From 1924cfa221cdffe7c958c3ebcaacdbaad6783579 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Mon, 27 Jul 2026 00:02:26 -0400 Subject: [PATCH] import CS git grafana-9.2.10-32.el8_10 --- .gitignore | 2 +- .grafana.metadata | 2 +- SOURCES/0019-update-go-billy-version.patch | 119 +++++++++++++++++++++ SOURCES/create_vendor_bundle.sh | 1 + SPECS/grafana.spec | 26 +++-- 5 files changed, 134 insertions(+), 16 deletions(-) create mode 100644 SOURCES/0019-update-go-billy-version.patch diff --git a/.gitignore b/.gitignore index f4d1ea0..82c9bbb 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,3 @@ SOURCES/grafana-9.2.10.tar.gz -SOURCES/grafana-vendor-9.2.10-31.tar.xz +SOURCES/grafana-vendor-9.2.10-32.tar.xz SOURCES/grafana-webpack-9.2.10-21.tar.gz diff --git a/.grafana.metadata b/.grafana.metadata index 487299f..5d508e9 100644 --- a/.grafana.metadata +++ b/.grafana.metadata @@ -1,3 +1,3 @@ 4c9db312dca444023c37c7af9acd2876a7e164b8 SOURCES/grafana-9.2.10.tar.gz -6264efdecdbfbe05d3937ff7f5fbc8f99db0e797 SOURCES/grafana-vendor-9.2.10-31.tar.xz +0735c8944a2af71b4c36319e3ec80d20d3b1d923 SOURCES/grafana-vendor-9.2.10-32.tar.xz f66e9f954173212fb43bebd00756cf3c78362ea1 SOURCES/grafana-webpack-9.2.10-21.tar.gz diff --git a/SOURCES/0019-update-go-billy-version.patch b/SOURCES/0019-update-go-billy-version.patch new file mode 100644 index 0000000..0669efc --- /dev/null +++ b/SOURCES/0019-update-go-billy-version.patch @@ -0,0 +1,119 @@ +diff --git a/go.mod b/go.mod +index 9a1a48a..9ce9855 100644 +--- a/go.mod ++++ b/go.mod +@@ -48,7 +48,7 @@ require ( + github.com/gogo/protobuf v1.3.2 + github.com/golang/mock v1.6.0 + github.com/golang/snappy v0.0.4 +- github.com/google/go-cmp v0.6.0 ++ github.com/google/go-cmp v0.7.0 + github.com/google/uuid v1.3.0 + github.com/google/wire v0.6.0 + github.com/gorilla/websocket v1.5.0 +@@ -86,7 +86,7 @@ require ( + github.com/prometheus/prometheus v1.8.2-0.20211011171444-354d8d2ecfac + github.com/robfig/cron/v3 v3.0.1 + github.com/russellhaering/goxmldsig v1.1.1 +- github.com/stretchr/testify v1.10.0 ++ github.com/stretchr/testify v1.11.1 + github.com/teris-io/shortid v0.0.0-20171029131806-771a37caa5cf + github.com/ua-parser/uap-go v0.0.0-20211112212520-00c877edfe0f + github.com/uber/jaeger-client-go v2.29.1+incompatible +@@ -103,7 +103,7 @@ require ( + go.opentelemetry.io/otel/sdk v1.6.3 + go.opentelemetry.io/otel/trace v1.6.3 + golang.org/x/crypto v0.51.0 +- golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 ++ golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f + golang.org/x/net v0.55.0 // indirect + golang.org/x/oauth2 v0.0.0-20220608161450-d0670ef3b1eb + golang.org/x/sync v0.20.0 +@@ -266,7 +266,7 @@ require ( + github.com/buildkite/yaml v2.1.0+incompatible // indirect + github.com/cloudflare/circl v1.3.7 // indirect + github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect +- github.com/cyphar/filepath-securejoin v0.2.5 // indirect ++ github.com/cyphar/filepath-securejoin v0.6.1 // indirect + github.com/drone/drone-yaml v0.0.0-20190729072335-70fa398b3560 // indirect + github.com/google/go-querystring v1.1.0 // indirect + github.com/google/gofuzz v1.2.0 // indirect +@@ -310,7 +310,7 @@ require ( + github.com/fsnotify/fsnotify v1.5.4 // indirect + github.com/ghodss/yaml v1.0.1-0.20190212211648-25d852aebe32 // indirect + github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect +- github.com/go-git/go-billy/v5 v5.6.0 // indirect ++ github.com/go-git/go-billy/v5 v5.9.0 // indirect + github.com/go-logr/logr v1.2.3 // indirect + github.com/go-logr/stdr v1.2.2 // indirect + github.com/golang-jwt/jwt v3.2.2+incompatible // indirect +diff --git a/go.sum b/go.sum +index 9b66c28..fad36b7 100644 +--- a/go.sum ++++ b/go.sum +@@ -672,8 +672,8 @@ github.com/crossdock/crossdock-go v0.0.0-20160816171116-049aabb0122b/go.mod h1:v + github.com/cucumber/godog v0.8.1/go.mod h1:vSh3r/lM+psC1BPXvdkSEuNjmXfpVqrMGYAElF6hxnA= + github.com/cyberdelia/templates v0.0.0-20141128023046-ca7fffd4298c/go.mod h1:GyV+0YP4qX0UQ7r2MoYZ+AvYDp12OF5yg4q8rGnyNh4= + github.com/cyphar/filepath-securejoin v0.2.2/go.mod h1:FpkQEhXnPnOthhzymB7CGsFk2G9VLXONKD9G7QGMM+4= +-github.com/cyphar/filepath-securejoin v0.2.5 h1:6iR5tXJ/e6tJZzzdMc1km3Sa7RRIVBKAK32O2s7AYfo= +-github.com/cyphar/filepath-securejoin v0.2.5/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4= ++github.com/cyphar/filepath-securejoin v0.6.1 h1:5CeZ1jPXEiYt3+Z6zqprSAgSWiggmpVyciv8syjIpVE= ++github.com/cyphar/filepath-securejoin v0.6.1/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc= + github.com/cznic/b v0.0.0-20180115125044-35e9bbe41f07/go.mod h1:URriBxXwVq5ijiJ12C7iIZqlA69nTlI+LgI6/pwftG8= + github.com/cznic/fileutil v0.0.0-20180108211300-6a051e75936f/go.mod h1:8S58EK26zhXSxzv7NQFpnliaOQsmDUxvoQO3rt154Vg= + github.com/cznic/golex v0.0.0-20170803123110-4ab7c5e190e4/go.mod h1:+bmmJDNmKlhWNG+gwWCkaBoTy39Fs+bzRxVBzoTQbIc= +@@ -895,8 +895,8 @@ github.com/go-fonts/liberation v0.1.1/go.mod h1:K6qoJYypsmfVjWg8KOVDQhLc8UDgIK2H + github.com/go-fonts/stix v0.1.0/go.mod h1:w/c1f0ldAUlJmLBvlbkvVXLAD+tAMqobIIQpmnUIzUY= + github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI= + github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic= +-github.com/go-git/go-billy/v5 v5.6.0 h1:w2hPNtoehvJIxR00Vb4xX94qHQi/ApZfX+nBE2Cjio8= +-github.com/go-git/go-billy/v5 v5.6.0/go.mod h1:sFDq7xD3fn3E0GOwUSZqHo9lrkmx8xJhA0ZrfvjBRGM= ++github.com/go-git/go-billy/v5 v5.9.0 h1:jItGXszUDRtR/AlferWPTMN4j38BQ88XnXKbilmmBPA= ++github.com/go-git/go-billy/v5 v5.9.0/go.mod h1:jCnQMLj9eUgGU7+ludSTYoZL/GGmii14RxKFj7ROgHw= + github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4= + github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII= + github.com/go-git/go-git/v5 v5.13.0 h1:vLn5wlGIh/X78El6r3Jr+30W16Blk0CTcxTYcYPWi5E= +@@ -1245,8 +1245,8 @@ github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/ + github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= + github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE= + github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= +-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI= +-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= ++github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= ++github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= + github.com/google/go-github v17.0.0+incompatible/go.mod h1:zLgOLi98H3fifZn+44m+umXrS52loVEgC2AApnigrVQ= + github.com/google/go-github/v45 v45.2.0 h1:5oRLszbrkvxDDqBCNj2hjDZMKmvexaZ1xw/FCD+K3FI= + github.com/google/go-github/v45 v45.2.0/go.mod h1:FObaZJEDSTa/WGCzZ2Z3eoCDXWJKMenWWTrd8jrta28= +@@ -2225,8 +2225,8 @@ github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFR + github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc= + github.com/rogpeppe/go-internal v1.8.0/go.mod h1:WmiCO8CzOY8rg0OYDC4/i/2WRWAB6poM+XZ2dLUbcbE= + github.com/rogpeppe/go-internal v1.8.1/go.mod h1:JeRgkft04UBgHMgCIwADu4Pn6Mtm5d4nPKWu0nJ5d+o= +-github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M= +-github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA= ++github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= ++github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= + github.com/rs/cors v1.8.0/go.mod h1:EBwu+T5AvHOcXwvZIkQFjUN6s8Czyqw12GL/Y0tUyRM= + github.com/rs/cors v1.8.2 h1:KCooALfAYGs415Cwu5ABvv9n9509fSiG5SQJn/AQo4U= + github.com/rs/cors v1.8.2/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU= +@@ -2364,8 +2364,8 @@ github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/ + github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= + github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= + github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= +-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA= +-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY= ++github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= ++github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= + github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw= + github.com/syndtr/gocapability v0.0.0-20170704070218-db04d3cc01c8/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww= + github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww= +@@ -2729,8 +2729,8 @@ golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMk + golang.org/x/exp v0.0.0-20200331195152-e8c3332aa8e5/go.mod h1:4M0jN8W1tt0AVLNr8HDosyJCDCDuyL9N9+3m7wDWgKw= + golang.org/x/exp v0.0.0-20200821190819-94841d0725da/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU= + golang.org/x/exp v0.0.0-20210126221216-84987778548c/go.mod h1:I6l2HNBLBZEcrOoCpyKLdY2lHoRZ8lI4x60KMCQDft4= +-golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8= +-golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY= ++golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM= ++golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80= + golang.org/x/image v0.0.0-20180708004352-c73c2afc3b81/go.mod h1:ux5Hcp/YLpHSI86hEcLt0YII63i6oz57MZXIpbrjZUs= + golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js= + golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0= diff --git a/SOURCES/create_vendor_bundle.sh b/SOURCES/create_vendor_bundle.sh index 0f1aedb..52f6efe 100755 --- a/SOURCES/create_vendor_bundle.sh +++ b/SOURCES/create_vendor_bundle.sh @@ -22,6 +22,7 @@ pushd "${SOURCE_DIR}" patch -p1 --fuzz=0 < ../0004-remove-unused-backend-dependencies.patch patch -p1 --fuzz=0 < ../0015-update-go-git-version.patch patch -p1 --fuzz=0 < ../0018-fix-x-net-CVE.patch +patch -p1 --fuzz=0 < ../0019-update-go-billy-version.patch go mod vendor # Generate Go files diff --git a/SPECS/grafana.spec b/SPECS/grafana.spec index 1b7cbf6..c1b2645 100644 --- a/SPECS/grafana.spec +++ b/SPECS/grafana.spec @@ -18,15 +18,7 @@ %define enable_fips_mode 0 %endif -%global grafana_arches %{lua: go_arches = {} - for arch in rpm.expand("%{go_arches}"):gmatch("%S+") do - go_arches[arch] = 1 - end - for arch in rpm.expand("%{nodejs_arches}"):gmatch("%S+") do - if go_arches[arch] then - print(arch .. " ") - end -end} +%global grafana_arches %{go_arches} %global gomodulesmode GO111MODULE=auto %global _gotestflags_save %{?gotestflags} @@ -36,7 +28,7 @@ end} Name: grafana Version: 9.2.10 -Release: 31%{?dist} +Release: 32%{?dist} Summary: Metrics dashboard and graph editor License: AGPLv3 URL: https://grafana.org @@ -47,7 +39,7 @@ Source0: https://github.com/grafana/grafana/archive/v%{version}/%{name} # Source1 contains the bundled Go and Node.js dependencies # Note: In case there were no changes to this tarball, the NVR of this tarball # lags behind the NVR of this package. -Source1: grafana-vendor-%{version}-31.tar.xz +Source1: grafana-vendor-%{version}-32.tar.xz %if %{compile_frontend} == 0 # Source2 contains the precompiled frontend @@ -100,6 +92,7 @@ Patch15: 0015-update-go-git-version.patch Patch16: 0016-fix-macaron-version-error.patch Patch17: 0017-fix-CVE-2025-4123.patch Patch18: 0018-fix-x-net-CVE.patch +Patch19: 0019-update-go-billy-version.patch # Patches affecting the vendor tarball Patch1001: 1001-vendor-patch-removed-backend-crypto.patch @@ -209,7 +202,7 @@ Provides: bundled(golang(github.com/gobwas/glob)) = 0.2.3 Provides: bundled(golang(github.com/gogo/protobuf)) = 1.3.2 Provides: bundled(golang(github.com/golang/mock)) = 1.6.0 Provides: bundled(golang(github.com/golang/snappy)) = 0.0.4 -Provides: bundled(golang(github.com/google/go-cmp)) = 0.6.0 +Provides: bundled(golang(github.com/google/go-cmp)) = 0.7.0 Provides: bundled(golang(github.com/google/uuid)) = 1.3.0 Provides: bundled(golang(github.com/google/wire)) = 0.6.0 Provides: bundled(golang(github.com/gorilla/websocket)) = 1.5.0 @@ -246,7 +239,7 @@ Provides: bundled(golang(github.com/prometheus/common)) = 0.37.0 Provides: bundled(golang(github.com/prometheus/prometheus)) = 1.8.2-0.20211011171444.354d8d2ecfac Provides: bundled(golang(github.com/robfig/cron/v3)) = 3.0.1 Provides: bundled(golang(github.com/russellhaering/goxmldsig)) = 1.1.1 -Provides: bundled(golang(github.com/stretchr/testify)) = 1.10.0 +Provides: bundled(golang(github.com/stretchr/testify)) = 1.11.1 Provides: bundled(golang(github.com/teris-io/shortid)) = 0.0.0-20171029131806.771a37caa5cf Provides: bundled(golang(github.com/ua-parser/uap-go)) = 0.0.0-20211112212520.00c877edfe0f Provides: bundled(golang(github.com/uber/jaeger-client-go)) = 2.29.1+incompatible @@ -262,7 +255,7 @@ Provides: bundled(golang(go.opentelemetry.io/otel/exporters/jaeger)) = 1.0.0 Provides: bundled(golang(go.opentelemetry.io/otel/sdk)) = 1.6.3 Provides: bundled(golang(go.opentelemetry.io/otel/trace)) = 1.6.3 Provides: bundled(golang(golang.org/x/crypto)) = 0.51.0 -Provides: bundled(golang(golang.org/x/exp)) = 0.0.0-20240719175910.8a7402abbf56 +Provides: bundled(golang(golang.org/x/exp)) = 0.0.0-20260410095643.746e56fc9e2f Provides: bundled(golang(golang.org/x/oauth2)) = 0.0.0-20220608161450.d0670ef3b1eb Provides: bundled(golang(golang.org/x/sync)) = 0.20.0 Provides: bundled(golang(golang.org/x/time)) = 0.0.0-20220609170525.579cf78fd858 @@ -781,6 +774,7 @@ cp -p %{SOURCE8} %{SOURCE9} %{SOURCE10} SELinux %patch -P 16 -p1 %patch -P 17 -p1 %patch -P 18 -p1 +%patch -P 19 -p1 %patch -P 1001 -p1 %if %{enable_fips_mode} @@ -1028,6 +1022,10 @@ fi %{_datadir}/selinux/*/grafana.pp %changelog +* Tue Jul 21 2026 Sam Feifer 9.2.10-32 +- Resolves RHEL-191816: CVE-2026-44740 +- Resolves RHEL-188279: Remove Lua ExclusiveArch macro for Konflux build + * Wed Jul 01 2026 Sam Feifer 9.2.10-31 - Resolves RHEL-183728: CVE-2026-39821