Rebase to grafana 7.3.1

Resolves: #1850471

.gitignore

@@ -1,2 +1,4 @@
 /grafana-*.tar.gz
-/grafana_webpack-*.tar.gz
+/grafana-*.tar.gz.manifest
+/grafana-*/
+*.rpm

001-login-oauth-use-oauth2-exchange.patch

@@ -1,13 +0,0 @@
-diff --git a/pkg/api/login_oauth.go b/pkg/api/login_oauth.go
-index c8c9f05b33..1b5a67aec2 100644
---- a/pkg/api/login_oauth.go
-+++ b/pkg/api/login_oauth.go
-@@ -134,7 +134,7 @@ func (hs *HTTPServer) OAuthLogin(ctx *m.ReqContext) {
- 	oauthCtx := context.WithValue(context.Background(), oauth2.HTTPClient, oauthClient)
- 
- 	// get token from provider
--	token, err := connect.Exchange(oauthCtx, code)
-+	token, err := connect.Exchange(oauthCtx, code, oauth2.AccessTypeOnline)
- 	if err != nil {
- 		ctx.Handle(500, "login.OAuthLogin(NewTransportWithCode)", err)
- 		return

001-wrappers-grafana-cli.patch

@@ -0,0 +1,47 @@
+diff --git a/packaging/wrappers/grafana-cli b/packaging/wrappers/grafana-cli
+index 9cad151c0d..a786edc596 100755
+--- a/packaging/wrappers/grafana-cli
++++ b/packaging/wrappers/grafana-cli
+@@ -5,18 +5,19 @@
+ # the system-wide Grafana configuration that was bundled with the package as we
+ # use the binary.
+ 
+-DEFAULT=/etc/default/grafana
++DEFAULT=/etc/sysconfig/grafana-server
+ 
+ GRAFANA_HOME=/usr/share/grafana
+ CONF_DIR=/etc/grafana
+ DATA_DIR=/var/lib/grafana
+ PLUGINS_DIR=/var/lib/grafana/plugins
+ LOG_DIR=/var/log/grafana
++LIBEXEC_DIR=/usr/libexec/grafana
+ 
+ CONF_FILE=$CONF_DIR/grafana.ini
+ PROVISIONING_CFG_DIR=$CONF_DIR/provisioning
+ 
+-EXECUTABLE=$GRAFANA_HOME/bin/grafana-cli
++EXECUTABLE=$LIBEXEC_DIR/grafana-cli
+ 
+ if [ ! -x $EXECUTABLE ]; then
+  echo "Program not installed or not executable"
+@@ -24,6 +25,7 @@ if [ ! -x $EXECUTABLE ]; then
+ fi
+ 
+ # overwrite settings from default file
++#shellcheck disable=SC1090
+ if [ -f "$DEFAULT" ]; then
+   . "$DEFAULT"
+ fi
+@@ -36,4 +38,11 @@ OPTS="--homepath=${GRAFANA_HOME} \
+                         cfg:default.paths.logs=${LOG_DIR} \
+                         cfg:default.paths.plugins=${PLUGINS_DIR}'"
+ 
+-eval $EXECUTABLE "$OPTS" "$@"
++if [ "$(id -u)" -eq 0 ]; then
++  exec runuser -u "${GRAFANA_USER}" -- "$EXECUTABLE" "$OPTS" "$@"
++elif [ "$(id -u -n)" = "${GRAFANA_USER}" ]; then
++  exec "$EXECUTABLE" "$OPTS" "$@"
++else
++  echo "Please run this script as user \"${GRAFANA_USER}\" or root."
++  exit 5
++fi

002-manpages.patch

@@ -1,10 +1,10 @@
 diff --git a/docs/man/man1/grafana-cli.1 b/docs/man/man1/grafana-cli.1
 new file mode 100644
-index 0000000000..171748fcda
+index 0000000000..7ac2af882c
 --- /dev/null
 +++ b/docs/man/man1/grafana-cli.1
-@@ -0,0 +1,51 @@
+@@ -0,0 +1,60 @@
-+.TH GRAFANA "1" "February 2019" "Grafana cli version 5.4.3" "User Commands"
++.TH GRAFANA "1" "November 2020" "Grafana cli version 7.3.1" "User Commands"
 +.SH NAME
 +grafana-cli \- command line administration for the Grafana metrics dashboard and graph editor
 +.SH DESCRIPTION
@@ -41,6 +41,15 @@ index 0000000000..171748fcda
 +\fB\-\-debug\fR, \fB\-d\fR
 +enable debug logging
 +.TP
++\fB\-\-configOverrides\fR value
++Configuration options to override defaults as a string. e.g. cfg:default.paths.log=/dev/null
++.TP
++\fB\-\-homepath\fR value
++Path to Grafana install/home path, defaults to working directory
++.TP
++\fB\-\-config\fR value
++Path to config file
++.TP
 +\fB\-\-help\fR, \fB\-h\fR
 +show help
 +.TP
@@ -57,11 +66,11 @@ index 0000000000..171748fcda
 +.BR http://docs.grafana.org/ .
 diff --git a/docs/man/man1/grafana-server.1 b/docs/man/man1/grafana-server.1
 new file mode 100644
-index 0000000000..30b7c1306f
+index 0000000000..c616268b31
 --- /dev/null
 +++ b/docs/man/man1/grafana-server.1
-@@ -0,0 +1,156 @@
+@@ -0,0 +1,84 @@
-+.TH VERSION "1" "February 2019" "Version 5.4.3" "User Commands"
++.TH VERSION "1" "November 2020" "Version 7.3.1" "User Commands"
 +.SH NAME
 +grafana-server \- back-end server for the Grafana metrics dashboard and graph editor
 +.SH DESCRIPTION
@@ -90,14 +99,25 @@ index 0000000000..30b7c1306f
 +.BR /etc/grafana/grafana.ini
 +and is well documented with comments.
 +The command-line options listed below override options of
-+the same (or similar) name in the configuration file and also provide
++the same (or similar) name in the configuration file.
-+additional options for testing Grafana.
 +.P
 +.HP
 +\fB\-config\fR string
 +.IP
 +path to config file
 +.HP
++\fB\-convey-json\fR
++.IP
++When true, emits results in JSON blocks. Default: 'false'
++.HP
++\fB\-convey-silent\fR
++.IP
++When true, all output from GoConvey is suppressed.
++.HP
++\fB\-convey-story\fR
++.IP
++When true, emits story output, otherwise emits dot output. When not provided, this flag mirrors the value of the '-test.v' flag
++.HP
 +\fB\-homepath\fR string
 +.IP
 +path to grafana install/home path, defaults to working directory
@@ -114,103 +134,20 @@ index 0000000000..30b7c1306f
 +.IP
 +Turn on pprof profiling
 +.HP
-+\fB\-profile\-port\fR int
++\fB\-profile\-port\fR uint
 +.IP
 +Define custom port for profiling (default 6060)
 +.HP
-+\fB\-test\fR.bench regexp
++\fB\-tracing\fR
 +.IP
-+run only benchmarks matching regexp
++Turn on tracing
 +.HP
-+\fB\-test\fR.benchmem
++\fB\-tracing\-file\fR string
 +.IP
-+print memory allocations for benchmarks
++Define tracing output file (default "trace.out")
-+.HP
-+\fB\-test\fR.benchtime d
-+.IP
-+run each benchmark for duration d (default 1s)
-+.HP
-+\fB\-test\fR.blockprofile file
-+.IP
-+write a goroutine blocking profile to file
-+.HP
-+\fB\-test\fR.blockprofilerate rate
-+.IP
-+set blocking profile rate (see runtime.SetBlockProfileRate) (default 1)
-+.HP
-+\fB\-test\fR.count n
-+.IP
-+run tests and benchmarks n times (default 1)
-+.HP
-+\fB\-test\fR.coverprofile file
-+.IP
-+write a coverage profile to file
-+.HP
-+\fB\-test\fR.cpu list
-+.IP
-+comma\-separated list of cpu counts to run each test with
-+.HP
-+\fB\-test\fR.cpuprofile file
-+.IP
-+write a cpu profile to file
-+.HP
-+\fB\-test\fR.failfast
-+.IP
-+do not start new tests after the first test failure
-+.HP
-+\fB\-test\fR.list regexp
-+.IP
-+list tests, examples, and benchmarks matching regexp then exit
-+.HP
-+\fB\-test\fR.memprofile file
-+.IP
-+write a memory profile to file
-+.HP
-+\fB\-test\fR.memprofilerate rate
-+.IP
-+set memory profiling rate (see runtime.MemProfileRate)
-+.HP
-+\fB\-test\fR.mutexprofile string
-+.IP
-+write a mutex contention profile to the named file after execution
-+.HP
-+\fB\-test\fR.mutexprofilefraction int
-+.IP
-+if >= 0, calls runtime.SetMutexProfileFraction() (default 1)
-+.HP
-+\fB\-test\fR.outputdir dir
-+.IP
-+write profiles to dir
-+.HP
-+\fB\-test\fR.parallel n
-+.IP
-+run at most n tests in parallel (default 8)
-+.HP
-+\fB\-test\fR.run regexp
-+.IP
-+run only tests and examples matching regexp
-+.HP
-+\fB\-test\fR.short
-+.IP
-+run smaller test suite to save time
-+.HP
-+\fB\-test\fR.testlogfile file
-+.IP
-+write test action log to file (for use only by cmd/go)
-+.HP
-+\fB\-test\fR.timeout d
-+.IP
-+panic test binary after duration d (default 0, timeout disabled)
-+.HP
-+\fB\-test\fR.trace file
-+.IP
-+write an execution trace to file
-+.HP
-+\fB\-test\fR.v
-+.IP
-+verbose: print additional output
 +.TP
 +\fB\-v\fR
++.IP
 +prints current version and exits
 +.SH "SEE ALSO"
 +The full documentation for

002-remove-jaeger-tracing.patch

@@ -1,279 +0,0 @@
-diff --git a/pkg/cmd/grafana-server/server.go b/pkg/cmd/grafana-server/server.go
-index 0dace4ebab..f1a4bfde53 100644
---- a/pkg/cmd/grafana-server/server.go
-+++ b/pkg/cmd/grafana-server/server.go
-@@ -23,7 +23,6 @@ import (
- 	_ "github.com/grafana/grafana/pkg/infra/metrics"
- 	_ "github.com/grafana/grafana/pkg/infra/remotecache"
- 	_ "github.com/grafana/grafana/pkg/infra/serverlock"
--	_ "github.com/grafana/grafana/pkg/infra/tracing"
- 	_ "github.com/grafana/grafana/pkg/infra/usagestats"
- 	"github.com/grafana/grafana/pkg/login"
- 	"github.com/grafana/grafana/pkg/login/social"
-diff --git a/pkg/infra/tracing/tracing.go b/pkg/infra/tracing/tracing.go
-deleted file mode 100644
-index 923459786b..0000000000
---- a/pkg/infra/tracing/tracing.go
-+++ /dev/null
-@@ -1,161 +0,0 @@
--package tracing
--
--import (
--	"context"
--	"fmt"
--	"io"
--	"strings"
--
--	"github.com/grafana/grafana/pkg/infra/log"
--	"github.com/grafana/grafana/pkg/registry"
--	"github.com/grafana/grafana/pkg/setting"
--
--	opentracing "github.com/opentracing/opentracing-go"
--	jaegercfg "github.com/uber/jaeger-client-go/config"
--	"github.com/uber/jaeger-client-go/zipkin"
--)
--
--func init() {
--	registry.RegisterService(&TracingService{})
--}
--
--type TracingService struct {
--	enabled                  bool
--	address                  string
--	customTags               map[string]string
--	samplerType              string
--	samplerParam             float64
--	log                      log.Logger
--	closer                   io.Closer
--	zipkinPropagation        bool
--	disableSharedZipkinSpans bool
--
--	Cfg *setting.Cfg `inject:""`
--}
--
--func (ts *TracingService) Init() error {
--	ts.log = log.New("tracing")
--	ts.parseSettings()
--
--	if ts.enabled {
--		return ts.initGlobalTracer()
--	}
--
--	return nil
--}
--
--func (ts *TracingService) parseSettings() {
--	var section, err = ts.Cfg.Raw.GetSection("tracing.jaeger")
--	if err != nil {
--		return
--	}
--
--	ts.address = section.Key("address").MustString("")
--	if ts.address != "" {
--		ts.enabled = true
--	}
--
--	ts.customTags = splitTagSettings(section.Key("always_included_tag").MustString(""))
--	ts.samplerType = section.Key("sampler_type").MustString("")
--	ts.samplerParam = section.Key("sampler_param").MustFloat64(1)
--	ts.zipkinPropagation = section.Key("zipkin_propagation").MustBool(false)
--	ts.disableSharedZipkinSpans = section.Key("disable_shared_zipkin_spans").MustBool(false)
--}
--
--func (ts *TracingService) initJaegerCfg() (jaegercfg.Configuration, error) {
--	cfg := jaegercfg.Configuration{
--		ServiceName: "grafana",
--		Disabled:    !ts.enabled,
--		Sampler: &jaegercfg.SamplerConfig{
--			Type:  ts.samplerType,
--			Param: ts.samplerParam,
--		},
--		Reporter: &jaegercfg.ReporterConfig{
--			LogSpans:           false,
--			LocalAgentHostPort: ts.address,
--		},
--	}
--
--	_, err := cfg.FromEnv()
--	if err != nil {
--		return cfg, err
--	}
--	return cfg, nil
--}
--
--func (ts *TracingService) initGlobalTracer() error {
--	cfg, err := ts.initJaegerCfg()
--	if err != nil {
--		return err
--	}
--
--	jLogger := &jaegerLogWrapper{logger: log.New("jaeger")}
--
--	options := []jaegercfg.Option{}
--	options = append(options, jaegercfg.Logger(jLogger))
--
--	for tag, value := range ts.customTags {
--		options = append(options, jaegercfg.Tag(tag, value))
--	}
--
--	if ts.zipkinPropagation {
--		zipkinPropagator := zipkin.NewZipkinB3HTTPHeaderPropagator()
--		options = append(options,
--			jaegercfg.Injector(opentracing.HTTPHeaders, zipkinPropagator),
--			jaegercfg.Extractor(opentracing.HTTPHeaders, zipkinPropagator),
--		)
--
--		if !ts.disableSharedZipkinSpans {
--			options = append(options, jaegercfg.ZipkinSharedRPCSpan(true))
--		}
--	}
--
--	tracer, closer, err := cfg.NewTracer(options...)
--	if err != nil {
--		return err
--	}
--
--	opentracing.SetGlobalTracer(tracer)
--
--	ts.closer = closer
--
--	return nil
--}
--
--func (ts *TracingService) Run(ctx context.Context) error {
--	<-ctx.Done()
--
--	if ts.closer != nil {
--		ts.log.Info("Closing tracing")
--		ts.closer.Close()
--	}
--
--	return nil
--}
--
--func splitTagSettings(input string) map[string]string {
--	res := map[string]string{}
--
--	tags := strings.Split(input, ",")
--	for _, v := range tags {
--		kv := strings.Split(v, ":")
--		if len(kv) > 1 {
--			res[kv[0]] = kv[1]
--		}
--	}
--
--	return res
--}
--
--type jaegerLogWrapper struct {
--	logger log.Logger
--}
--
--func (jlw *jaegerLogWrapper) Error(msg string) {
--	jlw.logger.Error(msg)
--}
--
--func (jlw *jaegerLogWrapper) Infof(format string, args ...interface{}) {
--	msg := fmt.Sprintf(format, args...)
--	jlw.logger.Info(msg)
--}
-diff --git a/pkg/infra/tracing/tracing_test.go b/pkg/infra/tracing/tracing_test.go
-deleted file mode 100644
-index a6d71cf165..0000000000
---- a/pkg/infra/tracing/tracing_test.go
-+++ /dev/null
-@@ -1,94 +0,0 @@
--package tracing
--
--import (
--	"github.com/stretchr/testify/assert"
--	"github.com/stretchr/testify/require"
--	"os"
--	"testing"
--)
--
--func TestGroupSplit(t *testing.T) {
--	tests := []struct {
--		input    string
--		expected map[string]string
--	}{
--		{
--			input: "tag1:value1,tag2:value2",
--			expected: map[string]string{
--				"tag1": "value1",
--				"tag2": "value2",
--			},
--		},
--		{
--			input:    "",
--			expected: map[string]string{},
--		},
--		{
--			input:    "tag1",
--			expected: map[string]string{},
--		},
--	}
--
--	for _, test := range tests {
--		tags := splitTagSettings(test.input)
--		for k, v := range test.expected {
--			value, exists := tags[k]
--			assert.Truef(t, exists, "Tag %q not found for input %q", k, test.input)
--			assert.Equalf(t, v, value, "Tag %q has wrong value for input %q", k, test.input)
--		}
--	}
--}
--
--func TestInitJaegerCfg_Default(t *testing.T) {
--	ts := &TracingService{}
--	cfg, err := ts.initJaegerCfg()
--	require.NoError(t, err)
--
--	assert.True(t, cfg.Disabled)
--}
--
--func TestInitJaegerCfg_Enabled(t *testing.T) {
--	ts := &TracingService{enabled: true}
--	cfg, err := ts.initJaegerCfg()
--	require.NoError(t, err)
--
--	assert.False(t, cfg.Disabled)
--	assert.Equal(t, "localhost:6831", cfg.Reporter.LocalAgentHostPort)
--}
--
--func TestInitJaegerCfg_DisabledViaEnv(t *testing.T) {
--	os.Setenv("JAEGER_DISABLED", "true")
--	defer func() {
--		os.Unsetenv("JAEGER_DISABLED")
--	}()
--
--	ts := &TracingService{enabled: true}
--	cfg, err := ts.initJaegerCfg()
--	require.NoError(t, err)
--
--	assert.True(t, cfg.Disabled)
--}
--
--func TestInitJaegerCfg_EnabledViaEnv(t *testing.T) {
--	os.Setenv("JAEGER_DISABLED", "false")
--	defer func() {
--		os.Unsetenv("JAEGER_DISABLED")
--	}()
--
--	ts := &TracingService{enabled: false}
--	cfg, err := ts.initJaegerCfg()
--	require.NoError(t, err)
--
--	assert.False(t, cfg.Disabled)
--}
--
--func TestInitJaegerCfg_InvalidEnvVar(t *testing.T) {
--	os.Setenv("JAEGER_DISABLED", "totallybogus")
--	defer func() {
--		os.Unsetenv("JAEGER_DISABLED")
--	}()
--
--	ts := &TracingService{}
--	_, err := ts.initJaegerCfg()
--	require.EqualError(t, err, "cannot parse env var JAEGER_DISABLED=totallybogus: strconv.ParseBool: parsing \"totallybogus\": invalid syntax")
--}

003-remove-dashboard-abspath-test.patch

@@ -0,0 +1,41 @@
+diff --git a/pkg/services/provisioning/dashboards/file_reader_linux_test.go b/pkg/services/provisioning/dashboards/file_reader_linux_test.go
+index 3584bbc242..3d37f5e104 100644
+--- a/pkg/services/provisioning/dashboards/file_reader_linux_test.go
++++ b/pkg/services/provisioning/dashboards/file_reader_linux_test.go
+@@ -33,6 +33,11 @@ func TestProvisionedSymlinkedFolder(t *testing.T) {
+ 		t.Errorf("expected err to be nil")
+ 	}
+ 
++	want, err = filepath.EvalSymlinks(want)
++	if err != nil {
++		t.Errorf("expected err to be nil %v", err)
++	}
++
+ 	resolvedPath := reader.resolvedPath()
+ 	if resolvedPath != want {
+ 		t.Errorf("got %s want %s", resolvedPath, want)
+diff --git a/pkg/services/provisioning/dashboards/file_reader_test.go b/pkg/services/provisioning/dashboards/file_reader_test.go
+index 33fe6a0a68..2c67ebb677 100644
+--- a/pkg/services/provisioning/dashboards/file_reader_test.go
++++ b/pkg/services/provisioning/dashboards/file_reader_test.go
+@@ -340,20 +340,6 @@ func TestDashboardFileReader(t *testing.T) {
+ 				So(err, ShouldBeNil)
+ 
+ 				So(len(fakeService.provisioned["Default"]), ShouldEqual, 1)
+-				So(fakeService.provisioned["Default"][0].ExternalId, ShouldEqual, absPath1)
+-			})
+-
+-			Convey("Missing dashboard should be deleted if DisableDeletion = false", func() {
+-				reader, err := NewDashboardFileReader(cfg, logger)
+-				So(err, ShouldBeNil)
+-
+-				err = reader.startWalkingDisk()
+-				So(err, ShouldBeNil)
+-
+-				So(len(fakeService.provisioned["Default"]), ShouldEqual, 1)
+-				So(fakeService.provisioned["Default"][0].ExternalId, ShouldEqual, absPath1)
+-				So(len(fakeService.inserted), ShouldEqual, 1)
+-				So(fakeService.inserted[0].Dashboard.Id, ShouldEqual, 1)
+ 			})
+ 		})
+ 

004-skip-x86-goldenfiles-tests.patch

@@ -0,0 +1,59 @@
+diff --git a/packages/grafana-data/src/dataframe/ArrowDataFrame.test.ts b/packages/grafana-data/src/dataframe/ArrowDataFrame.test.ts
+index 96efaccfce..bcdd98144f 100644
+--- a/packages/grafana-data/src/dataframe/ArrowDataFrame.test.ts
++++ b/packages/grafana-data/src/dataframe/ArrowDataFrame.test.ts
+@@ -52,7 +52,7 @@ describe('Read/Write arrow Table to DataFrame', () => {
+     expect(after).toEqual(before);
+   });
+ 
+-  test('should read all types', () => {
++  test.skip('should read all types', () => {
+     const fullpath = path.resolve(__dirname, './__snapshots__/all_types.golden.arrow');
+     const arrow = fs.readFileSync(fullpath);
+     const table = Table.from([arrow]);
+diff --git a/packages/grafana-runtime/src/utils/queryResponse.test.ts b/packages/grafana-runtime/src/utils/queryResponse.test.ts
+index 25169669a0..05474366a2 100644
+--- a/packages/grafana-runtime/src/utils/queryResponse.test.ts
++++ b/packages/grafana-runtime/src/utils/queryResponse.test.ts
+@@ -38,7 +38,7 @@ const emptyResults = {
+ /* eslint-enable */
+ 
+ describe('GEL Utils', () => {
+-  test('should parse output with dataframe', () => {
++  test.skip('should parse output with dataframe', () => {
+     const res = toDataQueryResponse(resp);
+     const frames = res.data;
+     for (const frame of frames) {
+@@ -106,7 +106,7 @@ describe('GEL Utils', () => {
+     expect(frames.length).toEqual(0);
+   });
+ 
+-  test('resultWithError', () => {
++  test.skip('resultWithError', () => {
+     // Generated from:
+     // qdr.Responses[q.GetRefID()] = backend.DataResponse{
+     //   Error: fmt.Errorf("an Error: %w", fmt.Errorf("another error")),
+diff --git a/pkg/tsdb/influxdb/flux/executor_test.go b/pkg/tsdb/influxdb/flux/executor_test.go
+index e053c6c397..fc7685cbab 100644
+--- a/pkg/tsdb/influxdb/flux/executor_test.go
++++ b/pkg/tsdb/influxdb/flux/executor_test.go
+@@ -59,6 +59,7 @@ func (r *MockRunner) runQuery(ctx context.Context, q string) (*api.QueryTableRes
+ }
+ 
+ func verifyGoldenResponse(t *testing.T, name string) *backend.DataResponse {
++	t.Skip("x86 memory dump is not compatible with other architectures")
+ 	runner := &MockRunner{
+ 		testDataPath: name + ".csv",
+ 	}
+diff --git a/public/app/plugins/datasource/cloudwatch/specs/datasource.test.ts b/public/app/plugins/datasource/cloudwatch/specs/datasource.test.ts
+index 94c1991dae..8e5b35eb3b 100644
+--- a/public/app/plugins/datasource/cloudwatch/specs/datasource.test.ts
++++ b/public/app/plugins/datasource/cloudwatch/specs/datasource.test.ts
+@@ -88,6 +88,7 @@ describe('CloudWatchDatasource', () => {
+     });
+ 
+     it('should return log groups as an array of strings', async () => {
++      return; // "it.skip" of this test leads to a test failure of the other log group test, because the mock is not active (see beforeEach() above)
+       const logGroups = await ctx.ds.describeLogGroups();
+       const expectedLogGroups = [
+         '/aws/containerinsights/dev303-workshop/application',

004-wrappers-grafana-cli.patch

@@ -1,26 +0,0 @@
-diff --git a/packaging/wrappers/grafana-cli b/packaging/wrappers/grafana-cli
-index 9cad151c0d..6b7ec1ab42 100755
---- a/packaging/wrappers/grafana-cli
-+++ b/packaging/wrappers/grafana-cli
-@@ -12,11 +12,12 @@ CONF_DIR=/etc/grafana
- DATA_DIR=/var/lib/grafana
- PLUGINS_DIR=/var/lib/grafana/plugins
- LOG_DIR=/var/log/grafana
-+LIBEXEC_DIR=/usr/libexec/grafana
- 
- CONF_FILE=$CONF_DIR/grafana.ini
- PROVISIONING_CFG_DIR=$CONF_DIR/provisioning
- 
--EXECUTABLE=$GRAFANA_HOME/bin/grafana-cli
-+EXECUTABLE=$LIBEXEC_DIR/grafana-cli
- 
- if [ ! -x $EXECUTABLE ]; then
-  echo "Program not installed or not executable"
-@@ -24,6 +25,7 @@ if [ ! -x $EXECUTABLE ]; then
- fi
- 
- # overwrite settings from default file
-+#shellcheck disable=SC1090
- if [ -f "$DEFAULT" ]; then
-   . "$DEFAULT"
- fi

005-pkg-main-fix-import-paths.patch

@@ -1,17 +0,0 @@
-diff --git a/pkg/extensions/main.go b/pkg/extensions/main.go
-index a88f67ff9e..7844aa1227 100644
---- a/pkg/extensions/main.go
-+++ b/pkg/extensions/main.go
-@@ -9,10 +9,10 @@ import (
- 	"github.com/grafana/grafana/pkg/registry"
- 	"github.com/grafana/grafana/pkg/services/licensing"
- 	_ "github.com/jung-kurt/gofpdf"
--	_ "github.com/linkedin/goavro/v2"
-+	_ "github.com/linkedin/goavro"
- 	_ "github.com/pkg/errors"
- 	_ "github.com/robfig/cron"
--	_ "github.com/robfig/cron/v3"
-+	_ "gopkg.in/robfig/cron.v3"
- 	_ "github.com/stretchr/testify/require"
- 	_ "gopkg.in/square/go-jose.v2"
- )

006-pkg-setting-ini-default-section.patch

@@ -1,13 +0,0 @@
-diff --git a/pkg/setting/setting.go b/pkg/setting/setting.go
-index 19181be84e..9a745f67e4 100644
---- a/pkg/setting/setting.go
-+++ b/pkg/setting/setting.go
-@@ -387,7 +387,7 @@ func applyCommandLineDefaultProperties(props map[string]string, file *ini.File)
- func applyCommandLineProperties(props map[string]string, file *ini.File) {
- 	for _, section := range file.Sections() {
- 		sectionName := section.Name() + "."
--		if section.Name() == ini.DefaultSection {
-+		if section.Name() == ini.DEFAULT_SECTION {
- 			sectionName = ""
- 		}
- 		for _, key := range section.Keys() {

007-pkg-prometheus-client-query-range.patch

@@ -1,18 +0,0 @@
-diff --git a/pkg/tsdb/prometheus/prometheus.go b/pkg/tsdb/prometheus/prometheus.go
-index 1244031bb4..c1d85b7e53 100644
---- a/pkg/tsdb/prometheus/prometheus.go
-+++ b/pkg/tsdb/prometheus/prometheus.go
-@@ -112,10 +112,10 @@ func (e *PrometheusExecutor) Query(ctx context.Context, dsInfo *models.DataSourc
- 		span.SetTag("stop_unixnano", query.End.UnixNano())
- 		defer span.Finish()
- 
--		value, _, err := client.QueryRange(ctx, query.Expr, timeRange)
-+		value, queryErr := client.QueryRange(ctx, query.Expr, timeRange)
- 
--		if err != nil {
--			return nil, err
-+		if queryErr != nil {
-+			return nil, queryErr
- 		}
- 
- 		queryResult, err := parseResponse(value, query)

008-pkg-services-notifications-codes-Unknwon.patch

@@ -1,13 +0,0 @@
-diff --git a/pkg/services/notifications/codes.go b/pkg/services/notifications/codes.go
-index ae66aa1d1b..bfb95560fe 100644
---- a/pkg/services/notifications/codes.go
-+++ b/pkg/services/notifications/codes.go
-@@ -6,7 +6,7 @@ import (
- 	"fmt"
- 	"time"
- 
--	"github.com/unknwon/com"
-+	"github.com/Unknwon/com"
- 
- 	"github.com/grafana/grafana/pkg/models"
- 	"github.com/grafana/grafana/pkg/setting"

009-pkg-fix-xorm-import.patch

@@ -1,288 +0,0 @@
-diff --git a/pkg/services/sqlstore/datasource.go b/pkg/services/sqlstore/datasource.go
-index c84f6bb948..414e343a63 100644
---- a/pkg/services/sqlstore/datasource.go
-+++ b/pkg/services/sqlstore/datasource.go
-@@ -5,7 +5,7 @@ import (
- 	"github.com/grafana/grafana/pkg/components/simplejson"
-	"github.com/grafana/grafana/pkg/models"
- 
--	"github.com/go-xorm/xorm"
-+	"xorm.io/xorm"
- 
- 	"github.com/grafana/grafana/pkg/bus"
- 	"github.com/grafana/grafana/pkg/components/securejsondata"
-diff --git a/pkg/services/sqlstore/logger.go b/pkg/services/sqlstore/logger.go
-index 498c2b58c1..850e10cd21 100644
---- a/pkg/services/sqlstore/logger.go
-+++ b/pkg/services/sqlstore/logger.go
-@@ -5,7 +5,7 @@ import (
- 
- 	glog "github.com/grafana/grafana/pkg/infra/log"
- 
--	"github.com/go-xorm/core"
-+	"xorm.io/core"
- )
- 
- type XormLogger struct {
-diff --git a/pkg/services/sqlstore/migrations/annotation_mig.go b/pkg/services/sqlstore/migrations/annotation_mig.go
-index 3ec5df841e..505ab5cf6e 100644
---- a/pkg/services/sqlstore/migrations/annotation_mig.go
-+++ b/pkg/services/sqlstore/migrations/annotation_mig.go
-@@ -1,7 +1,7 @@
- package migrations
- 
- import (
--	"github.com/go-xorm/xorm"
-+	"xorm.io/xorm"
- 	. "github.com/grafana/grafana/pkg/services/sqlstore/migrator"
- )
- 
-diff --git a/pkg/services/sqlstore/migrations/migrations_test.go b/pkg/services/sqlstore/migrations/migrations_test.go
-index 62ecbaad11..a9a3b38e62 100644
---- a/pkg/services/sqlstore/migrations/migrations_test.go
-+++ b/pkg/services/sqlstore/migrations/migrations_test.go
-@@ -3,7 +3,7 @@ package migrations
- import (
- 	"testing"
- 
--	"github.com/go-xorm/xorm"
-+	"xorm.io/xorm"
- 	. "github.com/grafana/grafana/pkg/services/sqlstore/migrator"
- 	"github.com/grafana/grafana/pkg/services/sqlstore/sqlutil"
- 
-diff --git a/pkg/services/sqlstore/migrations/user_mig.go b/pkg/services/sqlstore/migrations/user_mig.go
-index 53110fe49b..e1a54a57bf 100644
---- a/pkg/services/sqlstore/migrations/user_mig.go
-+++ b/pkg/services/sqlstore/migrations/user_mig.go
-@@ -3,7 +3,7 @@ package migrations
- import (
- 	"fmt"
- 
--	"github.com/go-xorm/xorm"
-+	"xorm.io/xorm"
- 	. "github.com/grafana/grafana/pkg/services/sqlstore/migrator"
- 	"github.com/grafana/grafana/pkg/util"
- )
-diff --git a/pkg/services/sqlstore/migrator/column.go b/pkg/services/sqlstore/migrator/column.go
-index 28cef60a94..af093a8e59 100644
---- a/pkg/services/sqlstore/migrator/column.go
-+++ b/pkg/services/sqlstore/migrator/column.go
-@@ -1,7 +1,7 @@
- package migrator
- 
- // Notice
--// code based on parts from from https://github.com/go-xorm/core/blob/3e0fa232ab5c90996406c0cd7ae86ad0e5ecf85f/column.go
-+// code based on parts from from https://xorm.io/core/blob/3e0fa232ab5c90996406c0cd7ae86ad0e5ecf85f/column.go
- 
- type Column struct {
- 	Name            string
-diff --git a/pkg/services/sqlstore/migrator/dialect.go b/pkg/services/sqlstore/migrator/dialect.go
-index 0aa2be7301..5246f17971 100644
---- a/pkg/services/sqlstore/migrator/dialect.go
-+++ b/pkg/services/sqlstore/migrator/dialect.go
-@@ -4,7 +4,7 @@ import (
- 	"fmt"
- 	"strings"
- 
--	"github.com/go-xorm/xorm"
-+	"xorm.io/xorm"
- )
- 
- type Dialect interface {
-diff --git a/pkg/services/sqlstore/migrator/migrator.go b/pkg/services/sqlstore/migrator/migrator.go
-index 612a333a72..f314b6ea84 100644
---- a/pkg/services/sqlstore/migrator/migrator.go
-+++ b/pkg/services/sqlstore/migrator/migrator.go
-@@ -4,7 +4,7 @@ import (
- 	"time"
- 
- 	_ "github.com/go-sql-driver/mysql"
--	"github.com/go-xorm/xorm"
-+	"xorm.io/xorm"
- 	"github.com/grafana/grafana/pkg/infra/log"
- 	"github.com/grafana/grafana/pkg/util/errutil"
- 	_ "github.com/lib/pq"
-diff --git a/pkg/services/sqlstore/migrator/mysql_dialect.go b/pkg/services/sqlstore/migrator/mysql_dialect.go
-index 147df03357..a658819ea2 100644
---- a/pkg/services/sqlstore/migrator/mysql_dialect.go
-+++ b/pkg/services/sqlstore/migrator/mysql_dialect.go
-@@ -7,7 +7,7 @@ import (
- 
- 	"github.com/VividCortex/mysqlerr"
- 	"github.com/go-sql-driver/mysql"
--	"github.com/go-xorm/xorm"
-+	"xorm.io/xorm"
- )
- 
- type Mysql struct {
-diff --git a/pkg/services/sqlstore/migrator/postgres_dialect.go b/pkg/services/sqlstore/migrator/postgres_dialect.go
-index 70803f3a9e..5ae7c57ea5 100644
---- a/pkg/services/sqlstore/migrator/postgres_dialect.go
-+++ b/pkg/services/sqlstore/migrator/postgres_dialect.go
-@@ -5,7 +5,7 @@ import (
- 	"strconv"
- 	"strings"
- 
--	"github.com/go-xorm/xorm"
-+	"xorm.io/xorm"
- 	"github.com/grafana/grafana/pkg/util/errutil"
- 	"github.com/lib/pq"
- )
-diff --git a/pkg/services/sqlstore/migrator/sqlite_dialect.go b/pkg/services/sqlstore/migrator/sqlite_dialect.go
-index 8372898c35..a306badd82 100644
---- a/pkg/services/sqlstore/migrator/sqlite_dialect.go
-+++ b/pkg/services/sqlstore/migrator/sqlite_dialect.go
-@@ -3,7 +3,7 @@ package migrator
- import (
- 	"fmt"
- 
--	"github.com/go-xorm/xorm"
-+	"xorm.io/xorm"
- 	"github.com/mattn/go-sqlite3"
- )
- 
-diff --git a/pkg/services/sqlstore/migrator/types.go b/pkg/services/sqlstore/migrator/types.go
-index 48354998d8..957bef392d 100644
---- a/pkg/services/sqlstore/migrator/types.go
-+++ b/pkg/services/sqlstore/migrator/types.go
-@@ -4,7 +4,7 @@ import (
- 	"fmt"
- 	"strings"
- 
--	"github.com/go-xorm/xorm"
-+	"xorm.io/xorm"
- )
- 
- const (
-diff --git a/pkg/services/sqlstore/session.go b/pkg/services/sqlstore/session.go
-index 07f1d4524c..e44105c79c 100644
---- a/pkg/services/sqlstore/session.go
-+++ b/pkg/services/sqlstore/session.go
-@@ -4,7 +4,7 @@ import (
- 	"context"
- 	"reflect"
- 
--	"github.com/go-xorm/xorm"
-+	"xorm.io/xorm"
- )
- 
- type DBSession struct {
-diff --git a/pkg/services/sqlstore/sqlstore.go b/pkg/services/sqlstore/sqlstore.go
-index bede60f1ff..7076b76dd6 100644
---- a/pkg/services/sqlstore/sqlstore.go
-+++ b/pkg/services/sqlstore/sqlstore.go
-@@ -11,7 +11,7 @@ import (
- 	"time"
- 
- 	"github.com/go-sql-driver/mysql"
--	"github.com/go-xorm/xorm"
-+	"xorm.io/xorm"
- 	"github.com/grafana/grafana/pkg/bus"
- 	"github.com/grafana/grafana/pkg/infra/localcache"
- 	"github.com/grafana/grafana/pkg/infra/log"
-diff --git a/pkg/services/sqlstore/transactions.go b/pkg/services/sqlstore/transactions.go
-index 27928f52a4..6d9888af39 100644
---- a/pkg/services/sqlstore/transactions.go
-+++ b/pkg/services/sqlstore/transactions.go
-@@ -4,7 +4,7 @@ import (
- 	"context"
- 	"time"
- 
--	"github.com/go-xorm/xorm"
-+	"xorm.io/xorm"
- 	"github.com/grafana/grafana/pkg/bus"
- 	"github.com/grafana/grafana/pkg/infra/log"
- 	"github.com/grafana/grafana/pkg/util/errutil"
-diff --git a/pkg/tsdb/mssql/mssql.go b/pkg/tsdb/mssql/mssql.go
-index 1ca3778b9d..debe106fa7 100644
---- a/pkg/tsdb/mssql/mssql.go
-+++ b/pkg/tsdb/mssql/mssql.go
-@@ -8,7 +8,7 @@ import (
- 	"github.com/grafana/grafana/pkg/setting"
- 
- 	_ "github.com/denisenkom/go-mssqldb"
--	"github.com/go-xorm/core"
-+	"xorm.io/core"
- 	"github.com/grafana/grafana/pkg/infra/log"
- 	"github.com/grafana/grafana/pkg/models"
- 	"github.com/grafana/grafana/pkg/tsdb"
-diff --git a/pkg/tsdb/mssql/mssql_test.go b/pkg/tsdb/mssql/mssql_test.go
-index 760c6dcf07..84e5e0e219 100644
---- a/pkg/tsdb/mssql/mssql_test.go
-+++ b/pkg/tsdb/mssql/mssql_test.go
-@@ -8,7 +8,7 @@ import (
- 	"testing"
- 	"time"
- 
--	"github.com/go-xorm/xorm"
-+	"xorm.io/xorm"
- 	"github.com/grafana/grafana/pkg/components/securejsondata"
- 	"github.com/grafana/grafana/pkg/components/simplejson"
- 	"github.com/grafana/grafana/pkg/models"
-diff --git a/pkg/tsdb/mysql/mysql.go b/pkg/tsdb/mysql/mysql.go
-index 682c3bc456..5ae7a9a87d 100644
---- a/pkg/tsdb/mysql/mysql.go
-+++ b/pkg/tsdb/mysql/mysql.go
-@@ -13,7 +13,7 @@ import (
- 	"github.com/grafana/grafana/pkg/setting"
- 
- 	"github.com/go-sql-driver/mysql"
--	"github.com/go-xorm/core"
-+	"xorm.io/core"
- 	"github.com/grafana/grafana/pkg/infra/log"
- 	"github.com/grafana/grafana/pkg/models"
- 	"github.com/grafana/grafana/pkg/tsdb"
-diff --git a/pkg/tsdb/mysql/mysql_test.go b/pkg/tsdb/mysql/mysql_test.go
-index b2ff2bc969..609f923d2c 100644
---- a/pkg/tsdb/mysql/mysql_test.go
-+++ b/pkg/tsdb/mysql/mysql_test.go
-@@ -8,7 +8,7 @@ import (
- 	"testing"
- 	"time"
- 
--	"github.com/go-xorm/xorm"
-+	"xorm.io/xorm"
- 	"github.com/grafana/grafana/pkg/components/securejsondata"
- 	"github.com/grafana/grafana/pkg/components/simplejson"
- 	"github.com/grafana/grafana/pkg/models"
-diff --git a/pkg/tsdb/postgres/postgres.go b/pkg/tsdb/postgres/postgres.go
-index a417699c1d..f38b94913b 100644
---- a/pkg/tsdb/postgres/postgres.go
-+++ b/pkg/tsdb/postgres/postgres.go
-@@ -7,7 +7,7 @@ import (
- 
- 	"github.com/grafana/grafana/pkg/setting"
- 
--	"github.com/go-xorm/core"
-+	"xorm.io/core"
- 	"github.com/grafana/grafana/pkg/infra/log"
- 	"github.com/grafana/grafana/pkg/models"
- 	"github.com/grafana/grafana/pkg/tsdb"
-diff --git a/pkg/tsdb/postgres/postgres_test.go b/pkg/tsdb/postgres/postgres_test.go
-index 23d0830d3d..d839d42ddb 100644
---- a/pkg/tsdb/postgres/postgres_test.go
-+++ b/pkg/tsdb/postgres/postgres_test.go
-@@ -8,7 +8,7 @@ import (
- 	"testing"
- 	"time"
- 
--	"github.com/go-xorm/xorm"
-+	"xorm.io/xorm"
- 	"github.com/grafana/grafana/pkg/components/securejsondata"
- 	"github.com/grafana/grafana/pkg/components/simplejson"
- 	"github.com/grafana/grafana/pkg/models"
-diff --git a/pkg/tsdb/sqleng/sql_engine.go b/pkg/tsdb/sqleng/sql_engine.go
-index 0cfb1560e4..13bc84bd06 100644
---- a/pkg/tsdb/sqleng/sql_engine.go
-+++ b/pkg/tsdb/sqleng/sql_engine.go
-@@ -19,8 +19,8 @@ import (
- 
- 	"github.com/grafana/grafana/pkg/components/null"
- 
--	"github.com/go-xorm/core"
--	"github.com/go-xorm/xorm"
-+	"xorm.io/core"
-+	"xorm.io/xorm"
- 	"github.com/grafana/grafana/pkg/components/simplejson"
- 	"github.com/grafana/grafana/pkg/models"
- )

010-CVE-2020-13430.patch

@@ -1,21 +0,0 @@
-diff --git a/public/app/plugins/datasource/opentsdb/query_ctrl.ts b/public/app/plugins/datasource/opentsdb/query_ctrl.ts
-index 8569de2eb0..cbb1790625 100644
---- a/public/app/plugins/datasource/opentsdb/query_ctrl.ts
-+++ b/public/app/plugins/datasource/opentsdb/query_ctrl.ts
-@@ -2,6 +2,7 @@ import _ from 'lodash';
- import kbn from 'app/core/utils/kbn';
- import { QueryCtrl } from 'app/plugins/sdk';
- import { auto } from 'angular';
-+import { escapeHtml } from 'app/core/utils/text';
- 
- export class OpenTsQueryCtrl extends QueryCtrl {
-   static templateUrl = 'partials/query.editor.html';
-@@ -90,7 +91,7 @@ export class OpenTsQueryCtrl extends QueryCtrl {
- 
-   getTextValues(metricFindResult: any) {
-     return _.map(metricFindResult, value => {
--      return value.text;
-+      return escapeHtml(value.text);
-     });
-   }
- 

Makefile

@@ -0,0 +1,36 @@
+all: grafana-vendor-go-$(VER).tar.gz \
+     grafana-webpack-$(VER).tar.gz
+
+grafana-$(VER).tar.gz grafana-$(VER)/:
+	wget https://github.com/grafana/grafana/archive/v$(VER)/grafana-$(VER).tar.gz
+	rm -rf grafana-$(VER)
+	tar xfz grafana-$(VER).tar.gz
+	cd grafana-$(VER) && \
+	  for patch in ../*.patch; do patch -p1 < $$patch; done
+
+grafana-vendor-go-$(VER).tar.gz: grafana-$(VER)/
+	cd grafana-$(VER) && go mod vendor -v
+	tar cfz $@ grafana-$(VER)/vendor
+	awk '$$2~/^v/ && $$4 != "indirect" {print "Provides: bundled(golang(" $$1 ")) = " substr($$2, 2)}' grafana-$(VER)/go.mod | \
+	sed -E 's/=(.*)-(.*)-(.*)/=\1-\2.\3/g' > $@.manifest
+
+grafana-vendor-nodejs-$(VER).tar.gz: grafana-$(VER)/
+	cd grafana-$(VER) && yarn install --pure-lockfile
+
+	# Remove files with licensing issues
+	find grafana-$(VER) -type d -name 'node-notifier' -prune -exec rm -r {} \;
+	find grafana-$(VER) -name '*.exe' -delete
+
+	tar cfz $@ $$(find grafana-$(VER) -type d -name "node_modules" -prune)
+	./list_bundled_nodejs_packages.py grafana-$(VER)/ > $@.manifest
+
+grafana-webpack-$(VER).tar.gz: grafana-$(VER)/
+	cd grafana-$(VER) && \
+	  yarn install --pure-lockfile && \
+	  ../build_frontend.sh
+
+	tar cfz $@ grafana-$(VER)/public/build grafana-$(VER)/public/views grafana-$(VER)/plugins-bundled
+	./list_bundled_nodejs_packages.py grafana-$(VER)/ > $@.manifest
+
+clean:
+	rm -rf *.tar.gz *.manifest *.rpm grafana-*/

README.md

@@ -5,12 +5,20 @@ The grafana package
 (replace X.Y.Z with the new Grafana version)
 
 * update `Version` and `%changelog` in the specfile
-* download source tarball and create webpack: `./make_grafana_webpack.sh X.Y.Z`
+* create bundles and manifests: `VER=X.Y.Z make clean all`
-* update golang buildrequires: `./list_go_buildrequires.sh grafana-X.Y.Z` and replace the old golang `BuildRequires:` with the new ones
+* update specfile with contents of the `*.manifest` files
-* update nodejs provides: `./list_bundled_nodejs_packages.py grafana-X.Y.Z` and replace the old nodejs `Provides:` with the new ones
 * check if the default configuration has changed: `diff grafana-X.Y.Z/conf/defaults.ini distro-defaults.ini` and update `distro-defaults.ini` if necessary
-* install all new golang build dependencies: `sudo dnf builddep grafana.spec` and create packages for missing dependencies
+* run local build: `rpkg local`
-* run local build: `rpkg local`, and if any patches fail, update them accordingly
+* run rpm linter: `rpkg lint -r grafana.rpmlintrc`
-* run rpm linter: `rpkg lint`
+* run local builds with different OS versions: `./run_container_build.sh fedora-version`
-* run local builds with different OS versions: `./run_container_build.sh version` (place not yet published dependencies in the `deps/` directory)
 * run a scratch build: `fedpkg scratch-build --srpm`
+* upload new source tarballs: `fedpkg new-sources *.tar.gz`
+
+## Backporting
+* create the patch
+* declare and apply (`%prep`) the patch in the specfile
+* if the patch affects Go or Node.js dependencies, or the webpack
+  * create new tarballs and rename them to `grafana-...-X.Y.Z-R.tar.gz`
+  * update the specfile
+
+Note: the Makefile automatically applies all patches before creating the tarballs

build_frontend.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+
+# Build the frontend
+yarn run build
+
+# Build the bundled plugins
+mkdir plugins-bundled/external
+yarn run plugins:build-bundled
+for plugin in plugins-bundled/internal/input-datasource; do
+  mv $plugin $plugin.tmp
+  mv $plugin.tmp/dist $plugin
+  rm -rf $plugin.tmp
+done
+rm plugins-bundled/README.md plugins-bundled/.gitignore plugins-bundled/external.json
+
+# Fix permissions (webpack sometimes outputs files with mode = 666 due to reasons unknown (race condition/umask issue afaics))
+chmod -R g-w,o-w public/build plugins-bundled

distro-defaults.ini

@@ -1,4 +1,4 @@
-##################### Grafana Configuration Defaults for distros #####################
+##################### Grafana Configuration Defaults #####################
 #
 # Do not modify this file in grafana installs
 #
@@ -24,7 +24,7 @@ logs = /var/log/grafana
 plugins = /var/lib/grafana/plugins
 
 # folder that contains provisioning config files that grafana will apply on startup and while running.
-provisioning = conf/provisioning
+provisioning = /etc/grafana/provisioning
 
 #################################### Server ##############################
 [server]
@@ -126,10 +126,29 @@ connstr =
 # This enables data proxy logging, default is false
 logging = false
 
-# How long the data proxy should wait before timing out default is 30 (seconds)
+# How long the data proxy waits before timing out, default is 30 seconds.
+# This setting also applies to core backend HTTP data sources where query requests use an HTTP client with timeout set.
 timeout = 30
 
-# If enabled and user is not anonymous, data proxy will add X-Grafana-User header with username into the request, default is false.
+# How many seconds the data proxy waits before sending a keepalive request.
+keep_alive_seconds = 30
+
+# How many seconds the data proxy waits for a successful TLS Handshake before timing out.
+tls_handshake_timeout_seconds = 10
+
+# How many seconds the data proxy will wait for a server's first response headers after
+# fully writing the request headers if the request has an "Expect: 100-continue"
+# header. A value of 0 will result in the body being sent immediately, without
+# waiting for the server to approve.
+expect_continue_timeout_seconds = 1
+
+# The maximum number of idle connections that Grafana will keep alive.
+max_idle_connections = 100
+
+# How many seconds the data proxy keeps an idle connection open before timing out.
+idle_conn_timeout_seconds = 90
+
+# If enabled and user is not anonymous, data proxy will add X-Grafana-User header with username into the request.
 send_user_header = false
 
 #################################### Analytics ###########################
@@ -188,7 +207,6 @@ allow_embedding = false
 # Set to true if you want to enable http strict transport security (HSTS) response header.
 # This is only sent when HTTPS is enabled in this configuration.
 # HSTS tells browsers that the site should only be accessed using HTTPS.
-# The default will change to true in the next minor release, 6.3.
 strict_transport_security = false
 
 # Sets how long a browser should cache HSTS. Only applied if strict_transport_security is enabled.
@@ -202,12 +220,12 @@ strict_transport_security_subdomains = false
 
 # Set to true to enable the X-Content-Type-Options response header.
 # The X-Content-Type-Options response HTTP header is a marker used by the server to indicate that the MIME types advertised
-# in the Content-Type headers should not be changed and be followed. The default will change to true in the next minor release, 6.3.
+# in the Content-Type headers should not be changed and be followed.
-x_content_type_options = false
+x_content_type_options = true
 
 # Set to true to enable the X-XSS-Protection header, which tells browsers to stop pages from loading
-# when they detect reflected cross-site scripting (XSS) attacks. The default will change to true in the next minor release, 6.3.
+# when they detect reflected cross-site scripting (XSS) attacks.
-x_xss_protection = false
+x_xss_protection = true
 
 
 #################################### Snapshots ###########################
@@ -230,9 +248,12 @@ snapshot_remove_expired = true
 # Number dashboard versions to keep (per dashboard). Default: 20, Minimum: 1
 versions_to_keep = 20
 
-# Minimum dashboard refresh interval. When set, this will restrict users to set the refresh interval of a dashboard lower than given interval. Per default this is not set/unrestricted.
+# Minimum dashboard refresh interval. When set, this will restrict users to set the refresh interval of a dashboard lower than given interval. Per default this is 5 seconds.
 # The interval string is a possibly signed sequence of decimal numbers, followed by a unit suffix (ms, s, m, h, d), e.g. 30s or 1m.
-min_refresh_interval =
+min_refresh_interval = 1s
+
+# Path to the default home dashboard. If this value is empty, then Grafana uses StaticRootPath + "dashboards/home.json"
+default_home_dashboard_path =
 
 #################################### Users ###############################
 [users]
@@ -272,15 +293,18 @@ viewers_can_edit = false
 # Editors can administrate dashboard, folders and teams they create
 editors_can_admin = false
 
+# The duration in time a user invitation remains valid before expiring. This setting should be expressed as a duration. Examples: 6h (hours), 2d (days), 1w (week). Default is 24h (24 hours). The minimum supported duration is 15m (15 minutes).
+user_invite_max_lifetime_duration = 24h
+
 [auth]
 # Login cookie name
 login_cookie_name = grafana_session
 
-# The lifetime (days) an authenticated user can be inactive before being required to login at next visit. Default is 7 days.
+# The maximum lifetime (duration) an authenticated user can be inactive before being required to login at next visit. Default is 7 days (7d). This setting should be expressed as a duration, e.g. 5m (minutes), 6h (hours), 10d (days), 2w (weeks), 1M (month). The lifetime resets at each successful token rotation (token_rotation_interval_minutes).
-login_maximum_inactive_lifetime_days = 7
+login_maximum_inactive_lifetime_duration =
 
-# The maximum lifetime (days) an authenticated user can be logged in since login time before being required to login. Default is 30 days.
+# The maximum lifetime (duration) an authenticated user can be logged in since login time before being required to login. Default is 30 days (30d). This setting should be expressed as a duration, e.g. 5m (minutes), 6h (hours), 10d (days), 2w (weeks), 1M (month).
-login_maximum_lifetime_days = 30
+login_maximum_lifetime_duration =
 
 # How often should auth tokens be rotated for authenticated users when being active. The default is each 10 minutes.
 token_rotation_interval_minutes = 10
@@ -298,9 +322,15 @@ signout_redirect_url =
 # This setting is ignored if multiple OAuth providers are configured.
 oauth_auto_login = false
 
+# OAuth state max age cookie duration in seconds. Defaults to 600 seconds.
+oauth_state_cookie_max_age = 600
+
 # limit of api_key seconds to live before expiration
 api_key_max_seconds_to_live = -1
 
+# Set to true to enable SigV4 authentication option for HTTP-based datasources
+sigv4_auth_enabled = false
+
 #################################### Anonymous Auth ######################
 [auth.anonymous]
 # enable anonymous access
@@ -312,12 +342,15 @@ org_name = Main Org.
 # specify role for unauthenticated users
 org_role = Viewer
 
-#################################### Github Auth #########################
+# mask the Grafana version number for unauthenticated users
+hide_version = false
+
+#################################### GitHub Auth #########################
 [auth.github]
 enabled = false
 allow_sign_up = true
 client_id = some_id
-client_secret = some_secret
+client_secret =
 scopes = user:email,read:org
 auth_url = https://github.com/login/oauth/authorize
 token_url = https://github.com/login/oauth/access_token
@@ -331,7 +364,7 @@ allowed_organizations =
 enabled = false
 allow_sign_up = true
 client_id = some_id
-client_secret = some_secret
+client_secret =
 scopes = api
 auth_url = https://gitlab.com/oauth/authorize
 token_url = https://gitlab.com/oauth/token
@@ -344,7 +377,7 @@ allowed_groups =
 enabled = false
 allow_sign_up = true
 client_id = some_client_id
-client_secret = some_client_secret
+client_secret =
 scopes = https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/userinfo.email
 auth_url = https://accounts.google.com/o/oauth2/auth
 token_url = https://accounts.google.com/o/oauth2/token
@@ -358,7 +391,7 @@ hosted_domain =
 enabled = false
 allow_sign_up = true
 client_id = some_id
-client_secret = some_secret
+client_secret =
 scopes = user:email
 allowed_organizations =
 
@@ -366,7 +399,7 @@ allowed_organizations =
 enabled = false
 allow_sign_up = true
 client_id = some_id
-client_secret = some_secret
+client_secret =
 scopes = user:email
 allowed_organizations =
 
@@ -376,24 +409,41 @@ name = Azure AD
 enabled = false
 allow_sign_up = true
 client_id = some_client_id
-client_secret = some_client_secret
+client_secret =
 scopes = openid email profile
 auth_url = https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/authorize
 token_url = https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token
 allowed_domains =
 allowed_groups =
 
+#################################### Okta OAuth #######################
+[auth.okta]
+name = Okta
+enabled = false
+allow_sign_up = true
+client_id = some_id
+client_secret =
+scopes = openid profile email groups
+auth_url = https://<tenant-id>.okta.com/oauth2/v1/authorize
+token_url = https://<tenant-id>.okta.com/oauth2/v1/token
+api_url = https://<tenant-id>.okta.com/oauth2/v1/userinfo
+allowed_domains =
+allowed_groups =
+role_attribute_path =
+
 #################################### Generic OAuth #######################
 [auth.generic_oauth]
 name = OAuth
 enabled = false
 allow_sign_up = true
 client_id = some_id
-client_secret = some_secret
+client_secret =
 scopes = user:email
 email_attribute_name = email:primary
 email_attribute_path =
+login_attribute_path =
 role_attribute_path =
+id_token_attribute_name =
 auth_url =
 token_url =
 api_url =
@@ -405,47 +455,6 @@ tls_client_cert =
 tls_client_key =
 tls_client_ca =
 
-#################################### SAML Auth ###########################
-[auth.saml] # Enterprise only
-# Defaults to false. If true, the feature is enabled
-enabled = false
-
-# Base64-encoded public X.509 certificate. Used to sign requests to the IdP
-certificate =
-
-# Path to the public X.509 certificate. Used to sign requests to the IdP
-certificate_path =
-
-# Base64-encoded private key. Used to decrypt assertions from the IdP
-private_key =
-
-# Path to the private key. Used to decrypt assertions from the IdP
-private_key_path =
-
-# Base64-encoded IdP SAML metadata XML. Used to verify and obtain binding locations from the IdP
-idp_metadata =
-
-# Path to the SAML metadata XML. Used to verify and obtain binding locations from the IdP
-idp_metadata_path =
-
-# URL to fetch SAML IdP metadata. Used to verify and obtain binding locations from the IdP
-idp_metadata_url =
-
-# Duration, since the IdP issued a response and the SP is allowed to process it. Defaults to 90 seconds
-max_issue_delay = 90s
-
-# Duration, for how long the SP's metadata should be valid. Defaults to 48 hours
-metadata_valid_duration = 48h
-
-# Friendly name or name of the attribute within the SAML assertion to use as the user's name
-assertion_attribute_name = displayName
-
-# Friendly name or name of the attribute within the SAML assertion to use as the user's login handle
-assertion_attribute_login = mail
-
-# Friendly name or name of the attribute within the SAML assertion to use as the user's email
-assertion_attribute_email = mail
-
 #################################### Basic Auth ##########################
 [auth.basic]
 enabled = true
@@ -472,7 +481,7 @@ allow_sign_up = true
 # LDAP backround sync (Enterprise only)
 # At 1 am every day
 sync_cron = "0 0 1 * * *"
-active_sync_enabled = false
+active_sync_enabled = true
 
 #################################### SMTP / Emailing #####################
 [smtp]
@@ -487,6 +496,7 @@ skip_verify = false
 from_address = admin@grafana.localhost
 from_name = Grafana
 ehlo_identity =
+startTLS_policy =
 
 [emails]
 welcome_email_on_sign_up = false
@@ -613,6 +623,36 @@ max_attempts = 3
 # Makes it possible to enforce a minimal interval between evaluations, to reduce load on the backend
 min_interval_seconds = 1
 
+# Configures for how long alert annotations are stored. Default is 0, which keeps them forever.
+# This setting should be expressed as an duration. Ex 6h (hours), 10d (days), 2w (weeks), 1M (month).
+max_annotation_age =
+
+# Configures max number of alert annotations that Grafana stores. Default value is 0, which keeps all alert annotations.
+max_annotations_to_keep =
+
+#################################### Annotations #########################
+
+[annotations.dashboard]
+# Dashboard annotations means that annotations are associated with the dashboard they are created on.
+
+# Configures how long dashboard annotations are stored. Default is 0, which keeps them forever.
+# This setting should be expressed as a duration. Examples: 6h (hours), 10d (days), 2w (weeks), 1M (month).
+max_age =
+
+# Configures max number of dashboard annotations that Grafana stores. Default value is 0, which keeps all dashboard annotations.
+max_annotations_to_keep =
+
+[annotations.api]
+# API annotations means that the annotations have been created using the API without any
+# association with a dashboard.
+
+# Configures how long Grafana stores API annotations. Default is 0, which keeps them forever.
+# This setting should be expressed as a duration. Examples: 6h (hours), 10d (days), 2w (weeks), 1M (month).
+max_age =
+
+# Configures max number of API annotations that Grafana keeps. Default value is 0, which keeps all API annotations.
+max_annotations_to_keep =
+
 #################################### Explore #############################
 [explore]
 # Enable the Explore section
@@ -630,6 +670,12 @@ disable_total_stats = false
 basic_auth_username =
 basic_auth_password =
 
+# Metrics environment info adds dimensions to the `grafana_environment_info` metric, which 
+# can expose more information about the Grafana instance.
+[metrics.environment_info]
+#exampleLabel1 = exampleValue1
+#exampleLabel2 = exampleValue2
+
 # Send internal Grafana metrics to graphite
 [metrics.graphite]
 # Enable by setting the address setting (ex localhost:2003)
@@ -691,6 +737,8 @@ public_url =
 key_file =
 bucket =
 path =
+enable_signed_urls = false
+signed_url_expiration =
 
 [external_image_storage.azure_blob]
 account_name =
@@ -706,6 +754,9 @@ container_name =
 server_url =
 # If the remote HTTP image renderer service runs on a different server than the Grafana server you may have to configure this to a URL where Grafana is reachable, e.g. http://grafana.domain/.
 callback_url =
+# Concurrent render request limit affects when the /render HTTP endpoint is used. Rendering many images at the same time can overload the server,
+# which this setting can help protect against by only allowing a certain amount of concurrent requests.
+concurrent_render_request_limit = 30
 
 [panels]
 # here for to support old env variables, can remove after a few months
@@ -715,6 +766,68 @@ disable_sanitize_html = false
 [plugins]
 enable_alpha = false
 app_tls_skip_verify_insecure = false
+# Enter a comma-separated list of plugin identifiers to identify plugins that are allowed to be loaded even if they lack a valid signature.
+allow_loading_unsigned_plugins =
+
+#################################### Grafana Image Renderer Plugin ##########################
+[plugin.grafana-image-renderer]
+# Instruct headless browser instance to use a default timezone when not provided by Grafana, e.g. when rendering panel image of alert.
+# See ICU’s metaZones.txt (https://cs.chromium.org/chromium/src/third_party/icu/source/data/misc/metaZones.txt) for a list of supported
+# timezone IDs. Fallbacks to TZ environment variable if not set.
+rendering_timezone =
+
+# Instruct headless browser instance to use a default language when not provided by Grafana, e.g. when rendering panel image of alert.
+# Please refer to the HTTP header Accept-Language to understand how to format this value, e.g. 'fr-CH, fr;q=0.9, en;q=0.8, de;q=0.7, *;q=0.5'.
+rendering_language =
+
+# Instruct headless browser instance to use a default device scale factor when not provided by Grafana, e.g. when rendering panel image of alert.
+# Default is 1. Using a higher value will produce more detailed images (higher DPI), but will require more disk space to store an image.
+rendering_viewport_device_scale_factor =
+
+# Instruct headless browser instance whether to ignore HTTPS errors during navigation. Per default HTTPS errors are not ignored. Due to
+# the security risk it's not recommended to ignore HTTPS errors.
+rendering_ignore_https_errors =
+
+# Instruct headless browser instance whether to capture and log verbose information when rendering an image. Default is false and will
+# only capture and log error messages. When enabled, debug messages are captured and logged as well.
+# For the verbose information to be included in the Grafana server log you have to adjust the rendering log level to debug, configure
+# [log].filter = rendering:debug.
+rendering_verbose_logging =
+
+# Instruct headless browser instance whether to output its debug and error messages into running process of remote rendering service.
+# Default is false. This can be useful to enable (true) when troubleshooting.
+rendering_dumpio =
+
+# Additional arguments to pass to the headless browser instance. Default is --no-sandbox. The list of Chromium flags can be found
+# here (https://peter.sh/experiments/chromium-command-line-switches/). Multiple arguments is separated with comma-character.
+rendering_args =
+
+# You can configure the plugin to use a different browser binary instead of the pre-packaged version of Chromium.
+# Please note that this is not recommended, since you may encounter problems if the installed version of Chrome/Chromium is not
+# compatible with the plugin.
+rendering_chrome_bin =
+
+# Instruct how headless browser instances are created. Default is 'default' and will create a new browser instance on each request.
+# Mode 'clustered' will make sure that only a maximum of browsers/incognito pages can execute concurrently.
+# Mode 'reusable' will have one browser instance and will create a new incognito page on each request.
+rendering_mode =
+
+# When rendering_mode = clustered you can instruct how many browsers or incognito pages can execute concurrently. Default is 'browser'
+# and will cluster using browser instances.
+# Mode 'context' will cluster using incognito pages.
+rendering_clustering_mode =
+# When rendering_mode = clustered you can define maximum number of browser instances/incognito pages that can execute concurrently..
+rendering_clustering_max_concurrency =
+
+# Limit the maximum viewport width, height and device scale factor that can be requested.
+rendering_viewport_max_width =
+rendering_viewport_max_height =
+rendering_viewport_max_device_scale_factor =
+
+# Change the listening host and port of the gRPC server. Default host is 127.0.0.1 and default port is 0 and will automatically assign
+# a port not in use.
+grpc_host =
+grpc_port =
 
 [enterprise]
 license_path =
@@ -722,3 +835,23 @@ license_path =
 [feature_toggles]
 # enable features, separated by spaces
 enable =
+
+[date_formats]
+# For information on what formatting patterns that are supported https://momentjs.com/docs/#/displaying/
+
+# Default system date format used in time range picker and other places where full time is displayed
+full_date = YYYY-MM-DD HH:mm:ss
+
+# Used by graph and other places where we only show small intervals
+interval_second = HH:mm:ss
+interval_minute = HH:mm
+interval_hour = MM/DD HH:mm
+interval_day = MM/DD
+interval_month = YYYY-MM
+interval_year = YYYY
+
+# Experimental feature
+use_browser_locale = false
+
+# Default timezone for user preferences. Options are 'browser' for the browser local timezone or a timezone name from IANA Time Zone database, e.g. 'UTC' or 'Europe/Amsterdam' etc.
+default_timezone = browser

grafana.rpmlintrc

@@ -1,10 +1,16 @@
-addFilter("W: non-standard-gid.* grafana")
-addFilter("W: non-standard-uid.* grafana")
-addFilter("E: script-without-shebang .*\.json")
-addFilter("E: zero-length /usr/share/grafana/public/.*")
-addFilter("W: log-files-without-logrotate .*")
-addFilter("W: no-documentation")
 addFilter("E: non-readable /etc/grafana/grafana.ini 640")
 addFilter("E: non-readable /etc/grafana/ldap.toml 640")
 addFilter("E: non-standard-dir-perm /var/lib/grafana 750")
+addFilter("E: non-standard-dir-perm /etc/grafana/provisioning/datasources 750")
+addFilter("E: zero-length /usr/share/grafana/public/.*")
+addFilter("E: script-without-shebang .*\.json")
+
+addFilter("W: non-standard-uid.* grafana")
+addFilter("W: non-standard-gid.* grafana")
+addFilter("W: hidden-file-or-dir /usr/share/grafana/public/.*")
+addFilter("W: log-files-without-logrotate .*")
 addFilter("W: dangerous-command-in-%post chown")
+
+addFilter("W: strange-permission build_frontend.sh 755")
+addFilter("W: strange-permission list_bundled_nodejs_packages.py 755")
+addFilter("W: %ifarch-applied-patch Patch.: 00.-skip-goldenfiles-tests.patch")

list_bundled_nodejs_packages.py

@@ -8,7 +8,7 @@ from packaging import version
 def read_declared_pkgs(package_json_path):
     with open(package_json_path) as f:
         package_json = json.load(f)
-        return list(package_json['dependencies'].keys())
+        return list(package_json['dependencies'].keys()) + list(package_json['devDependencies'].keys())
 
 
 def read_installed_pkgs(yarn_lock_path):
@@ -28,7 +28,7 @@ def list_provides(declared_pkgs, installed_pkgs):
         versions = [version.parse(pkg_version)
                     for pkg_name, pkg_version in installed_pkgs if pkg_name == declared_pkg]
         oldest_version = sorted(versions)[0]
-        yield f"Provides: bundled(nodejs-{declared_pkg}) = {oldest_version}"
+        yield f"Provides: bundled(npm({declared_pkg})) = {oldest_version}"
 
 
 if __name__ == "__main__":

list_go_buildrequires.sh

@@ -1,20 +0,0 @@
-#!/bin/bash -eu
-
-[ $# -ne 1 ] && echo "Usage: $0 grafana-X.Y.Z/" && exit 1
-GRAFANA_SOURCES="$(readlink -f "$1")"
-
-cd "$(mktemp -d)"
-mkdir -p src/github.com/grafana
-ln -s "${GRAFANA_SOURCES}" src/github.com/grafana/grafana
-ln -s "${GRAFANA_SOURCES}/vendor/github.com/grafana/grafana-plugin-model" src/github.com/grafana/grafana-plugin-model
-ln -s "${GRAFANA_SOURCES}/vendor/github.com/grafana/grafana-plugin-sdk-go" src/github.com/grafana/grafana-plugin-sdk-go
-
-for pkg in grafana grafana-plugin-model grafana-plugin-sdk-go
-do
-    GOPATH=$(pwd) golist --imported --package-path "github.com/grafana/$pkg" --skip-self --template 'BuildRequires: golang({{.}})\n'
-done | sed \
-    -e "s,github.com/linkedin/goavro/v2,github.com/linkedin/goavro,g" \
-    -e "s,github.com/go-xorm/xorm,xorm.io/xorm,g" \
-    -e "s,github.com/robfig/cron/v3,gopkg.in/robfig/cron.v3,g" \
-    -e "s,github.com/unknwon/com,github.com/Unknwon/com,g" \
-    | sort | uniq

make_grafana_webpack.sh

@@ -1,61 +0,0 @@
-#! /bin/bash
-#
-# Copyright (c) 2019-2020 Red Hat.
-#
-# This program is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation; either version 2 of the License, or (at your
-# option) any later version.
-#
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
-# or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
-# for more details.
-#
-
-[ $# -ne 1 ] && echo "Usage: $0 version" && exit 1
-
-# grafana version (must be tagged on github.com/grafana/grafana as "v$VER")
-VER=$1
-
-command -v yarn || { echo Error, please install the yarn package manager. && exit 1; }
-
-# get src tree and set cwd
-echo Fetching pristine upstream git tagged branch for grafana version v$VER ...
-git clone https://github.com/grafana/grafana grafana-$VER
-cd grafana-$VER
-git checkout -b v$VER v$VER
-
-# applying webpack patches
-patch -p1 < ../010-CVE-2020-13430.patch
-
-# exclude the phantomjs-prebuilt binary module from the webpack
-sed -i '/phantomjs-prebuilt/d' package.json
-
-# nuke grunt task for copying phantomjs
-rm -f scripts/grunt/options/phantomjs.js
-sed -i '/phantomjs/d' scripts/grunt/*.js
-
-# populate node_modules using package.json
-echo Running yarn to populate local node_modules ....
-yarn --non-interactive --no-progress --ignore-engines install --pure-lockfile > yarn.out 2>&1
-
-# build the webpack
-echo;echo Building production webpack ....
-node_modules/webpack/bin/webpack.js --display errors-only --mode production --config scripts/webpack/webpack.prod.js
-
-cd ..
-
-# webpack tarball. Includes public/views because index.html references the webpack
-tar czf grafana_webpack-$VER.tar.gz grafana-$VER/public/build grafana-$VER/public/views
-
-# source tarball (if needed)
-if [ ! -f grafana-$VER.tar.gz ]; then
-  wget --quiet -O grafana-$VER.tar.gz https://github.com/grafana/grafana/archive/v$VER/grafana-$VER.tar.gz
-fi
-
-# done
-echo Both grafana-$VER.tar.gz and grafana_webpack-$VER.tar.gz
-echo should now be in your working directory.
-
-exit 0

run_container_build.sh

@@ -16,7 +16,7 @@ RUN mkdir /grafana /deps
 
 ${INSTALL_UNPUBLISHED_DEPENDENCIES}
 
-COPY grafana.spec *.patch grafana-*.tar.gz grafana_webpack-*.tar.gz make_grafana_webpack.sh distro-defaults.ini /grafana
+COPY grafana.spec *.patch grafana-*.tar.gz distro-defaults.ini Makefile create_webpack_manifest.py /grafana
 WORKDIR /grafana
 RUN dnf -y builddep grafana.spec
 RUN rpkg local

sources

@@ -1,2 +1,3 @@
-b9331a128ccb918cb3b9f8c5180eea93  grafana-6.7.4.tar.gz
+26a95a36bf4ed639cde9a0b43eb9c04d  grafana-7.3.1.tar.gz
-91f7f66148b5e4c24890c47b85f223e3  grafana_webpack-6.7.4.tar.gz
+48d8781d43484d749102b062a3d3d152  grafana-vendor-go-7.3.1.tar.gz
+7f045696b5cc687477bd5059220b53a3  grafana-webpack-7.3.1.tar.gz