From 363d42fa0fbd7ac31fe309a0d0e989bae913242d Mon Sep 17 00:00:00 2001
From: Sam Feifer <sfeifer@redhat.com>
Date: Tue, 21 Jul 2026 13:51:28 -0400
Subject: [PATCH] Resolves: RHEL-188281

---
 1002-vendor-use-pbkdf2-from-OpenSSL.patch | 32 ++++++++++++++---------
 grafana.spec                              | 11 ++------
 2 files changed, 22 insertions(+), 21 deletions(-)

diff --git a/1002-vendor-use-pbkdf2-from-OpenSSL.patch b/1002-vendor-use-pbkdf2-from-OpenSSL.patch
index ad92fb1..7d268e0 100644
--- a/1002-vendor-use-pbkdf2-from-OpenSSL.patch
+++ b/1002-vendor-use-pbkdf2-from-OpenSSL.patch
@@ -107,29 +107,37 @@ index 0000000000..e244fb5663
 +	panic("boringcrypto: not available")
 +}
 diff --git a/vendor/golang.org/x/crypto/pbkdf2/pbkdf2.go b/vendor/golang.org/x/crypto/pbkdf2/pbkdf2.go
-index 593f653008..799a611f94 100644
+index 04a3487cf1..b20657944e 100644
 --- a/vendor/golang.org/x/crypto/pbkdf2/pbkdf2.go
 +++ b/vendor/golang.org/x/crypto/pbkdf2/pbkdf2.go
-@@ -19,8 +19,11 @@ pbkdf2.Key.
- package pbkdf2 // import "golang.org/x/crypto/pbkdf2"
- 
+@@ -12,8 +12,11 @@
+ package pbkdf2
+
  import (
 +	"crypto/boring"
- 	"crypto/hmac"
+ 	"crypto/pbkdf2"
  	"hash"
 +
 +	xboring "golang.org/x/crypto/internal/boring"
  )
- 
+
  // Key derives a key from the password, salt and iteration count, returning a
-@@ -40,6 +43,10 @@ import (
- // Using a higher iteration count will increase the cost of an exhaustive
- // search but will also make derivation proportionally slower.
+@@ -21,6 +24,10 @@
+ // derived based on the method described as PBKDF2 with the HMAC variant using
+ // the supplied hash function.
  func Key(password, salt []byte, iter, keyLen int, h func() hash.Hash) []byte {
 +	if boring.Enabled() {
 +		return xboring.Pbkdf2Key(password, salt, iter, keyLen, h)
 +	}
 +
- 	prf := hmac.New(h, password)
- 	hashLen := prf.Size()
- 	numBlocks := (keyLen + hashLen - 1) / hashLen
+ 	out, err := pbkdf2.Key(h, string(password), salt, iter, keyLen)
+ 	if err != nil {
+ 		// FIPS 140 enforcement, or an invalid key length.
+diff --git a/vendor/modules.txt b/vendor/modules.txt
+index 1234567890..abcdef1234 100644
+--- a/vendor/modules.txt
++++ b/vendor/modules.txt
+@@ -2028,2 +2028,3 @@
+ golang.org/x/crypto/internal/alias
++golang.org/x/crypto/internal/boring
+ golang.org/x/crypto/internal/poly1305
diff --git a/grafana.spec b/grafana.spec
index 98b46e4..d40c688 100644
--- a/grafana.spec
+++ b/grafana.spec
@@ -8,15 +8,7 @@
 %define enable_fips_mode 0
 %endif
 
-%global grafana_arches %{lua: go_arches = {}
-  for arch in rpm.expand("%{go_arches}"):gmatch("%S+") do
-    go_arches[arch] = 1
-  end
-  for arch in rpm.expand("%{nodejs_arches}"):gmatch("%S+") do
-    if go_arches[arch] then
-      print(arch .. " ")
-  end
-end}
+%global grafana_arches %{go_arches}
 
 %global gomodulesmode GO111MODULE=auto
 %global _gotestflags_save %{?gotestflags}
@@ -1032,6 +1024,7 @@ done
 * Thu Jul 09 2026 Sam Feifer <sfeifer@redhat.com> 10.2.6-23
 - Resolves RHEL-183848: CVE-2026-39821
 - Resolves RHEL-191577: CVE-2026-27136
+- Resolves RHEL-188281: Remove Lua ExclusiveArch macro for Konflux build
 
 * Wed Apr 22 2026 Sam Feifer <sfeifer@redhat.com> 10.2.6-22
 - Resolves RHEL-161804: CVE-2026-27877