType: hard
+ 
+-"node-forge@npm:^1, node-forge@npm:^1.3.1":
+"node-forge@npm:^1.3.1":
+   version: 1.3.1
+   resolution: "node-forge@npm:1.3.1"
+   checksum: 05bab6868633bf9ad4c3b1dd50ec501c22ffd69f556cdf169a00998ca1d03e8107a6032ba013852f202035372021b845603aeccd7dfcb58cdb7430013b3daa8d
+@@ -27151,7 +27024,7 @@ __metadata:
+   languageName: node
+   linkType: hard
+ 
+-"safer-buffer@npm:>= 2.1.2 < 3, safer-buffer@npm:>= 2.1.2 < 3.0.0, safer-buffer@npm:^2.0.2, safer-buffer@npm:^2.1.0, safer-buffer@npm:~2.1.0":
+"safer-buffer@npm:>= 2.1.2 < 3, safer-buffer@npm:>= 2.1.2 < 3.0.0":
+   version: 2.1.2
+   resolution: "safer-buffer@npm:2.1.2"
+   checksum: 7eaf7a0cf37cc27b42fb3ef6a9b1df6e93a1c6d98c6c6702b02fe262d5fcbd89db63320793b99b21cb5348097d0a53de81bd5f4e8b86e20cc9412e3f1cfb4e83
+@@ -27282,12 +27155,10 @@ __metadata:
+   languageName: node
+   linkType: hard
+ 
+-"selfsigned@npm:^2.1.1":
+-  version: 2.1.1
+-  resolution: "selfsigned@npm:2.1.1"
+-  dependencies:
+-    node-forge: "npm:^1"
+-  checksum: 6005206e0d005448274aceceaded5195b944f67a42b72d212a6169d2e5f4bdc87c15a3fe45732c544db8c7175702091aaf95403ad6632585294a6ec8cca63638
+"selfsigned@https://registry.yarnpkg.com/@favware/skip-dependency/-/skip-dependency-1.1.3.tgz":
+  version: 1.1.3
+  resolution: "selfsigned@https://registry.yarnpkg.com/@favware/skip-dependency/-/skip-dependency-1.1.3.tgz"
+  checksum: 4988a0dbdf123fb808194a6198f5951e2df711de6fd967d72a8876baccaa23d5c260efb8f1dbfbc5bf1f852e81f897ad09267908977ab94862867ef971a3d48d
+   languageName: node
+   linkType: hard
+ 
+@@ -28053,27 +27924,6 @@ __metadata:
+   languageName: node
+   linkType: hard
+ 
+-"sshpk@npm:^1.14.1, sshpk@npm:^1.7.0":
+-  version: 1.17.0
+-  resolution: "sshpk@npm:1.17.0"
+-  dependencies:
+-    asn1: "npm:~0.2.3"
+-    assert-plus: "npm:^1.0.0"
+-    bcrypt-pbkdf: "npm:^1.0.0"
+-    dashdash: "npm:^1.12.0"
+-    ecc-jsbn: "npm:~0.1.1"
+-    getpass: "npm:^0.1.1"
+-    jsbn: "npm:~0.1.0"
+-    safer-buffer: "npm:^2.0.2"
+-    tweetnacl: "npm:~0.14.0"
+-  bin:
+-    sshpk-conv: bin/sshpk-conv
+-    sshpk-sign: bin/sshpk-sign
+-    sshpk-verify: bin/sshpk-verify
+-  checksum: 668c2a279a6ce66fd739ce5684e37927dd75427cc020c828a208f85890a4c400705d4ba09f32fa44efca894339dc6931941664f6f6ba36dfa543de6d006cbe9c
+-  languageName: node
+-  linkType: hard
+-
+ "ssri@npm:^10.0.0, ssri@npm:^10.0.1":
+   version: 10.0.5
+   resolution: "ssri@npm:10.0.5"
+@@ -29479,13 +29329,6 @@ __metadata:
+   languageName: node
+   linkType: hard
+ 
+-"tweetnacl@npm:^0.14.3, tweetnacl@npm:~0.14.0":
+-  version: 0.14.5
+-  resolution: "tweetnacl@npm:0.14.5"
+-  checksum: 04ee27901cde46c1c0a64b9584e04c96c5fe45b38c0d74930710751ea991408b405747d01dfae72f80fc158137018aea94f9c38c651cb9c318f0861a310c3679
+-  languageName: node
+-  linkType: hard
+-
+ "type-check@npm:^0.4.0, type-check@npm:~0.4.0":
+   version: 0.4.0
+   resolution: "type-check@npm:0.4.0"
+@@ -30199,17 +30042,6 @@ __metadata:
+   languageName: node
+   linkType: soft
+ 
+-"verror@npm:1.10.0":
+-  version: 1.10.0
+-  resolution: "verror@npm:1.10.0"
+-  dependencies:
+-    assert-plus: "npm:^1.0.0"
+-    core-util-is: "npm:1.0.2"
+-    extsprintf: "npm:^1.2.0"
+-  checksum: da548149dd9c130a8a2587c9ee71ea30128d1526925707e2d01ed9c5c45c9e9f86733c66a328247cdd5f7c1516fb25b0f959ba754bfbe15072aa99ff96468a29
+-  languageName: node
+-  linkType: hard
+-
+ "vinyl-fs@npm:^3.0.2":
+   version: 3.0.3
+   resolution: "vinyl-fs@npm:3.0.3"
--- a/0006-skip-marketplace-plugin-install-test.patch
+++ b/0006-skip-marketplace-plugin-install-test.patch
@ -0,0 +1,21 @@
+From ed8a438d72a667844ae07804491b568ad2f5dcdd Mon Sep 17 00:00:00 2001
+From: Andreas Gerstmayr <agerstmayr@redhat.com>
+Date: Thu, 23 Jun 2022 17:00:46 +0200
+Subject: [PATCH] skip marketplace plugin install test
+
+This test (tries to) install a plugin from the Grafana marketplace.
+Network connectivity is disabled in the build environment for security
+reasons, therefore we need to disable this test.
+
+diff --git a/pkg/tests/api/plugins/api_plugins_test.go b/pkg/tests/api/plugins/api_plugins_test.go
+index 4fc2295ed8..a326c40b04 100644
+--- a/pkg/tests/api/plugins/api_plugins_test.go
+++ b/pkg/tests/api/plugins/api_plugins_test.go
+@@ -71,6 +71,7 @@ func TestIntegrationPlugins(t *testing.T) {
+ 		})
+ 
+ 		t.Run("Request is not forbidden if from an admin", func(t *testing.T) {
+			t.Skip("this test requires connectivity to the Grafana plugin marketplace (fetching metadata)")
+ 			statusCode, body := makePostRequest(t, grafanaAPIURL(usernameAdmin, grafanaListedAddr, "plugins/test/install"))
+ 
+ 			assert.Equal(t, 404, statusCode)
--- a/0007-redact-weak-ciphers.patch
+++ b/0007-redact-weak-ciphers.patch
@ -0,0 +1,30 @@
+From 7ac26d6beb2175f0d6001ca0df322ce610401cce Mon Sep 17 00:00:00 2001
+From: Stan Cox <scox@redhat.com>
+Date: Wed, 22 Jun 2022 17:05:48 +0200
+Subject: [PATCH] redact weak ciphers
+
+
+diff --git a/pkg/api/http_server.go b/pkg/api/http_server.go
+index da04044683..8a29270d4d 100644
+--- a/pkg/api/http_server.go
+++ b/pkg/api/http_server.go
+@@ -820,13 +820,13 @@ func (hs *HTTPServer) getDefaultCiphers(tlsVersion uint16, protocol string) []ui
+ 			tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+ 			tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+ 			tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+-			tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
+			//			tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
+ 			tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
+-			tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
+-			tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
+-			tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
+-			tls.TLS_RSA_WITH_AES_128_CBC_SHA,
+-			tls.TLS_RSA_WITH_AES_256_CBC_SHA,
+			//			tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
+			//			tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
+			//			tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
+			//			tls.TLS_RSA_WITH_AES_128_CBC_SHA,
+			//			tls.TLS_RSA_WITH_AES_256_CBC_SHA,
+ 		}
+ 	}
+ 	if protocol == "h2" {
--- a/0008-replace-faulty-slices-sort.patch
+++ b/0008-replace-faulty-slices-sort.patch
@ -0,0 +1,40 @@
+From 3f45f26993ed94837001bb9760d7859e7a057649 Mon Sep 17 00:00:00 2001
+From: Sam Feifer <sfeifer@redhat.com>
+Date: Fri, 1 Mar 2024 15:00:55 -0500
+Subject: [PATCH] replace faulty slices sort
+
+
+diff --git a/pkg/services/sqlstore/migrator/dialect.go b/pkg/services/sqlstore/migrator/dialect.go
+index 183b619de8..da21edeafa 100644
+--- a/pkg/services/sqlstore/migrator/dialect.go
+++ b/pkg/services/sqlstore/migrator/dialect.go
+@@ -368,7 +368,8 @@ func (b *BaseDialect) InsertQuery(tableName string, row map[string]any) (string,
+ 	for col := range row {
+ 		keys = append(keys, col)
+ 	}
+-	slices.Sort[string](keys)
+	slices.Sort(keys)
+	//slices.Sort[string](keys)
+ 
+ 	// build query and values
+ 	for _, col := range keys {
+@@ -398,7 +399,8 @@ func (b *BaseDialect) UpdateQuery(tableName string, row map[string]any, where ma
+ 	for col := range row {
+ 		keys = append(keys, col)
+ 	}
+-	slices.Sort[string](keys)
+	slices.Sort(keys)
+	//slices.Sort[string](keys)
+ 
+ 	// build update query and values
+ 	for _, col := range keys {
+@@ -411,7 +413,8 @@ func (b *BaseDialect) UpdateQuery(tableName string, row map[string]any, where ma
+ 	for col := range where {
+ 		keys = append(keys, col)
+ 	}
+-	slices.Sort[string](keys)
+	slices.Sort(keys)
+	//slices.Sort[string](keys)
+ 
+ 	// build where clause and values
+ 	for _, col := range keys {
--- a/0009-update-wrappers-and-systemd-with-distro-paths.patch
+++ b/0009-update-wrappers-and-systemd-with-distro-paths.patch
@ -0,0 +1,76 @@
+From 5fe02f961e67af04907dc57beda42456128ab1c8 Mon Sep 17 00:00:00 2001
+From: Sam Feifer <sfeifer@redhat.com>
+Date: Fri, 1 Mar 2024 15:05:24 -0500
+Subject: [PATCH] update wrappers and systemd with distro paths
+
+
+diff --git a/packaging/rpm/systemd/grafana-server.service b/packaging/rpm/systemd/grafana-server.service
+index e3adc3f469..b2e4aced06 100644
+--- a/packaging/rpm/systemd/grafana-server.service
+++ b/packaging/rpm/systemd/grafana-server.service
+@@ -14,7 +14,7 @@ Restart=on-failure
+ WorkingDirectory=/usr/share/grafana
+ RuntimeDirectory=grafana
+ RuntimeDirectoryMode=0750
+-ExecStart=/usr/share/grafana/bin/grafana server                                     \
+ExecStart=/usr/sbin/grafana server                                     \
+                             --config=${CONF_FILE}                                   \
+                             --pidfile=${PID_FILE_DIR}/grafana-server.pid            \
+                             --packaging=rpm                                         \
+diff --git a/packaging/wrappers/grafana b/packaging/wrappers/grafana
+index 86e0fc9faa..5c88bae4c3 100755
+--- a/packaging/wrappers/grafana
+++ b/packaging/wrappers/grafana
+@@ -5,7 +5,7 @@
+ # the system-wide Grafana configuration that was bundled with the package as we
+ # use the binary.
+ 
+-DEFAULT=/etc/default/grafana
+DEFAULT=/etc/sysconfig/grafana-server
+ 
+ GRAFANA_HOME="${GRAFANA_HOME:-/usr/share/grafana}"
+ 
+@@ -13,11 +13,12 @@ CONF_DIR=/etc/grafana
+ DATA_DIR=/var/lib/grafana
+ PLUGINS_DIR=/var/lib/grafana/plugins
+ LOG_DIR=/var/log/grafana
++LIBEXEC_DIR=/usr/libexec/grafana
+ 
+ CONF_FILE=$CONF_DIR/grafana.ini
+ PROVISIONING_CFG_DIR=$CONF_DIR/provisioning
+ 
+-EXECUTABLE="$GRAFANA_HOME/bin/grafana"
++EXECUTABLE=$LIBEXEC_DIR/grafana
+ 
+ if [ ! -x $EXECUTABLE ]; then
+  echo "$EXECUTABLE not installed or not executable"
+@@ -46,4 +47,13 @@ if [ "$CMD" = cli ]; then
+        --pluginsDir=${PLUGINS_DIR}"
+ fi
+ 
+-eval $EXECUTABLE "$CMD" "$OPTS" "$@"
+if [ "$(id -u)" -eq 0 -o "$(id -g)" -eq 0 ]; then
+  cd "${GRAFANA_HOME}"
+  exec runuser -u "${GRAFANA_USER}" -- "$EXECUTABLE" "$CMD" "${OPTS[@]}" "$@"
+elif [ "$(id -u -n)" = "${GRAFANA_USER}" ]; then
+  cd "${GRAFANA_HOME}"
+  exec "$EXECUTABLE" "$CMD" "${OPTS[@]}" "$@"
+else
+  echo "$0: please run this script as user \"${GRAFANA_USER}\" or root."
+  exit 5
+fi
+\ No newline at end of file
+diff --git a/packaging/wrappers/grafana-server b/packaging/wrappers/grafana-server
+index 466b0d7c69..6be356f562 100755
+--- a/packaging/wrappers/grafana-server
+++ b/packaging/wrappers/grafana-server
+@@ -7,7 +7,8 @@
+ 
+ GRAFANA_HOME="${GRAFANA_HOME:-/usr/share/grafana}"
+ 
+-EXECUTABLE="$GRAFANA_HOME/bin/grafana"
+LIBEXEC_DIR=/usr/libexec/grafana
+EXECUTABLE=$LIBEXEC_DIR/grafana
+ 
+ if [ ! -x $EXECUTABLE ]; then
+  echo "$EXECUTABLE not installed or not executable"
--- a/001-login-oauth-use-oauth2-exchange.patch
+++ b/001-login-oauth-use-oauth2-exchange.patch
@ -1,13 +0,0 @@
-diff --git a/pkg/api/login_oauth.go b/pkg/api/login_oauth.go
-index a3599bc7a..0c6579847 100644
--- a/pkg/api/login_oauth.go
-+++ b/pkg/api/login_oauth.go
-@@ -125,7 +125,7 @@ func (hs *HTTPServer) OAuthLogin(ctx *m.ReqContext) {
- 	oauthCtx := context.WithValue(context.Background(), oauth2.HTTPClient, oauthClient)
- 
- 	// get token from provider
-	token, err := connect.Exchange(oauthCtx, code)
-+	token, err := connect.Exchange(oauthCtx, code, oauth2.AccessTypeOnline)
- 	if err != nil {
- 		ctx.Handle(500, "login.OAuthLogin(NewTransportWithCode)", err)
- 		return
--- a/0010-remove-bcrypt-references.patch
+++ b/0010-remove-bcrypt-references.patch
@ -0,0 +1,108 @@
+From eb711315d4c8a81ff52984293758a47372c21b8d Mon Sep 17 00:00:00 2001
+From: Sam Feifer <sfeifer@redhat.com>
+Date: Fri, 1 Mar 2024 15:07:22 -0500
+Subject: [PATCH] remove bcrypt references
+
+
+diff --git a/pkg/services/extsvcauth/oauthserver/oasimpl/service.go b/pkg/services/extsvcauth/oauthserver/oasimpl/service.go
+index 8c5a90248d..43f6d11e08 100644
+--- a/pkg/services/extsvcauth/oauthserver/oasimpl/service.go
+++ b/pkg/services/extsvcauth/oauthserver/oasimpl/service.go
+@@ -19,7 +19,6 @@ import (
+ 	"github.com/ory/fosite/compose"
+ 	"github.com/ory/fosite/storage"
+ 	"github.com/ory/fosite/token/jwt"
+-	"golang.org/x/crypto/bcrypt"
+ 
+ 	"github.com/grafana/grafana/pkg/api/routing"
+ 	"github.com/grafana/grafana/pkg/bus"
+@@ -235,88 +234,7 @@ func (s *OAuth2ServiceImpl) RemoveExternalService(ctx context.Context, name stri
+ // it ensures that the associated service account has the correct permissions.
+ // Database consistency is not guaranteed, consider changing this in the future.
+ func (s *OAuth2ServiceImpl) SaveExternalService(ctx context.Context, registration *extsvcauth.ExternalServiceRegistration) (*extsvcauth.ExternalService, error) {
+-	if registration == nil {
+-		s.logger.Warn("RegisterExternalService called without registration")
+-		return nil, nil
+-	}
+-	slug := registration.Name
+-	s.logger.Info("Registering external service", "external service", slug)
+-
+-	// Check if the client already exists in store
+-	client, errFetchExtSvc := s.sqlstore.GetExternalServiceByName(ctx, slug)
+-	if errFetchExtSvc != nil && !errors.Is(errFetchExtSvc, oauthserver.ErrClientNotFound) {
+-		s.logger.Error("Error fetching service", "external service", slug, "error", errFetchExtSvc)
+-		return nil, errFetchExtSvc
+-	}
+-	// Otherwise, create a new client
+-	if client == nil {
+-		s.logger.Debug("External service does not yet exist", "external service", slug)
+-		client = &oauthserver.OAuthExternalService{
+-			Name:             slug,
+-			ServiceAccountID: oauthserver.NoServiceAccountID,
+-			Audiences:        s.cfg.AppURL,
+-		}
+-	}
+-
+-	// Parse registration form to compute required permissions for the client
+-	client.SelfPermissions, client.ImpersonatePermissions = s.handleRegistrationPermissions(registration)
+-
+-	if registration.OAuthProviderCfg == nil {
+-		return nil, errors.New("missing oauth provider configuration")
+-	}
+-
+-	if registration.OAuthProviderCfg.RedirectURI != nil {
+-		client.RedirectURI = *registration.OAuthProviderCfg.RedirectURI
+-	}
+-
+-	var errGenCred error
+-	client.ClientID, client.Secret, errGenCred = s.genCredentials()
+-	if errGenCred != nil {
+-		s.logger.Error("Error generating credentials", "client", client.LogID(), "error", errGenCred)
+-		return nil, errGenCred
+-	}
+-
+-	grantTypes := s.computeGrantTypes(registration.Self.Enabled, registration.Impersonation.Enabled)
+-	client.GrantTypes = strings.Join(grantTypes, ",")
+-
+-	// Handle key options
+-	s.logger.Debug("Handle key options")
+-	keys, err := s.handleKeyOptions(ctx, registration.OAuthProviderCfg.Key)
+-	if err != nil {
+-		s.logger.Error("Error handling key options", "client", client.LogID(), "error", err)
+-		return nil, err
+-	}
+-	if keys != nil {
+-		client.PublicPem = []byte(keys.PublicPem)
+-	}
+-	dto := client.ToExternalService(keys)
+-
+-	hashedSecret, err := bcrypt.GenerateFromPassword([]byte(client.Secret), bcrypt.DefaultCost)
+-	if err != nil {
+-		s.logger.Error("Error hashing secret", "client", client.LogID(), "error", err)
+-		return nil, err
+-	}
+-	client.Secret = string(hashedSecret)
+-
+-	s.logger.Debug("Save service account")
+-	saID, errSaveServiceAccount := s.saService.ManageExtSvcAccount(ctx, &serviceaccounts.ManageExtSvcAccountCmd{
+-		ExtSvcSlug:  slugify.Slugify(client.Name),
+-		Enabled:     registration.Self.Enabled,
+-		OrgID:       oauthserver.TmpOrgID,
+-		Permissions: client.SelfPermissions,
+-	})
+-	if errSaveServiceAccount != nil {
+-		return nil, errSaveServiceAccount
+-	}
+-	client.ServiceAccountID = saID
+-
+-	err = s.sqlstore.SaveExternalService(ctx, client)
+-	if err != nil {
+-		s.logger.Error("Error saving external service", "client", client.LogID(), "error", err)
+-		return nil, err
+-	}
+-	s.logger.Debug("Registered", "client", client.LogID())
+-	return dto, nil
+	panic("bcrypt cipher not available")
+ }
+ 
+ // randString generates a a cryptographically secure random string of n bytes
--- a/0011-fix-dompurify-CVE.patch
+++ b/0011-fix-dompurify-CVE.patch
@ -0,0 +1,58 @@
+From: Sam Feifer <sfeifer@redhat.com>
+Subject: [PATCH] fix dompurify CVE
+
+diff --git a/package.json b/package.json
+index 38deb6d7dee..010a24fb451 100644
+--- a/package.json
+++ b/package.json
+@@ -432,7 +432,8 @@
+     "react-split-pane@0.1.92": "patch:react-split-pane@npm:0.1.92#.yarn/patches/react-split-pane-npm-0.1.92-93dbf51dff.patch",
+     "@storybook/blocks@7.4.5": "patch:@storybook/blocks@npm%3A7.4.5#./.yarn/patches/@storybook-blocks-npm-7.4.5-5a2374564a.patch",
+     "history@4.10.1": "patch:history@npm%3A4.10.1#./.yarn/patches/history-npm-4.10.1-ee217563ae.patch",
+-    "history@^4.9.0": "patch:history@npm%3A4.10.1#./.yarn/patches/history-npm-4.10.1-ee217563ae.patch"
+    "history@^4.9.0": "patch:history@npm%3A4.10.1#./.yarn/patches/history-npm-4.10.1-ee217563ae.patch",
+    "dompurify": "^2.5.0"
+   },
+   "workspaces": {
+     "packages": [
+diff --git a/packages/grafana-data/package.json b/packages/grafana-data/package.json
+index 2182744e61b..4201ef58dda 100644
+--- a/packages/grafana-data/package.json
+++ b/packages/grafana-data/package.json
+@@ -41,7 +41,7 @@
+     "@types/string-hash": "1.1.1",
+     "d3-interpolate": "3.0.1",
+     "date-fns": "2.30.0",
+-    "dompurify": "^2.4.3",
+    "dompurify": "^2.5.0",
+     "eventemitter3": "5.0.1",
+     "fast_array_intersect": "1.1.0",
+     "history": "4.10.1",
+diff --git a/yarn.lock b/yarn.lock
+index bf22ba52a17..88fc4d3fbfb 100644
+--- a/yarn.lock
+++ b/yarn.lock
+@@ -2953,7 +2953,7 @@ __metadata:
+     "@types/tinycolor2": "npm:1.4.3"
+     d3-interpolate: "npm:3.0.1"
+     date-fns: "npm:2.30.0"
+-    dompurify: "npm:^2.4.3"
+    dompurify: "npm:^2.5.0"
+     esbuild: "npm:0.18.12"
+     eventemitter3: "npm:5.0.1"
+     fast_array_intersect: "npm:1.1.0"
+@@ -14478,10 +14478,10 @@ __metadata:
+   languageName: node
+   linkType: hard
+ 
+-"dompurify@npm:^2.2.0, dompurify@npm:^2.4.3":
+-  version: 2.4.5
+-  resolution: "dompurify@npm:2.4.5"
+-  checksum: d764c2ff126b3749dad35bc34eed40f51141d7dfd620e938c92f08d68c32beeb259d06abadeee91f6e2a8c8737ce670e2124ac9a257ba3bcdc666598cebcde01
+"dompurify@npm:^2.5.0":
+  version: 2.5.7
+  resolution: "dompurify@npm:2.5.7"
+  checksum: b150ca1e28083252cd51097162dc96cb45203f7e2af1fbaa8ef32b4f4d6b605e4aa8915190d38bd0635cbbf14d13a200138cd3ec1b084096819b14c718355122
+   languageName: node
+   linkType: hard
+ 
--- a/0012-fix-jwt-CVE.patch
+++ b/0012-fix-jwt-CVE.patch
@ -0,0 +1,31 @@
+From: Sam Feifer <sfeifer@redhat.com>
+Subject: [PATCH] fix jwt CVE
+
+diff --git a/go.mod b/go.mod
+index fcbc09da5e6..1771902bc1c 100644
+--- a/go.mod
+++ b/go.mod
+@@ -164,7 +164,7 @@ require (
+ 	github.com/go-openapi/spec v0.20.9 // indirect
+ 	github.com/go-openapi/swag v0.22.4 // indirect
+ 	github.com/go-openapi/validate v0.22.1 // indirect
+-	github.com/golang-jwt/jwt/v4 v4.5.0 // @grafana/backend-platform
+	github.com/golang-jwt/jwt/v4 v4.5.2 // @grafana/backend-platform
+ 	github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect
+ 	github.com/golang/glog v1.1.2 // indirect
+ 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+diff --git a/go.sum b/go.sum
+index d05dfb55fd4..3a045f712eb 100644
+--- a/go.sum
+++ b/go.sum
+@@ -1593,8 +1593,9 @@ github.com/golang-jwt/jwt/v4 v4.0.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzw
+ github.com/golang-jwt/jwt/v4 v4.2.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
+ github.com/golang-jwt/jwt/v4 v4.4.1/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+ github.com/golang-jwt/jwt/v4 v4.4.3/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+-github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
+ github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
+github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+ github.com/golang-migrate/migrate/v4 v4.7.0 h1:gONcHxHApDTKXDyLH/H97gEHmpu1zcnnbAaq2zgrPrs=
+ github.com/golang-migrate/migrate/v4 v4.7.0/go.mod h1:Qvut3N4xKWjoH3sokBccML6WyHSnggXm/DvMMnTsQIc=
+ github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
--- a/0013-fix-CVE-2025-4123.patch
+++ b/0013-fix-CVE-2025-4123.patch
@ -0,0 +1,32 @@
+From 2d4314b5ca1e527a3420fad11d3f1a25351700d4 Mon Sep 17 00:00:00 2001
+From: Sam Feifer <sfeifer@redhat.com>
+Date: Wed, 7 May 2025 16:27:08 -0400
+Subject: [PATCH] fix CVE-2025-4123
+
+
+diff --git a/conf/defaults.ini b/conf/defaults.ini
+index e1e5468bfa3..4221144bf54 100644
+--- a/conf/defaults.ini
+++ b/conf/defaults.ini
+@@ -363,7 +363,7 @@ x_xss_protection = true
+ 
+ # Enable adding the Content-Security-Policy header to your requests.
+ # CSP allows to control resources the user agent is allowed to load and helps prevent XSS attacks.
+-content_security_policy = false
+content_security_policy = true
+ 
+ # Set Content Security Policy template used when adding the Content-Security-Policy header to your requests.
+ # $NONCE in the template includes a random nonce.
+diff --git a/conf/sample.ini b/conf/sample.ini
+index 51d2b6c512b..fd588b48225 100644
+--- a/conf/sample.ini
+++ b/conf/sample.ini
+@@ -364,7 +364,7 @@
+ 
+ # Enable adding the Content-Security-Policy header to your requests.
+ # CSP allows to control resources the user agent is allowed to load and helps prevent XSS attacks.
+-;content_security_policy = false
+;content_security_policy = true
+ 
+ # Set Content Security Policy template used when adding the Content-Security-Policy header to your requests.
+ # $NONCE in the template includes a random nonce.
--- a/002-remove-jaeger-tracing.patch
+++ b/002-remove-jaeger-tracing.patch
@ -1,189 +0,0 @@
-diff --git a/pkg/cmd/grafana-server/server.go b/pkg/cmd/grafana-server/server.go
-index 2ac326ed3..20943918c 100644
--- a/pkg/cmd/grafana-server/server.go
-+++ b/pkg/cmd/grafana-server/server.go
-@@ -21,7 +21,6 @@ import (
- 	_ "github.com/grafana/grafana/pkg/infra/metrics"
- 	_ "github.com/grafana/grafana/pkg/infra/remotecache"
- 	_ "github.com/grafana/grafana/pkg/infra/serverlock"
-	_ "github.com/grafana/grafana/pkg/infra/tracing"
- 	_ "github.com/grafana/grafana/pkg/infra/usagestats"
- 	"github.com/grafana/grafana/pkg/log"
- 	"github.com/grafana/grafana/pkg/login"
-diff --git a/pkg/infra/tracing/tracing.go b/pkg/infra/tracing/tracing.go
-deleted file mode 100644
-index fd7258b7a..000000000
--- a/pkg/infra/tracing/tracing.go
-+++ /dev/null
-@@ -1,129 +0,0 @@
-package tracing
-
-import (
-	"context"
-	"io"
-	"strings"
-
-	"github.com/grafana/grafana/pkg/log"
-	"github.com/grafana/grafana/pkg/registry"
-	"github.com/grafana/grafana/pkg/setting"
-
-	opentracing "github.com/opentracing/opentracing-go"
-	jaegercfg "github.com/uber/jaeger-client-go/config"
-)
-
-func init() {
-	registry.RegisterService(&TracingService{})
-}
-
-type TracingService struct {
-	enabled      bool
-	address      string
-	customTags   map[string]string
-	samplerType  string
-	samplerParam float64
-	log          log.Logger
-	closer       io.Closer
-
-	Cfg *setting.Cfg `inject:""`
-}
-
-func (ts *TracingService) Init() error {
-	ts.log = log.New("tracing")
-	ts.parseSettings()
-
-	if ts.enabled {
-		ts.initGlobalTracer()
-	}
-
-	return nil
-}
-
-func (ts *TracingService) parseSettings() {
-	var section, err = ts.Cfg.Raw.GetSection("tracing.jaeger")
-	if err != nil {
-		return
-	}
-
-	ts.address = section.Key("address").MustString("")
-	if ts.address != "" {
-		ts.enabled = true
-	}
-
-	ts.customTags = splitTagSettings(section.Key("always_included_tag").MustString(""))
-	ts.samplerType = section.Key("sampler_type").MustString("")
-	ts.samplerParam = section.Key("sampler_param").MustFloat64(1)
-}
-
-func (ts *TracingService) initGlobalTracer() error {
-	cfg := jaegercfg.Configuration{
-		ServiceName: "grafana",
-		Disabled:    !ts.enabled,
-		Sampler: &jaegercfg.SamplerConfig{
-			Type:  ts.samplerType,
-			Param: ts.samplerParam,
-		},
-		Reporter: &jaegercfg.ReporterConfig{
-			LogSpans:           false,
-			LocalAgentHostPort: ts.address,
-		},
-	}
-
-	jLogger := &jaegerLogWrapper{logger: log.New("jaeger")}
-
-	options := []jaegercfg.Option{}
-	options = append(options, jaegercfg.Logger(jLogger))
-
-	for tag, value := range ts.customTags {
-		options = append(options, jaegercfg.Tag(tag, value))
-	}
-
-	tracer, closer, err := cfg.NewTracer(options...)
-	if err != nil {
-		return err
-	}
-
-	opentracing.InitGlobalTracer(tracer)
-
-	ts.closer = closer
-
-	return nil
-}
-
-func (ts *TracingService) Run(ctx context.Context) error {
-	<-ctx.Done()
-
-	if ts.closer != nil {
-		ts.log.Info("Closing tracing")
-		ts.closer.Close()
-	}
-
-	return nil
-}
-
-func splitTagSettings(input string) map[string]string {
-	res := map[string]string{}
-
-	tags := strings.Split(input, ",")
-	for _, v := range tags {
-		kv := strings.Split(v, ":")
-		if len(kv) > 1 {
-			res[kv[0]] = kv[1]
-		}
-	}
-
-	return res
-}
-
-type jaegerLogWrapper struct {
-	logger log.Logger
-}
-
-func (jlw *jaegerLogWrapper) Error(msg string) {
-	jlw.logger.Error(msg)
-}
-
-func (jlw *jaegerLogWrapper) Infof(msg string, args ...interface{}) {
-	jlw.logger.Info(msg, args)
-}
-diff --git a/pkg/infra/tracing/tracing_test.go b/pkg/infra/tracing/tracing_test.go
-deleted file mode 100644
-index 27e4de777..000000000
--- a/pkg/infra/tracing/tracing_test.go
-+++ /dev/null
-@@ -1,36 +0,0 @@
-package tracing
-
-import "testing"
-
-func TestGroupSplit(t *testing.T) {
-	tests := []struct {
-		input    string
-		expected map[string]string
-	}{
-		{
-			input: "tag1:value1,tag2:value2",
-			expected: map[string]string{
-				"tag1": "value1",
-				"tag2": "value2",
-			},
-		},
-		{
-			input:    "",
-			expected: map[string]string{},
-		},
-		{
-			input:    "tag1",
-			expected: map[string]string{},
-		},
-	}
-
-	for _, test := range tests {
-		tags := splitTagSettings(test.input)
-		for k, v := range test.expected {
-			value, exists := tags[k]
-			if !exists || value != v {
-				t.Errorf("tags does not match %v ", test)
-			}
-		}
-	}
-}
--- a/003-new-files.patch
+++ b/003-new-files.patch
--- a/1001-vendor-patch-removed-backend-crypto.patch
+++ b/1001-vendor-patch-removed-backend-crypto.patch
--- a/1002-vendor-use-pbkdf2-from-OpenSSL.patch
+++ b/1002-vendor-use-pbkdf2-from-OpenSSL.patch
@ -0,0 +1,135 @@
+use pbkdf2 from OpenSSL if FIPS mode is enabled
+
+This patch modifies the x/crypto/pbkdf2 function to use OpenSSL
+if FIPS mode is enabled.
+DEFINEFUNC is from /usr/lib/golang/src/vendor/github.com/golang-fips/openssl-fips/openssl/goopenssl.h
+
+diff --git a/vendor/golang.org/x/crypto/internal/boring/boring.go b/vendor/golang.org/x/crypto/internal/boring/boring.go
+new file mode 100644
+index 0000000000..5a06918832
+--- /dev/null
+++ b/vendor/golang.org/x/crypto/internal/boring/boring.go
+@@ -0,0 +1,74 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Copyright 2021 Red Hat.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build linux
+// +build !android
+// +build !no_openssl
+// +build !cmd_go_bootstrap
+// +build !msan
+
+package boring
+
+// #include "/usr/lib/golang/src/vendor/github.com/golang-fips/openssl/v2/goopenssl.h"
+// #cgo LDFLAGS: -ldl
+import "C"
+import (
+	"bytes"
+	"crypto/sha1"
+	"crypto/sha256"
+	"hash"
+	"unsafe"
+)
+
+var (
+	emptySha1   = sha1.Sum([]byte{})
+	emptySha256 = sha256.Sum256([]byte{})
+)
+
+func hashToMD(h hash.Hash) C.GO_EVP_MD_PTR {
+	emptyHash := h.Sum([]byte{})
+
+	switch {
+	case bytes.Equal(emptyHash, emptySha1[:]):
+		return C.go_openssl_EVP_sha1()
+	case bytes.Equal(emptyHash, emptySha256[:]):
+		return C.go_openssl_EVP_sha256()
+	}
+	return nil
+}
+
+// charptr returns the address of the underlying array in b,
+// being careful not to panic when b has zero length.
+func charptr(b []byte) *C.char {
+	if len(b) == 0 {
+		return nil
+	}
+	return (*C.char)(unsafe.Pointer(&b[0]))
+}
+
+// ucharptr returns the address of the underlying array in b,
+// being careful not to panic when b has zero length.
+func ucharptr(b []byte) *C.uchar {
+	if len(b) == 0 {
+		return nil
+	}
+	return (*C.uchar)(unsafe.Pointer(&b[0]))
+}
+
+func Pbkdf2Key(password, salt []byte, iter, keyLen int, h func() hash.Hash) []byte {
+	// println("[debug] using pbkdf2 from OpenSSL")
+	ch := h()
+	md := hashToMD(ch)
+	if md == nil {
+		return nil
+	}
+
+	out := make([]byte, keyLen)
+	ok := C.go_openssl_PKCS5_PBKDF2_HMAC(charptr(password), C.int(len(password)), ucharptr(salt), C.int(len(salt)), C.int(iter), md, C.int(keyLen), ucharptr(out))
+	if ok != 1 {
+		panic("boringcrypto: PKCS5_PBKDF2_HMAC failed")
+	}
+	return out
+}
+diff --git a/vendor/golang.org/x/crypto/internal/boring/notboring.go b/vendor/golang.org/x/crypto/internal/boring/notboring.go
+new file mode 100644
+index 0000000000..e244fb5663
+--- /dev/null
+++ b/vendor/golang.org/x/crypto/internal/boring/notboring.go
+@@ -0,0 +1,16 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Copyright 2021 Red Hat.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build !linux !cgo android cmd_go_bootstrap msan no_openssl
+
+package boring
+
+import (
+	"hash"
+)
+
+func Pbkdf2Key(password, salt []byte, iter, keyLen int, h func() hash.Hash) []byte {
+	panic("boringcrypto: not available")
+}
+diff --git a/vendor/golang.org/x/crypto/pbkdf2/pbkdf2.go b/vendor/golang.org/x/crypto/pbkdf2/pbkdf2.go
+index 593f653008..799a611f94 100644
+--- a/vendor/golang.org/x/crypto/pbkdf2/pbkdf2.go
+++ b/vendor/golang.org/x/crypto/pbkdf2/pbkdf2.go
+@@ -19,8 +19,11 @@ pbkdf2.Key.
+ package pbkdf2 // import "golang.org/x/crypto/pbkdf2"
+ 
+ import (
+	"crypto/boring"
+ 	"crypto/hmac"
+ 	"hash"
+
+	xboring "golang.org/x/crypto/internal/boring"
+ )
+ 
+ // Key derives a key from the password, salt and iteration count, returning a
+@@ -40,6 +43,10 @@ import (
+ // Using a higher iteration count will increase the cost of an exhaustive
+ // search but will also make derivation proportionally slower.
+ func Key(password, salt []byte, iter, keyLen int, h func() hash.Hash) []byte {
+	if boring.Enabled() {
+		return xboring.Pbkdf2Key(password, salt, iter, keyLen, h)
+	}
+
+ 	prf := hmac.New(h, password)
+ 	hashLen := prf.Size()
+ 	numBlocks := (keyLen + hashLen - 1) / hashLen
--- a/1003-vendor-skip-goldenfiles-tests.patch
+++ b/1003-vendor-skip-goldenfiles-tests.patch
@ -0,0 +1,18 @@
+skip goldenfiles tests
+
+The golden files include memory dumps from a x86_64 machine.
+Integers are stored as little endian on x86, but as big endian on s390x,
+therefore loading this memory dump fails on s390x.
+
+diff --git a/vendor/github.com/grafana/grafana-plugin-sdk-go/experimental/golden_response_checker.go b/vendor/github.com/grafana/grafana-plugin-sdk-go/experimental/golden_response_checker.go
+index 320f40f3bd..20f5fa4f46 100644
+--- a/vendor/github.com/grafana/grafana-plugin-sdk-go/experimental/golden_response_checker.go
+++ b/vendor/github.com/grafana/grafana-plugin-sdk-go/experimental/golden_response_checker.go
+@@ -203,6 +203,7 @@ func CheckGoldenJSONFrame(t *testing.T, dir string, name string, f *data.Frame,
+ // CheckGoldenJSONResponse will verify that the stored JSON file matches the given backend.DataResponse.
+ func CheckGoldenJSONResponse(t *testing.T, dir string, name string, dr *backend.DataResponse, updateFile bool) {
+ 	t.Helper()
+	t.Skip("skipping test: x86_64 memory dump is not compatible with other architectures")
+ 	fpath := path.Join(dir, name+".jsonc")
+ 
+ 	expected, err := readGoldenJSONFile(fpath)
--- a/1004-vendor-Redacted-Url-in-logs.patch
+++ b/1004-vendor-Redacted-Url-in-logs.patch
@ -0,0 +1,51 @@
+diff --git a/vendor/github.com/hashicorp/go-retryablehttp/client.go b/vendor/github.com/hashicorp/go-retryablehttp/client.go
+index f40d241..765a828 100644
+--- a/vendor/github.com/hashicorp/go-retryablehttp/client.go
+++ b/vendor/github.com/hashicorp/go-retryablehttp/client.go
+@@ -584,9 +584,9 @@ func (c *Client) Do(req *Request) (*http.Response, error) {
+ 	if logger != nil {
+ 		switch v := logger.(type) {
+ 		case LeveledLogger:
+-			v.Debug("performing request", "method", req.Method, "url", req.URL)
+			v.Debug("performing request", "method", req.Method, "url", req.URL.Redacted())
+ 		case Logger:
+-			v.Printf("[DEBUG] %s %s", req.Method, req.URL)
+			v.Printf("[DEBUG] %s %s", req.Method, req.URL.Redacted())
+ 		}
+ 	}
+ 
+@@ -641,9 +641,9 @@ func (c *Client) Do(req *Request) (*http.Response, error) {
+ 		if err != nil {
+ 			switch v := logger.(type) {
+ 			case LeveledLogger:
+-				v.Error("request failed", "error", err, "method", req.Method, "url", req.URL)
+				v.Error("request failed", "error", err, "method", req.Method, "url", req.URL.Redacted())
+ 			case Logger:
+-				v.Printf("[ERR] %s %s request failed: %v", req.Method, req.URL, err)
+				v.Printf("[ERR] %s %s request failed: %v", req.Method, req.URL.Redacted(), err)
+ 			}
+ 		} else {
+ 			// Call this here to maintain the behavior of logging all requests,
+@@ -679,7 +679,7 @@ func (c *Client) Do(req *Request) (*http.Response, error) {
+ 
+ 		wait := c.Backoff(c.RetryWaitMin, c.RetryWaitMax, i, resp)
+ 		if logger != nil {
+-			desc := fmt.Sprintf("%s %s", req.Method, req.URL)
+			desc := fmt.Sprintf("%s %s", req.Method, req.URL.Redacted())
+ 			if resp != nil {
+ 				desc = fmt.Sprintf("%s (status: %d)", desc, resp.StatusCode)
+ 			}
+@@ -735,11 +735,11 @@ func (c *Client) Do(req *Request) (*http.Response, error) {
+ 	// communicate why
+ 	if err == nil {
+ 		return nil, fmt.Errorf("%s %s giving up after %d attempt(s)",
+-			req.Method, req.URL, attempt)
+			req.Method, req.URL.Redacted(), attempt)
+ 	}
+ 
+ 	return nil, fmt.Errorf("%s %s giving up after %d attempt(s): %w",
+-		req.Method, req.URL, attempt, err)
+		req.Method, req.URL.Redacted(), attempt, err)
+ }
+ 
+ // Try to read the response body so we can reuse this connection.
--- a/README.md
+++ b/README.md
@ -1,3 +1,51 @@
 # grafana
+The grafana package

-The grafana package
+## Setup instructions
+* clone the upstream sources: `git clone https://github.com/grafana/grafana && cd grafana`
+* checkout the version of the specfile: `git checkout <currentversion>`
+* apply existing patches: `git am ../0*.patch`
+
+## Upgrade instructions
+* follow the Setup instructions above
+* rebase to the new version: `git fetch && git rebase --onto <newversion> <oldversion>`
+  * rebasing `remove-unused-backend-dependencies.patch`: only apply the patch to `pkg/extensions/main.go` and run `go mod tidy`, then `go.mod` and `go.sum` will get updated automatically
+  * rebasing `remove-unused-frontend-crypto.patch`: only apply the patch to `package.json` and run `yarn install`, then `yarn.lock` will get updated automatically
+* create new patches from the modified git commits: `git format-patch -N --no-stat --no-signature <newversion> && mv *.patch ..`
+* update `Version`, `Release`, `%changelog` and tarball NVRs in the specfile
+* create bundles and manifest: `./create_bundles_in_container.sh`
+* inspect the vendor tarball for any new non-FIPS crypto (`vendor/golang.org/x/crypto`), delete these files/directories in the Makefile and update the `patch-removed-backend-crypto.patch` if required
+* update specfile with contents of the `.manifest` file
+* update the manpages patch in `0002-add-manpages.patch` and other patches if required
+* run local build: `rpkg local`
+* run rpmlint: `rpmlint -r grafana.rpmlintrc /tmp/rpkg/grafana-*/grafana-*.src.rpm /tmp/rpkg/grafana-*/x86_64/grafana-*.x86_64.rpm`
+* run a scratch build: `fedpkg scratch-build --srpm`
+* upload new source tarballs: `fedpkg new-sources *.tar.gz *.tar.xz`
+* commit new `sources` file
+
+## Patches
+* create the patch
+* declare and apply (`%prep`) the patch in the specfile
+* if the patch affects Go or Node.js dependencies, or the webpack
+  * update the `create_bundles.sh` script and apply the patch
+  * create new tarballs
+  * update the specfile with new tarball name and contents of the `.manifest` file
+
+### General guidelines
+* aim to apply all patches in the specfile
+* avoid rebuilding the tarballs
+
+Patches fall in several categories:
+  * modify dependency versions
+  * modify both sources and vendored dependencies (e.g. CVEs)
+  * modify the Node.js source (i.e. affect the webpack)
+  * some patches are conditional (e.g. FIPS)
+
+Patches cannot be applied twice.
+It is not possible to unconditionally apply all patches in the Makefile, and great care must be taken to include the required patches at the correct stage of the build.
+
+## Reproducible Bundles
+Run `./create_bundles_in_container.sh` to generate a reproducible vendor and webpack bundle.
+
+## Verification
+* compare the list of files with the upstream RPM at https://grafana.com/grafana/download
--- a/build_frontend.sh
+++ b/build_frontend.sh
@ -0,0 +1,20 @@
+#!/bin/bash -eu
+
+# Webpack needs more than the default 4GB RAM
+export NODE_OPTIONS="${NODE_OPTIONS:-} --max_old_space_size=6144"
+
+# Build the frontend
+yarn run build
+
+# Build the bundled plugins
+mkdir plugins-bundled/external
+yarn run plugins:build-bundled
+for plugin in plugins-bundled/internal/input-datasource; do
+  mv $plugin $plugin.tmp
+  mv $plugin.tmp/dist $plugin
+  rm -rf $plugin.tmp
+done
+rm plugins-bundled/README.md plugins-bundled/.gitignore plugins-bundled/external.json
+
+# Fix permissions (webpack sometimes outputs files with mode = 666 due to reasons unknown (race condition/umask issue afaics))
+chmod -R g-w,o-w public/build plugins-bundled
--- a/ci.fmf
+++ b/ci.fmf
@ -0,0 +1,5 @@
+/gating:
+  plan:
+    import:
+      name: /plans/gating
+      url: https://gitlab.com/redhat/centos-stream/tests/grafana.git
--- a/create_bundles.sh
+++ b/create_bundles.sh
@ -0,0 +1,106 @@
+#!/bin/bash -eux
+VERSION=$(rpm --specfile ./*.spec --qf '%{VERSION}\n' | head -1)
+RELEASE=$(rpm --specfile ./*.spec --qf '%{RELEASE}\n' | head -1 | cut -d. -f1)
+CHANGELOGTIME=$(rpm --specfile ./*.spec --qf '%{CHANGELOGTIME}\n' | head -1)
+SOURCE_DATE_EPOCH=$((CHANGELOGTIME - CHANGELOGTIME % 86400))
+
+SOURCE_DIR=grafana-$VERSION
+SOURCE_TAR=grafana-$VERSION.tar.gz
+VENDOR_TAR=grafana-vendor-$VERSION-$RELEASE.tar.xz
+WEBPACK_TAR=grafana-webpack-$VERSION-$RELEASE.tar.gz
+
+
+## Download and extract source tarball
+spectool -g grafana.spec
+rm -rf "${SOURCE_DIR}"
+tar xf "${SOURCE_TAR}"
+
+
+## Create vendor bundle
+pushd "${SOURCE_DIR}"
+
+# Vendor Go dependencies
+patch -p1 --fuzz=0 < ../0004-remove-unused-backend-dependencies.patch
+patch -p1 --fuzz=0 < ../0012-fix-jwt-CVE.patch
+go mod vendor
+
+# Generate Go files
+make gen-go
+
+# Remove unused crypto
+rm -r vendor/golang.org/x/crypto/bcrypt
+rm -r vendor/golang.org/x/crypto/blowfish
+rm -r vendor/golang.org/x/crypto/cast5
+rm -r vendor/golang.org/x/crypto/acme
+rm -r vendor/golang.org/x/crypto/argon2
+rm -r vendor/golang.org/x/crypto/blake2b
+rm -r vendor/golang.org/x/crypto/chacha20
+rm -r vendor/golang.org/x/crypto/chacha20poly1305
+rm -r vendor/golang.org/x/crypto/cryptobyte
+rm -r vendor/golang.org/x/crypto/curve25519
+rm -r vendor/golang.org/x/crypto/ed25519
+rm -r vendor/golang.org/x/crypto/hkdf
+rm -r vendor/golang.org/x/crypto/internal
+rm -r vendor/golang.org/x/crypto/md4
+rm -r vendor/golang.org/x/crypto/nacl
+rm -r vendor/golang.org/x/crypto/openpgp
+rm -r vendor/golang.org/x/crypto/pkcs12
+rm -r vendor/golang.org/x/crypto/poly1305
+rm -r vendor/golang.org/x/crypto/salsa20
+rm -r vendor/golang.org/x/crypto/scrypt
+rm -r vendor/golang.org/x/crypto/sha3
+
+# Remove unused code under apsl licenses
+rm -r vendor/modernc.org/libc
+rm -r vendor/modernc.org/sqlite
+
+# List bundled dependencies
+awk '$2 ~ /^v/ && $4 != "indirect" {print "Provides: bundled(golang(" $1 ")) = " substr($2, 2)}' go.mod | \
+    sed -E 's/=(.*)-(.*)-(.*)/=\1-\2.\3/g' > "../${VENDOR_TAR}.manifest"
+
+# Vendor Node.js dependencies
+patch -p1 --fuzz=0 < ../0005-remove-unused-frontend-crypto.patch
+patch -p1 --fuzz=0 < ../0011-fix-dompurify-CVE.patch
+export HUSKY=0
+yarn install --frozen-lockfile
+
+# Remove files with licensing issues
+find .yarn -name 'node-notifier' -prune -exec rm -r {} \;
+find .yarn -name 'nodemon' -prune -exec rm -r {} \;
+
+# List bundled dependencies
+../list_bundled_nodejs_packages.py . >> "../${VENDOR_TAR}.manifest"
+
+popd
+
+# Create tarball
+# shellcheck disable=SC2046
+XZ_OPT=-9 tar \
+    --sort=name \
+    --mtime="@${SOURCE_DATE_EPOCH}" --clamp-mtime \
+    --owner=0 --group=0 --numeric-owner \
+    -cJf "${VENDOR_TAR}" \
+    "${SOURCE_DIR}/vendor" \
+    $(find "${SOURCE_DIR}" -type f -name wire_gen.go | LC_ALL=C sort) \
+    "${SOURCE_DIR}/.pnp.cjs" \
+    "${SOURCE_DIR}/.yarn/cache" \
+    "${SOURCE_DIR}/.yarn/unplugged"
+
+
+## Create webpack
+pushd "${SOURCE_DIR}"
+../build_frontend.sh
+popd
+
+# Create tarball
+tar \
+    --sort=name \
+    --mtime="@${SOURCE_DATE_EPOCH}" --clamp-mtime \
+    --owner=0 --group=0 --numeric-owner \
+    -czf "${WEBPACK_TAR}" \
+    "${SOURCE_DIR}/plugins-bundled" \
+    "${SOURCE_DIR}/public/build" \
+    "${SOURCE_DIR}/public/img" \
+    "${SOURCE_DIR}/public/lib" \
+    "${SOURCE_DIR}/public/locales" \
+    "${SOURCE_DIR}/public/views"
--- a/create_bundles_in_container.sh
+++ b/create_bundles_in_container.sh
@ -0,0 +1,24 @@
+#!/bin/bash -eu
+#
+# create vendor and webpack bundles inside a container (for reproducibility)
+# using a Go cache:
+#   ./create_bundles_in_container.sh --security-opt label=disable -v $(pwd)/.gocache:/root/go
+#
+
+cat <<EOF | podman build -t grafana-build -f - .
+FROM fedora:39
+
+RUN dnf upgrade -y && \
+    dnf install -y rpmdevtools python3-packaging python3-pyyaml make golang nodejs yarnpkg
+
+# https://groups.google.com/g/golang-nuts/c/MVtHZUtZru4
+ENV GOPROXY=https://proxy.golang.org,direct
+
+WORKDIR /tmp/grafana-build
+COPY grafana.spec create_bundles.sh build_frontend.sh list_bundled_nodejs_packages.py *.patch .
+RUN mkdir bundles
+CMD ./create_bundles.sh && mv *.tar.* bundles
+EOF
+
+podman run --name grafana-build --replace "$@" grafana-build
+podman cp grafana-build:bundles/. .
--- a/gating.yaml
+++ b/gating.yaml
@ -0,0 +1,7 @@
+--- !Policy
+product_versions:
+  - fedora-*
+decision_context: bodhi_update_push_stable
+subject_type: koji_build
+rules:
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}
--- a/grafana.fc
+++ b/grafana.fc
@ -0,0 +1,26 @@
+/etc/systemd/system/grafana-server.service		--	gen_context(system_u:object_r:grafana_unit_file_t,s0)
+/usr/lib/systemd/system/grafana-server.service		--	gen_context(system_u:object_r:grafana_unit_file_t,s0)
+
+/etc/grafana(/.*)?						gen_context(system_u:object_r:grafana_conf_t,s0)
+
+/usr/bin/grafana-cli                    --    gen_context(system_u:object_r:grafana_exec_t,s0)
+/usr/bin/grafana-server                 --    gen_context(system_u:object_r:grafana_exec_t,s0)
+/usr/bin/grafana                        --    gen_context(system_u:object_r:grafana_exec_t,s0)
+
+/var/lib/grafana(/.*)?						gen_context(system_u:object_r:grafana_var_lib_t,s0)
+#/var/lib/grafana/grafana.db				--	gen_context(system_u:object_r:grafana_db_t,s0)
+
+/var/log/grafana(/.*)?						gen_context(system_u:object_r:grafana_log_t,s0)
+
+/var/run/grafana(/.*)?			--	gen_context(system_u:object_r:grafana_var_run_t,s0)
+
+#/var/lib/grafana/plugins(/.*)?					gen_context(system_u:object_r:grafana_plugin_t,s0)
+
+/usr/share/grafana/bin/grafana				--	gen_context(system_u:object_r:grafana_exec_t,s0)
+/usr/share/grafana/bin/grafana-cli			--	gen_context(system_u:object_r:grafana_exec_t,s0)
+/usr/share/grafana/bin/grafana-server			--	gen_context(system_u:object_r:grafana_exec_t,s0)
+
+#define context for pcp plugin
+#/usr/share/performancecopilot-pcp-app/datasources/redis/pcp_redis_datasource_(.*)           -- gen_context(system_u:object_r:grafana_pcp_exec_t,s0)
+/usr/libexec/grafana-pcp/datasources/redis/pcp_redis_datasource_(.*)           -- gen_context(system_u:object_r:grafana_pcp_exec_t,s0)
+/usr/libexec/grafana-pcp/datasources/valkey/pcp_valkey_datasource_(.*)         -- gen_context(system_u:object_r:grafana_pcp_exec_t,s0)
--- a/grafana.if
+++ b/grafana.if
@ -0,0 +1,141 @@
+## <summary>policy for grafana</summary>
+
+########################################
+## <summary>
+##	Execute grafana_exec_t in the grafana domain.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`grafana_domtrans',`
+	gen_require(`
+		type grafana_t, grafana_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, grafana_exec_t, grafana_t)
+')
+
+########################################
+## <summary>
+##      Allow domain to name_connect to grafana port. Default :3000
+## </summary>
+## <param name="domain">
+## <summary>
+##      Domain allowed access
+## </summary>
+## </param>
+#
+interface(`connect_grafana_port',`
+        gen_require(`
+		class tcp_socket name_connect;
+                type grafana_port_t;
+        ')
+
+	allow $1 grafana_port_t:tcp_socket name_connect;
+')
+
+#######################################
+## <summary>
+##	Read grafana database.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`grafana_read_db',`
+	gen_require(`
+		type grafana_db_t;
+	')
+
+	files_search_var_lib($1)
+	search_dirs_pattern($1, grafana_var_lib_t, grafana_var_lib_t)	
+	read_files_pattern($1, grafana_db_t, grafana_db_t)
+')
+
+######################################
+## <summary>
+##	Execute grafana in the caller domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`grafana_exec',`
+	gen_require(`
+		type grafana_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	can_exec($1, grafana_exec_t)
+')
+########################################
+## <summary>
+##	Execute grafana server in the grafana domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+interface(`grafana_systemctl',`
+	gen_require(`
+		type grafana_t;
+		type grafana_unit_file_t;
+	')
+
+	systemd_exec_systemctl($1)
+        systemd_read_fifo_file_passwd_run($1)
+	allow $1 grafana_unit_file_t:file read_file_perms;
+	allow $1 grafana_unit_file_t:service manage_service_perms;
+
+	ps_process_pattern($1, grafana_t)
+')
+
+
+########################################
+## <summary>
+##	All of the rules required to administrate
+##	an grafana environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`grafana_admin',`
+	gen_require(`
+	type grafana_t;
+	type grafana_unit_file_t;
+	')
+
+	allow $1 grafana_t:process { signal_perms };
+	ps_process_pattern($1, grafana_t)
+
+	tunable_policy(`deny_ptrace',`',`
+        	allow $1 grafana_t:process ptrace;
+    	')
+
+	grafana_systemctl($1)
+	admin_pattern($1, grafana_unit_file_t)
+	allow $1 grafana_unit_file_t:service all_service_perms;
+	optional_policy(`
+		systemd_passwd_agent_exec($1)
+		systemd_read_fifo_file_passwd_run($1)
+	')
+')
--- a/grafana.rpmlintrc
+++ b/grafana.rpmlintrc
@ -0,0 +1,17 @@
+addFilter("E: non-readable /etc/grafana/grafana.ini 640")
+addFilter("E: non-readable /etc/grafana/ldap.toml 640")
+addFilter("E: non-standard-dir-perm /var/lib/grafana 750")
+addFilter("E: non-standard-dir-perm /etc/grafana/provisioning/datasources 750")
+addFilter("W: non-standard-uid.* grafana")
+addFilter("W: non-standard-gid.* grafana")
+
+addFilter("W: invalid-url Source1: grafana-vendor-")
+addFilter("W: invalid-url Source2: grafana-webpack-")
+addFilter("E: zero-length /usr/share/grafana/public")
+addFilter("W: hidden-file-or-dir /usr/share/grafana/public")
+addFilter("W: files-duplicate /usr/share/grafana/public/img")
+addFilter("W: files-duplicate /usr/share/grafana/public/lib/.*.LICENSE.txt")
+
+addFilter("W: dangerous-command-in-%post chown")
+addFilter("W: log-files-without-logrotate")
+addFilter("W: %ifarch-applied-patch Patch.*: .*vendor-skip-goldenfiles-tests.patch")
--- a/grafana.spec
+++ b/grafana.spec
--- a/grafana.sysusers
+++ b/grafana.sysusers
@ -0,0 +1,2 @@
+#Type Name    ID GECOS                  Home directory
+u     grafana -  "Grafana user account" /var/lib/grafana
--- a/grafana.te
+++ b/grafana.te
@ -0,0 +1,257 @@
+policy_module(grafana, 1.0.4)
+
+########################################
+#
+# Declarations
+#
+#permissive grafana_t;
+
+## <desc>
+## <p>
+## Allow grafana to be used with a reverse proxy
+## </p>
+## </desc>
+gen_tunable(grafana_can_reverse_proxy, false)
+
+## <desc>
+## <p>
+## Allow grafana to connect to elasticsearch's default tcp port of 9200
+## </p>
+## </desc>
+gen_tunable(grafana_can_tcp_connect_elasticsearch_port, false)
+
+## <desc>
+## <p>
+## Allow grafana to connect to mysql's default tcp port of 3306
+## </p>
+## </desc>
+gen_tunable(grafana_can_tcp_connect_mysql_port, false)
+
+## <desc>
+## <p>
+## Allow grafana to connect to prometheus' default tcp port of 9090
+## </p>
+## </desc>
+gen_tunable(grafana_can_tcp_connect_prometheus_port, false)
+
+## <desc>            
+## <p>
+## Allow grafana to connect to postgresql's default tcp port of 5432            
+## </p>            
+## </desc>            
+gen_tunable(grafana_can_tcp_connect_postgresql_port, false)
+
+## <desc>            
+## <p>
+## Allow grafana to connect to ldap's tcp port           
+## </p>            
+## </desc>  
+gen_tunable(grafana_can_tcp_connect_ldap_port, false)
+
+type grafana_t;
+type grafana_exec_t;
+init_daemon_domain(grafana_t, grafana_exec_t)
+init_nnp_daemon_domain(grafana_t)
+
+type grafana_unit_file_t;
+systemd_unit_file(grafana_unit_file_t)
+
+type grafana_conf_t;
+files_config_file(grafana_conf_t)
+
+type grafana_db_t;
+files_config_file(grafana_db_t)
+
+type grafana_tmp_t;
+files_tmp_file(grafana_tmp_t)
+
+type grafana_tmpfs_t;
+files_tmpfs_file(grafana_tmpfs_t)
+
+type grafana_log_t;
+logging_log_file(grafana_log_t)
+
+type grafana_var_run_t;
+files_pid_file(grafana_var_run_t)
+
+type grafana_var_lib_t;
+files_type(grafana_var_lib_t)
+
+type grafana_port_t;
+corenet_port(grafana_port_t)
+
+type grafana_pcp_exec_t;
+corecmd_executable_file(grafana_pcp_exec_t)
+can_exec(grafana_t, grafana_pcp_exec_t)
+
+# Ports 32768-60999 (pcp port is 44322)
+corenet_tcp_connect_all_ephemeral_ports(grafana_t)
+grafana_exec(grafana_t)
+
+# Allow grafana to connect to mssql's default tcp port of 1433 
+corenet_tcp_connect_mssql_port(grafana_t)
+
+########################################
+#
+# grafana local policy
+#
+allow grafana_t self:tcp_socket create_stream_socket_perms;
+allow grafana_t self:udp_socket create_stream_socket_perms;
+allow grafana_t self:unix_dgram_socket create_socket_perms;
+
+allow grafana_t grafana_port_t:tcp_socket { name_bind name_connect };
+
+allow grafana_t grafana_var_lib_t:file { execute execute_no_trans };
+allow grafana_t grafana_var_lib_t:file map;
+
+allow grafana_t self:unix_stream_socket connectto;
+
+allow grafana_t self:netlink_route_socket { create bind getattr nlmsg_read };
+
+optional_policy(`
+	require {
+		type cgroup_t;
+		class dir { search };
+		class file { open read };
+	}
+	allow grafana_t cgroup_t:dir search;
+	allow grafana_t cgroup_t:file { open read };
+')
+
+optional_policy(`
+	require {
+		type smtp_port_t;
+		class tcp_socket { name_connect };
+	}
+	allow grafana_t smtp_port_t:tcp_socket name_connect;
+')
+
+optional_policy(`
+	require {
+		type ntop_port_t;
+		class tcp_socket { name_bind };
+	}
+	allow grafana_t ntop_port_t:tcp_socket name_bind;
+')
+
+optional_policy(`
+	require {
+		type usr_t;
+		class file { execute execute_no_trans };
+	}
+	allow grafana_t usr_t:file { execute execute_no_trans };
+')
+
+optional_policy(`
+	require {
+		type postgresql_t;
+		type postgresql_var_run_t;
+		class unix_stream_socket { connectto };
+		class sock_file { write };
+	}
+	allow grafana_t postgresql_t:unix_stream_socket connectto;
+	allow grafana_t postgresql_var_run_t:sock_file write;
+')
+
+optional_policy(`
+	require {
+		type proc_net_t;
+		class lnk_file { read };
+	}
+	allow grafana_t proc_net_t:lnk_file read;
+')
+
+optional_policy(`
+	require {
+		type autofs_t;
+		class dir {getattr};
+	}
+	allow grafana_t autofs_t:dir getattr;
+')
+
+optional_policy(`
+	require {
+		type postfix_local_t;
+		class dir { search };
+	}
+	allow postfix_local_t grafana_var_lib_t:dir search;
+')
+
+manage_dirs_pattern(grafana_t, grafana_conf_t, grafana_conf_t)
+manage_files_pattern(grafana_t, grafana_conf_t, grafana_conf_t)
+
+manage_dirs_pattern(grafana_t, grafana_db_t, grafana_db_t)
+manage_files_pattern(grafana_t, grafana_db_t, grafana_db_t)
+
+manage_dirs_pattern(grafana_t, grafana_tmp_t, grafana_tmp_t)
+manage_files_pattern(grafana_t, grafana_tmp_t, grafana_tmp_t)
+manage_sock_files_pattern(grafana_t, grafana_tmp_t, grafana_tmp_t)
+files_tmp_filetrans(grafana_t, grafana_tmp_t, { dir file sock_file })
+
+manage_dirs_pattern(grafana_t, grafana_tmpfs_t, grafana_tmpfs_t)
+manage_files_pattern(grafana_t, grafana_tmpfs_t, grafana_tmpfs_t)
+fs_tmpfs_filetrans(grafana_t, grafana_tmpfs_t, {dir file})
+
+manage_dirs_pattern(grafana_t, grafana_log_t, grafana_log_t)
+manage_files_pattern(grafana_t, grafana_log_t, grafana_log_t)
+logging_log_filetrans(grafana_t, grafana_log_t, { dir file })
+
+manage_dirs_pattern(grafana_t, grafana_var_run_t, grafana_var_run_t)
+manage_files_pattern(grafana_t, grafana_var_run_t, grafana_var_run_t)
+files_pid_filetrans(grafana_t, grafana_var_run_t, { dir file })
+
+manage_dirs_pattern(grafana_t, grafana_var_lib_t, grafana_var_lib_t)
+manage_files_pattern(grafana_t, grafana_var_lib_t, grafana_var_lib_t)
+manage_lnk_files_pattern(grafana_t, grafana_var_lib_t, grafana_var_lib_t)
+files_var_lib_filetrans(grafana_t, grafana_var_lib_t, { dir file })
+
+
+corenet_tcp_connect_http_port(grafana_t)
+corenet_tcp_bind_generic_node(grafana_t)
+
+kernel_dgram_send(grafana_t)
+kernel_read_net_sysctls(grafana_t)
+kernel_read_system_state(grafana_t)
+
+auth_read_passwd(grafana_t)
+
+dev_read_sysfs(grafana_t)
+
+sysnet_read_config(grafana_t)
+
+logging_send_syslog_msg(grafana_t)
+
+miscfiles_read_generic_certs(grafana_t)
+
+tunable_policy(`grafana_can_reverse_proxy',`
+	gen_require(`
+		type httpd_t;
+	')
+
+	connect_grafana_port(httpd_t) # Reverse proxy support
+	corenet_tcp_connect_http_port(grafana_t)
+')
+
+tunable_policy(`grafana_can_tcp_connect_elasticsearch_port',` # Elasticsearch default tcp port 9200
+	corenet_tcp_connect_wap_wsp_port(grafana_t)
+')
+
+tunable_policy(`grafana_can_tcp_connect_mysql_port',` # Mysql default tcp port 3306
+	corenet_tcp_connect_mysqld_port(grafana_t)
+')
+
+tunable_policy(`grafana_can_tcp_connect_prometheus_port',` # Prometheus default tcp port 9090
+	corenet_tcp_connect_websm_port(grafana_t)
+')
+
+tunable_policy(`grafana_can_tcp_connect_postgresql_port',` # Postgresql default tcp port 5432
+	corenet_tcp_connect_postgresql_port(grafana_t)
+')
+
+tunable_policy(`grafana_can_tcp_connect_ldap_port',`
+	corenet_tcp_connect_ldap_port(grafana_t)
+')
+
+optional_policy(`
+    systemd_private_tmp(grafana_tmp_t)
+')
--- a/list_bundled_nodejs_packages.py
+++ b/list_bundled_nodejs_packages.py
@ -0,0 +1,72 @@
+#!/usr/bin/env python3
+#
+# generates Provides: bundled(npm(...)) = ... lines for each declared dependency and devDependency of package.json
+#
+import os
+import sys
+import json
+import yaml
+from packaging import version
+
+
+def scan_package_json(package_dir):
+    for root, dirs, files in os.walk(package_dir, topdown=True):
+        dirs[:] = [d for d in dirs if d not in ["node_modules", "vendor"]]
+        if "package.json" in files:
+            yield os.path.join(root, "package.json")
+
+
+def read_declared_pkgs(package_json_path):
+    with open(package_json_path) as f:
+        package_json = json.load(f)
+        return list(package_json.get("dependencies", {}).keys()) + list(
+            package_json.get("devDependencies", {}).keys()
+        )
+
+
+def read_installed_pkgs(yarn_lock_path):
+    bad_version_strings = ['0.0.0-use.local', '7.0.1-patch.1']
+    with open(yarn_lock_path) as f:
+        lockfile = yaml.safe_load(f)
+        for pkg_decl, meta in lockfile.items():
+            for pkg in pkg_decl.split(", "):
+                if ":" not in pkg:
+                    continue
+                pkg_name = pkg[: pkg.index("@", 1)]
+                pkg_version = meta["version"]
+                if pkg_version not in bad_version_strings:
+                    yield (pkg_name, pkg_version)
+
+
+def list_provides(declared_pkgs, installed_pkgs):
+    for declared_pkg in declared_pkgs:
+        # there can be multiple versions installed of one package (transitive dependencies)
+        # but rpm doesn't support Provides: with a single package and multiple versions
+        # so let's declare the oldest version here
+        versions = [
+            version.parse(pkg_version)
+            for pkg_name, pkg_version in installed_pkgs
+            if pkg_name == declared_pkg
+        ]
+
+        if not versions:
+            print(f"warning: {declared_pkg} missing in yarn.lock", file=sys.stderr)
+            continue
+
+        oldest_version = sorted(versions)[0]
+        yield f"Provides: bundled(npm({declared_pkg})) = {oldest_version}"
+
+
+if __name__ == "__main__":
+    if len(sys.argv) != 2:
+        print(f"usage: {sys.argv[0]} package-X.Y.Z/", file=sys.stdout)
+        sys.exit(1)
+
+    package_dir = sys.argv[1]
+    declared_pkgs = set()
+    for package_json_path in scan_package_json(package_dir):
+        declared_pkgs.update(read_declared_pkgs(package_json_path))
+    installed_pkgs = list(read_installed_pkgs(f"{package_dir}/yarn.lock"))
+    provides = list_provides(declared_pkgs, installed_pkgs)
+    for provide in sorted(provides):
+        print(provide)
--- a/make_grafana_webpack.sh
+++ b/make_grafana_webpack.sh
@ -1,61 +0,0 @@
-#! /bin/bash
-#
-# Copyright (c) 2019 Red Hat.
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation; either version 2 of the License, or (at your
-# option) any later version.
-#
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
-# or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
-# for more details.
-#
-
-[ $# -ne 1 ] && echo "Usage: $0 version" && exit 1
-
-# grafana version (must be tagged on github.com/grafana/grafana as "v$VER")
-VER=$1
-BUILDDIR=`mktemp -d buildXXXXXX`
-
-[ ! -f /usr/bin/npm ] && echo Error, please install \"npm\" package && exit 1
-
-# get src tree and set cwd
-echo Fetching pristine upstream git tagged branch for grafana version v$VER ...
-git clone https://github.com/grafana/grafana grafana-$VER
-cd grafana-$VER
-git checkout -b v$VER v$VER
-
-# exclude the phantomjs-prebuilt binary module from the webpack
-sed -i '/phantomjs-prebuilt/d' package.json
-
-# nuke grunt task for copying phantomjs
-rm -f scripts/grunt/options/phantomjs.js
-sed -i '/phantomjs/d' scripts/grunt/*.js
-
-# populate node_modules using package.json
-echo Running yarn to populate local node_modules ....
-npm install yarn
-node_modules/yarn/bin/yarn --non-interactive --no-progress --ignore-engines install --pure-lockfile > yarn.out 2>&1
-node_modules/yarn/bin/yarn --non-interactive -W add webpack-cli
-
-# build the webpack
-echo;echo Building production webpack ....
-node_modules/webpack/bin/webpack.js --display errors-only --mode production --config scripts/webpack/webpack.prod.js
-
-cd ..
-
-# webpack tarball. Includes public/views because index.html references the webpack
-tar czf grafana_webpack-$VER.tar.gz grafana-$VER/public/build grafana-$VER/public/views
-
-# source tarball (if needed)
-if [ ! -f grafana-$VER.tar.gz ]; then
-  wget --quiet -O grafana-$VER.tar.gz https://github.com/grafana/grafana/archive/v$VER/grafana-$VER.tar.gz
-fi
-
-# done
-echo Both grafana-$VER.tar.gz and grafana_webpack-$VER.tar.gz
-echo should now be copied to your \$HOME/rpmbuild/SOURCES
-
-exit 0
--- a/rpminspect.yaml
+++ b/rpminspect.yaml
@ -0,0 +1,5 @@
+---
+annocheck:
+    jobs:
+        # Ignore the branch-test as for golang binaries it has no use
+        hardened: --ignore-unknown --skip-branch-test --verbose
--- a/5
+++ b/5
@ -1,2 +1,3 @@
-SHA512 (grafana-6.2.2.tar.gz) = fffa2a04c5249e6159297280313b7d6cbec2f86fc59e48200405905848dda524bb522cf34a1cf2f55855104e93c72e69284875f0dbea447cc8f551948c03e8af
-SHA512 (grafana_webpack-6.2.2.tar.gz) = db09ff6cf5c1292bca01dfb5c0c1e615890c229c510785af11406bc945f135b19d14fcda6a483c6a438dde567f8d43d59298aec638c6780a788b60bb9b734d64
+SHA512 (grafana-vendor-10.2.6-12.tar.xz) = 289235d9345db6dd8522b974d975ab1511f05b22c752c9183f3aaaf51b277f865a661fe34861a4e4eb303ace6c716a72c0bab41fa22a33b9d95af063e73727f4
+SHA512 (grafana-webpack-10.2.6-12.tar.gz) = 18add624478ce7337d560dc81589e5ce06c6d15cad9edc77f2292b747e75f597793a8ad0364961afe564e21b897090d7b5912fa16f631d9f7f80efd63e106282
+SHA512 (grafana-10.2.6.tar.gz) = 7244f4cb6572fe0403e6224f7247fbb273bbd1f359ee706a82001f0d409fb375d113f1cb24a657e845b93eb55ee98e1d7ae713e767c219f4d3b00eaf5c73d28e
Author	SHA1	Message	Date
Sam Feifer	3a728b088c	Fix recursive macro definition error in rpminspect	2025-12-03 10:13:04 -05:00
Sam Feifer	7b0c1da454	Fix grafana-selinux cgroups denials	2025-12-02 15:16:24 -05:00
Jan Kurik	46b52069d0	Use default gating config	2025-10-15 08:30:55 +00:00
Alejandro Sáez	a806424a30	rebuild	2025-10-10 14:37:22 +02:00
Jan Kurik	a1291fb28e	Reworked gating to use CentOS test repository	2025-09-25 07:24:28 +00:00
Jan Kurik	28c9808c05	Reworked gating to use CentOS test repository	2025-09-25 07:24:28 +00:00
Maxwell G	23e030d974	Rebuild for golang-1.25.0	2025-08-15 17:54:06 -05:00
Fedora Release Engineering	872b376f01	Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild	2025-07-24 16:34:03 +00:00
Sam Feifer	2d4bd8e98d	change sbin to bin in grafana-selinux	2025-07-17 16:16:04 -04:00
Sam Feifer	ee9685a734	revert removal of noarch grafana-selinux	2025-07-17 12:28:36 -04:00
Sam Feifer	92a8f286a4	backport selinux packaging changes	2025-07-16 12:02:15 -04:00
Sam Feifer	848bb46373	backport changes to selinux policy	2025-07-16 11:56:15 -04:00
Sam Feifer	5d2ccd6839	Fix CVE-2025-4123	2025-05-13 10:31:56 -04:00
Sam Feifer	dcbaef147d	Rework selinux policy packaging and add rules	2025-05-02 13:46:04 -04:00
Sam Feifer	575c462570	Move home directory and resolve CVEs	2025-03-26 17:18:37 -04:00
Sam Feifer	8803dd55d3	drop call to %sysusers_create_compat	2025-02-13 17:21:39 -05:00
Fedora Release Engineering	b70e3c2d33	Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild	2025-01-17 05:04:48 +00:00
Sam Feifer	4839459068	Revert changes that break custom dashboards	2024-11-26 11:28:48 -05:00
Sam Feifer	de6f87df84	Clean up grafana.ini file	2024-11-25 14:33:20 -05:00
Sam Feifer	8807b5661a	Allow loading valkey datasource	2024-11-22 10:26:03 -05:00
Sam Feifer	9d54ca90a8	Update selinux policy for valkey	2024-11-08 11:18:23 -05:00
Sam Feifer	a83c749afa	fix selinux issue caused by unification of sbin and bin	2024-08-01 12:02:42 -04:00
Sam Feifer	724cb7b263	Redact urls in go-retryablehttp logs	2024-07-17 15:30:14 -04:00
Yaakov Selkowitz	18004cd98e	Sync FIPS patch from c10s This fixes compatibility with golang 1.22 in ELN.	2024-06-26 17:20:12 -04:00
Sam Feifer	794deb8c05	Allow for mssql datasource	2024-06-26 10:56:21 -04:00
Jan Kurik	e090db2d65	Introduced rpminspect.yaml with branch test disabled	2024-04-22 17:56:18 +02:00
Sam Feifer	0d69776de3	Remove unused code under apsl licenses	2024-04-18 16:02:21 -04:00
Sam Feifer	d2e04de310	Rebase to grafana 10.2.6	2024-03-28 11:52:33 -04:00
Jan Kurik	dfcb3fc0e7	Enable specific plan for gating	2024-03-26 12:48:22 +01:00
Jan Kurik	a613e53f89	Cleanup of gating configuration	2024-03-26 12:42:30 +01:00
Sam Feifer	054b331461	Rebase to Grafana 10.2.5	2024-03-20 11:41:15 -04:00
Sam Feifer	d902d62345	Bump release and add changelog for previous commit	2024-03-13 16:18:48 -04:00
Sam Feifer	d3d0f192a1	Fix issue with grafana-cli command during rebase	2024-03-13 16:09:58 -04:00
Sam Feifer	74196551b8	rebase to grafana 10.2.3	2024-03-06 11:37:45 -05:00
Maxwell G	64ac5e3a93	Rebuild for golang 1.22.0	2024-02-11 23:24:49 +00:00
Sam Feifer	cafc25a0b0	Allow postgreSQL selinux and gid to be 0	2024-01-31 15:52:40 -05:00
Fedora Release Engineering	21e86afeef	Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild	2024-01-24 20:56:59 +00:00
Fedora Release Engineering	0be17e0a47	Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild	2024-01-20 21:25:51 +00:00
Sam Feifer	0a301faf67	Fix postgresql AVC denials	2023-12-18 10:42:57 -05:00
Sam Feifer	51103637cb	Fix coredump caused by selinux denial	2023-12-15 11:55:48 -05:00
Sam Feifer	9a03130965	Fix AVC denials found only on certain architectures	2023-11-30 09:48:06 -05:00
Sam Feifer	66cf89ab9b	Fix AVC denials on specific architectures	2023-11-20 11:16:51 -05:00
Sam Feifer	f71f22a242	Fix additional AVC denials found when testing	2023-11-15 15:22:58 -05:00
Sam Feifer	23e6d56b77	Stop running faulty tests	2023-11-15 12:42:52 -05:00
Sam Feifer	756e76aa17	Fix AVC denials found when testing	2023-11-15 11:48:55 -05:00
Sam Feifer	2952ea608f	Hide relabeling messages when installing selinux	2023-11-09 15:36:38 -05:00
Sam Feifer	8e32711fab	Install selinux policy when installing grafana	2023-11-08 17:16:23 -05:00
Sam Feifer	13a60acf34	Skip problematic tests	2023-10-05 11:55:46 -04:00
Sam Feifer	1e676f5c30	Added selinux policy	2023-09-28 12:30:08 -04:00
Jan Kurik	1818ba3ad8	Transfer of tests to tests/grafana repo	2023-08-09 11:26:34 +02:00
Jan Kurik	ba32fdafe7	Removed an obsolete ci.fmf plan breaking automation	2023-07-25 19:01:18 +02:00
Jan Kurik	a17e087edd	Improved cleanup after licence-check test	2023-07-25 18:17:59 +02:00
Jan Kurik	3ffdbb5a31	Updated licence string to follow SPDX	2023-07-25 17:38:46 +02:00
Jan Kurik	d7eae17627	Use /var/tmp instead of /tmp for unpacking SRPM in licence-check test	2023-07-25 17:32:36 +02:00
Jan Kurik	dcd5f159ac	Add all tests to the gating plan	2023-07-24 08:40:11 +02:00
Carl George	f70a707434	resolve CVE-2023-3128 grafana: Remove Email Lookup from oauth integrations	2023-07-22 00:37:49 -05:00
Fedora Release Engineering	53f206ac65	Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>	2023-07-20 05:29:13 +00:00
Jan Kurik	401f1b0597	Implemented license check	2023-07-18 12:11:15 +02:00
Jan Kurik	d00a5f40c5	Introduced a TMT plan for gating	2023-07-18 12:06:05 +02:00
Yaakov Selkowitz	06d14c376f	Enable FIPS mode in ELN builds ELN now has a RHEL-like golang with FIPS support. With golang 1.19, GOEXPERIMENT=boringcrypto is needed because of the boring.Enabled() calls.	2023-06-29 13:52:31 -04:00
Stan Cox	11d08a039c	Update to upstream Grafana 9.2.10	2023-05-18 11:05:15 -04:00
Stan Cox	07328769ba	Update to upstream Grafana 9.2.10	2023-05-18 07:08:23 -04:00
Fedora Release Engineering	ce811794ee	Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>	2023-01-19 11:27:15 +00:00
Yaakov Selkowitz	89a8b91117	Disable FIPS on ELN ELN golang does not include the boringcrypto support present in RHEL.	2022-12-06 02:48:24 +00:00
Andreas Gerstmayr	329ced8843	update to upstream Grafana 9.0.9	2022-09-21 14:28:28 +02:00
Andreas Gerstmayr	b5e14d4705	update to upstream Grafana 9.0.8	2022-09-15 18:12:52 +02:00
Andreas Gerstmayr	ed6a83eef2	drop makefile in favor of create_bundles.sh script, drop husky patch	2022-09-13 19:52:37 +02:00
Andreas Gerstmayr	95ac515fcf	don't list /usr/share/grafana/conf twice	2022-09-07 15:51:54 +02:00
Andreas Gerstmayr	15e6076b1d	partially revert NODE_OPTIONS settings Partially revert `ffa6c2bb08` The OpenSSL legacy provider is not available in the F35 container and not required.	2022-09-07 13:51:58 +02:00
Andreas Gerstmayr	d5d007a430	sync provides/obsoletes with CentOS versions	2022-09-07 13:51:06 +02:00
Andreas Gerstmayr	ffa6c2bb08	update NODE_OPTIONS in build script, not in container * specify legacy OpenSSL provider until file-loader is removed * fix UI test command	2022-09-06 17:44:13 +02:00
Andreas Gerstmayr	4d72cb1a8e	update to upstream Grafana 9.0.5	2022-07-27 12:43:28 +02:00
Fedora Release Engineering	63c89e23be	Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>	2022-07-21 12:57:10 +00:00
Andreas Gerstmayr	4eb2bc3050	fix quoting in grafana-cli wrapper script	2022-07-14 14:28:36 +02:00
Andreas Gerstmayr	0ca120b8ba	use systemd-sysusers to create the Grafana user and group	2022-07-13 13:13:01 +02:00
Andreas Gerstmayr	cba27cf903	update to upstream Grafana 9.0.2	2022-07-07 19:49:51 +02:00
Andreas Gerstmayr	f922bfd4ed	update to upstream Grafana 8.5.6	2022-06-29 12:17:46 +02:00
Robert-André Mauchin	7a25e7f28a	Rebuilt for CVE-2022-1996, CVE-2022-24675, CVE-2022-28327, CVE-2022-27191, CVE-2022-29526, CVE-2022-30629	2022-06-19 11:47:40 +02:00
Andreas Gerstmayr	0215856343	remove openssl build dependency, add conditional for HMAC-SHA256 patch	2022-04-19 14:29:40 +02:00
Andreas Gerstmayr	bbde02e26d	use clamp-mtime when generating the vendor and webpack tarballs and round tarball mtime timestamp to midnight, to match SOURCE_DATE_EPOCH	2022-04-11 18:00:46 +02:00
Andreas Gerstmayr	8efab3c896	update to upstream Grafana 7.5.15, resolve CVE-2021-23648 and CVE-2022-21698	2022-04-08 18:57:17 +02:00
Jan Kurik	1b5c362107	Implementation of verify-systemd-units test case The test case verifies systemd unit files using systemd-analyze tool.	2022-03-07 09:14:29 +01:00
Andreas Gerstmayr	6463efb1e2	update to upstream Grafana 7.5.13, support go1.18	2022-01-28 19:33:35 +01:00
Fedora Release Engineering	8b29cc71e2	- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>	2022-01-20 11:42:54 +00:00
Andreas Gerstmayr	4905045f54	use HMAC-SHA-256 instead of SHA-1 to generate password reset tokens update FIPS tests in check phase	2022-01-18 19:28:03 +01:00
Andreas Gerstmayr	9d18845fa6	fix CVE-2021-44716 and CVE-2021-43813	2022-01-18 16:12:34 +01:00
Andreas Gerstmayr	497e262377	update rpmlintrc	2021-10-11 18:37:28 +02:00
Andreas Gerstmayr	7a938610cf	update to upstream version 7.5.11	2021-10-11 15:31:16 +02:00
Andreas Gerstmayr	b3f6907658	update patch handling and instructions	2021-10-08 16:53:45 +02:00
Andreas Gerstmayr	c29ffffe46	update rpmlintrc to ignore warning about vendor patches *.vendor.patch are applied in the Makefile, not in the specfile	2021-10-01 14:51:01 +02:00
Andreas Gerstmayr	6bb3f5d121	minor fix in Makefile	2021-10-01 13:32:07 +02:00
Andreas Gerstmayr	fea303393e	define gobuild and gotest macros in case they are not available	2021-09-30 18:08:19 +02:00
Andreas Gerstmayr	7f0368f33d	update to upstream version 7.5.10	2021-09-30 17:08:41 +02:00
Andreas Gerstmayr	b1a75dfdd6	rebuild to resolve CVE-2021-34558	2021-08-16 15:29:29 +02:00
Fedora Release Engineering	4099bfd2fb	- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>	2021-07-22 07:02:16 +00:00
Andreas Gerstmayr	6556266917	rebuild for 7.5.9-2 * remove unused dependency property-information * always include FIPS patch in SRPM	2021-07-08 16:16:48 +02:00
Andreas Gerstmayr	31059f957a	setup OpenSSL FIPS provider in test phase Since OpenSSL 3 GOLANG_FIPS=1 is not sufficient anymore to exercise FIPS functionality, therefore a custom OpenSSL config is created enabling the OpenSSL FIPS provider in the test phase of the specfile.	2021-06-29 17:49:21 +02:00
Andreas Gerstmayr	d5a8a5e3a1	update to upstream version 7.5.9	2021-06-25 17:04:46 +02:00
Andreas Gerstmayr	6f684e2bea	update to upstream version 7.5.8 and remove unused dependencies selfsigned, http-signature and gofpdf	2021-06-18 16:23:45 +02:00
Andreas Gerstmayr	ae140cba9b	remove unused crypto, use OpenSSL if FIPS mode is enabled	2021-06-11 12:44:26 +02:00
Andreas Gerstmayr	f969f20576	update source hashes and minor updates to 007 patch	2021-05-25 19:24:10 +02:00
Andreas Gerstmayr	4998b969b6	update goldenfiles patch, call t.Skip in verifyGoldenResponse instead of executeMockedQuery	2021-05-25 18:04:24 +02:00
Andreas Gerstmayr	8515ac34cb	update to upstream version 7.5.7	2021-05-25 17:56:00 +02:00
Zbigniew Jędrzejewski-Szmek	2e345ff8c6	Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583.	2021-03-02 16:13:42 +01:00
Jan Kurik	a59fc24268	Initial set of gating tests for grafana on Fedora	2021-02-03 19:58:40 +01:00
Fedora Release Engineering	7dbccd67bd	- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>	2021-01-26 12:53:57 +00:00
Andreas Gerstmayr	093c901afa	updates for Grafana 7.3.6-2 build - change working dir to $GRAFANA_HOME in grafana-cli wrapper (fixes Red Hat BZ #1916083) - add pcp-redis-datasource to allow_loading_unsigned_plugins config option	2021-01-22 12:42:12 +01:00
Andreas Gerstmayr	8b048a5bf5	update to upstream version 7.3.6	2020-12-21 19:42:28 +01:00
Andreas Gerstmayr	6b8f02a56e	update to upstream version 7.3.4	2020-11-25 18:55:36 +01:00
Andreas Gerstmayr	07f640b8f3	re-add comment about vendored deps	2020-11-10 20:22:40 +01:00
Andreas Gerstmayr	8232254ba4	fix merge conflict, update README	2020-11-10 20:19:51 +01:00
Andreas Gerstmayr	35e322cb71	update to upstream version 7.3.1, resolve RHBZ #1843170	2020-11-10 20:14:13 +01:00
Fedora Release Engineering	fa4f56cd7c	- Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>	2020-08-01 03:20:29 +00:00
Andreas Gerstmayr	7a1a656aa3	update to upstream version 7.1.1	2020-07-30 18:09:47 +02:00
Fedora Release Engineering	21d92f3f7f	- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>	2020-07-28 00:17:23 +00:00
Andreas Gerstmayr	111fbc27f0	update to upstream 6.7.4 security fix for CVE-2020-13379	2020-06-05 15:17:12 +02:00
Andreas Gerstmayr	9b5a7ad653	Merge #1 `Don't use recommends when not supported`	2020-04-30 10:30:28 +00:00
Andreas Gerstmayr	365729b038	add helper scripts to SRPM, fix perms on upgrade, update changelog	2020-04-30 11:58:34 +02:00
Andreas Gerstmayr	09156edf8f	remove %commit, update sources	2020-04-28 14:01:56 +02:00
Andreas Gerstmayr	f7791a6ad7	update /var/lib/grafana directory permissions	2020-04-27 20:54:29 +02:00
Andreas Gerstmayr	925160cd8d	create grafana.db in %post (should not be in %files section)	2020-04-24 18:18:22 +02:00
Andreas Gerstmayr	fab93d6736	update to grafana 6.7.3, fix permissions for grafana.db and grafana.ini	2020-04-23 22:13:03 +02:00
Andreas Gerstmayr	355749558c	update to upstream version 6.7.2, add scripts to ease upgrade process	2020-04-23 19:14:27 +02:00
Nicolas Chauvet	f852e2f945	Don't use recommends when not supported Signed-off-by: Nicolas Chauvet <kwizart@gmail.com>	2020-03-09 16:21:09 +01:00
Mark Goodwin	add390a657	add grafana.rpmlintrc	2020-03-04 09:57:43 +11:00
Mark Goodwin	2e8a4f2b32	Update to latest upstream sources v6.6.2	2020-02-26 08:38:50 +11:00
Fedora Release Engineering	62208e25fb	- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>	2020-01-29 03:27:02 +00:00
Mark Goodwin	47a36c9081	Update to latest upstream sources v6.3.6	2019-11-27 10:35:10 +11:00
Mark Goodwin	25db04d286	update to latest upstream sources v6.3.5 Resolves: bz1735308	2019-09-05 17:15:31 +10:00