Resolves: RHEL-166519

Resolves: RHEL-167380
Resolves: RHEL-167542

CLAUDE.md

@@ -0,0 +1,76 @@
+# Grafana CentOS Packaging Workflow
+
+This file documents the standard workflow for working with the grafana centpkg repository. Claude Code will follow these steps autonomously.
+
+## Workflow Steps
+
+1. Fork the repository:
+   ```
+   centpkg fork
+   ```
+
+2. Fetch all remotes:
+   ```
+   git fetch --all
+   ```
+
+3. Create a new branch named after the Jira ticket, branching off the appropriate version branch.
+   Ask the user which version (c8s, c9s, c10s) and which Jira ticket before running this step.
+   The branch name is the ticket number lowercased with an `r` prefix (e.g. RHEL-161792 → r161792).
+   ```
+   git checkout -b r<ticket-number> origin/<version>
+   ```
+
+4. Bump the release number in `grafana.spec` (the `Release:` field) by 1.
+
+5. Add a new changelog entry at the top of `%changelog` in `grafana.spec` following this format:
+   ```
+   * <Day> <Mon> <DD> <YYYY> <name> <<email>> <version>-<new-release>
+   - Resolves <TICKET>: <CVE>
+   - Resolves <TICKET>: <CVE>
+   ...
+   ```
+   Ask the user for:
+   - The primary Jira ticket (used for the branch name)
+   - Any additional Jira tickets being fixed in this build (there may be multiple)
+   - Their Atlassian account email (or check if it is stored in an environment variable)
+   - Their Atlassian API token variable name (or check if it is stored in an environment variable)
+
+   Fetch the CVE for each ticket from Jira simultaneously:
+   ```
+   curl -s -H "Authorization: Basic $(echo -n "<email>:$<atlassian_token_var>" | base64 -w 0)" \
+     "https://redhat.atlassian.net/rest/api/2/issue/<TICKET>?fields=summary"
+   ```
+   Extract the CVE identifier (e.g. `CVE-XXXX-XXXXX`) from the `summary` field of each response.
+   Add one `- Resolves` line per ticket.
+
+6. Ask the user if there is a new patch file to apply. If yes:
+   - Place the patch file in the repository directory.
+   - In `grafana.spec`, add a new `PatchNNN:` line in the sources/patches block, following the existing numbering sequence (e.g. if the last patch is `Patch12:`, add `Patch13: your-patch.patch`).
+   - In the `%prep` section, add a corresponding `%patchNNN -p1` line after the existing patch applications, matching the same number.
+   If no patch file is needed, skip this step and continue.
+
+7. Build the source RPM:
+   ```
+   centpkg srpm
+   ```
+
+8. Stage all modified and new files:
+   ```
+   git add grafana.spec CLAUDE.md <any new patch files>
+   ```
+
+9. Commit using `centpkg commit -m` with each ticket on its own line:
+   ```
+   centpkg commit -m "$(cat <<'EOF'
+   Resolves: RHEL-XXXXXX
+   Resolves: RHEL-XXXXXX
+   EOF
+   )"
+   ```
+
+10. Push the branch to the fork. The fork remote name can be found by running `git remote -v`
+   and identifying the remote that points to the user's personal fork (not `origin`).
+   ```
+   git push <fork-remote> <branch-name>
+   ```

grafana.spec

@@ -36,7 +36,7 @@ end}
 
 Name:             grafana
 Version:          9.2.10
-Release:          29%{?dist}
+Release:          30%{?dist}
 Summary:          Metrics dashboard and graph editor
 License:          AGPLv3
 URL:              https://grafana.org
@@ -1024,6 +1024,11 @@ fi
 %{_datadir}/selinux/*/grafana.pp
 
 %changelog
+* Wed Apr 22 2026 Sam Feifer <sfeifer@redhat.com> 9.2.10-30
+- Resolves RHEL-166519: CVE-2026-32282
+- Resolves RHEL-167380: CVE-2026-32280
+- Resolves RHEL-167542: CVE-2026-32283
+
 * Tue Mar 31 2026 Sam Feifer <sfeifer@redhat.com> 9.2.10-29
 - Resolves RHEL-156639: CVE-2026-25679