|
|
|
|
@ -1,3 +1,13 @@
|
|
|
|
|
# gobuild and gotest macros are not available on CentOS Stream
|
|
|
|
|
# remove once BZ 1965292 is resolved
|
|
|
|
|
# definitions lifted from Fedora 34 podman.spec
|
|
|
|
|
%if ! 0%{?gobuild:1}
|
|
|
|
|
%define gobuild(o:) GO111MODULE=off go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "${LDFLAGS:-} -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -extldflags '-Wl,-z,relro -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld '" -a -v -x %{?**};
|
|
|
|
|
%endif
|
|
|
|
|
%if ! 0%{?gotest:1}
|
|
|
|
|
%define gotest() GO111MODULE=off go test -buildmode pie -compiler gc -ldflags "${LDFLAGS:-} -extldflags '-Wl,-z,relro -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld '" %{?**};
|
|
|
|
|
%endif
|
|
|
|
|
|
|
|
|
|
# Specify if the frontend will be compiled as part of the build or
|
|
|
|
|
# is attached as a webpack tarball (in case of an unsuitable nodejs version on the build system)
|
|
|
|
|
%define compile_frontend 0
|
|
|
|
|
@ -25,9 +35,9 @@ end}
|
|
|
|
|
|
|
|
|
|
Name: grafana
|
|
|
|
|
Version: 9.2.10
|
|
|
|
|
Release: 19%{?dist}
|
|
|
|
|
Release: 15%{?dist}
|
|
|
|
|
Summary: Metrics dashboard and graph editor
|
|
|
|
|
License: AGPL-3.0-only
|
|
|
|
|
License: AGPLv3
|
|
|
|
|
URL: https://grafana.org
|
|
|
|
|
|
|
|
|
|
# Source0 contains the tagged upstream sources
|
|
|
|
|
@ -36,13 +46,13 @@ Source0: https://github.com/grafana/grafana/archive/v%{version}/%{name}
|
|
|
|
|
# Source1 contains the bundled Go and Node.js dependencies
|
|
|
|
|
# Note: In case there were no changes to this tarball, the NVR of this tarball
|
|
|
|
|
# lags behind the NVR of this package.
|
|
|
|
|
Source1: grafana-vendor-%{version}-19.tar.xz
|
|
|
|
|
Source1: grafana-vendor-%{version}-2.tar.xz
|
|
|
|
|
|
|
|
|
|
%if %{compile_frontend} == 0
|
|
|
|
|
# Source2 contains the precompiled frontend
|
|
|
|
|
# Note: In case there were no changes to this tarball, the NVR of this tarball
|
|
|
|
|
# lags behind the NVR of this package.
|
|
|
|
|
Source2: grafana-webpack-%{version}-19.tar.gz
|
|
|
|
|
Source2: grafana-webpack-%{version}-2.tar.gz
|
|
|
|
|
%endif
|
|
|
|
|
|
|
|
|
|
# Source3 contains the systemd-sysusers configuration
|
|
|
|
|
@ -74,12 +84,9 @@ Patch5: 0005-remove-unused-frontend-crypto.patch
|
|
|
|
|
Patch6: 0006-skip-marketplace-plugin-install-test.patch
|
|
|
|
|
Patch7: 0007-fix-alert-test.patch
|
|
|
|
|
Patch8: 0008-graphite-functions-xss.patch
|
|
|
|
|
Patch9: 0009-redact-weak-ciphers.patch
|
|
|
|
|
Patch10: 0010-skip-tests.patch
|
|
|
|
|
Patch11: 0011-remove-email-lookup.patch
|
|
|
|
|
Patch12: 0012-coredump-selinux-error.patch
|
|
|
|
|
Patch13: 0013-snapshot-delete-check-org.patch
|
|
|
|
|
Patch14: 0014-resolve-dompurify-CVE.patch
|
|
|
|
|
|
|
|
|
|
# Patches affecting the vendor tarball
|
|
|
|
|
Patch1001: 1001-vendor-patch-removed-backend-crypto.patch
|
|
|
|
|
@ -523,7 +530,7 @@ Provides: bundled(npm(date-fns)) = 2.25.0
|
|
|
|
|
Provides: bundled(npm(debounce-promise)) = 3.1.2
|
|
|
|
|
Provides: bundled(npm(deep-freeze)) = 0.0.1
|
|
|
|
|
Provides: bundled(npm(devtools-protocol)) = 0.0.927104
|
|
|
|
|
Provides: bundled(npm(dompurify)) = 2.5.7
|
|
|
|
|
Provides: bundled(npm(dompurify)) = 2.3.8
|
|
|
|
|
Provides: bundled(npm(emotion)) = 10.0.27
|
|
|
|
|
Provides: bundled(npm(enzyme)) = 3.11.0
|
|
|
|
|
Provides: bundled(npm(enzyme-to-json)) = 3.6.2
|
|
|
|
|
@ -734,7 +741,7 @@ BuildRequires: checkpolicy, selinux-policy-devel, selinux-policy-targeted
|
|
|
|
|
Requires: selinux-policy >= %{_selinux_policy_version}
|
|
|
|
|
%endif
|
|
|
|
|
Requires: %{name} = %{version}-%{release}
|
|
|
|
|
Requires: selinux-policy-targeted
|
|
|
|
|
Requires: selinux-policy-targeted
|
|
|
|
|
Requires(post): /usr/sbin/semodule, /usr/sbin/semanage, /sbin/restorecon, /sbin/fixfiles, grafana
|
|
|
|
|
Requires(postun): /usr/sbin/semodule, /usr/sbin/semanage, /sbin/restorecon, /sbin/fixfiles, /sbin/service, grafana
|
|
|
|
|
|
|
|
|
|
@ -763,12 +770,9 @@ cp -p %{SOURCE8} %{SOURCE9} %{SOURCE10} SELinux
|
|
|
|
|
%patch -P 6 -p1
|
|
|
|
|
%patch -P 7 -p1
|
|
|
|
|
%patch -P 8 -p1
|
|
|
|
|
%patch -P 9 -p1
|
|
|
|
|
%patch -P 10 -p1
|
|
|
|
|
%patch -P 11 -p1
|
|
|
|
|
%patch -P 12 -p1
|
|
|
|
|
%patch -P 13 -p1
|
|
|
|
|
%patch -P 14 -p1
|
|
|
|
|
|
|
|
|
|
%patch -P 1001 -p1
|
|
|
|
|
%if %{enable_fips_mode}
|
|
|
|
|
@ -877,7 +881,10 @@ done
|
|
|
|
|
cd -
|
|
|
|
|
|
|
|
|
|
%pre
|
|
|
|
|
%sysusers_create_compat %{SOURCE3}
|
|
|
|
|
# sysusers_create_compat macro is not present in rhel8
|
|
|
|
|
# SOURCE3 may not be available in %%prein stage so specify on command line via --replace
|
|
|
|
|
# instead of "systemd-sysusers %%{SOURCE3}"
|
|
|
|
|
echo 'u grafana - "Grafana user account" /usr/share/grafana' | systemd-sysusers --replace=/usr/lib/sysusers.d/grafana.conf -
|
|
|
|
|
|
|
|
|
|
%preun
|
|
|
|
|
%systemd_preun grafana-server.service
|
|
|
|
|
@ -1012,79 +1019,51 @@ fi
|
|
|
|
|
%{_datadir}/selinux/*/grafana.pp
|
|
|
|
|
|
|
|
|
|
%changelog
|
|
|
|
|
* Thu Oct 17 2024 Sam Feifer <sfeifer@redhat.com> 9.2.10-19
|
|
|
|
|
- Resolves RHEL-62309: CVE-2024-47875
|
|
|
|
|
|
|
|
|
|
* Thu Oct 10 2024 Sam Feifer <sfeifer@redhat.com> 9.2.10-18
|
|
|
|
|
- Resolves RHEL-61049: CVE-2024-9355
|
|
|
|
|
|
|
|
|
|
* Tue Sep 17 2024 Sam Feifer <sfeifer@redhat.com> 9.2.10-17
|
|
|
|
|
- Resolves RHEL-57925: CVE-2024-34156
|
|
|
|
|
|
|
|
|
|
* Tue Apr 16 2024 Sam Feifer <sfeifer@redhat.com> 9.2.10-16
|
|
|
|
|
- Check OrdID is correct before deleting snapshot
|
|
|
|
|
- fix CVE-2024-1313
|
|
|
|
|
- fix CVE-2024-1394
|
|
|
|
|
|
|
|
|
|
* Wed Jan 31 2024 Sam Feifer <sfeifer@redhat.com> 9.2.10-15
|
|
|
|
|
- Resolves RHEL-23468
|
|
|
|
|
- Resolves RHEL-23466
|
|
|
|
|
- Resolves RHEL-21027
|
|
|
|
|
- Allows for gid to be 0
|
|
|
|
|
- Allows for postgreSQL datasource in selinux policy
|
|
|
|
|
|
|
|
|
|
* Tue Dec 19 2023 Sam Feifer <sfeifer@redhat.com> 9.2.10-14
|
|
|
|
|
- Fixes postgresql AVC denial
|
|
|
|
|
- Related RHEL-7505
|
|
|
|
|
|
|
|
|
|
* Thu Dec 14 2023 Sam Feifer <sfeifer@redhat.com> 9.2.10-13
|
|
|
|
|
- Resolves RHEL-19296
|
|
|
|
|
* Mon Dec 18 2023 Sam Feifer <sfeifer@redhat.com> 9.2.10-14
|
|
|
|
|
- Resolves RHEL-19596
|
|
|
|
|
- Fixes coredump issue introduced by selinux
|
|
|
|
|
- Patches out call to panic when trying to walk "/" directory
|
|
|
|
|
- Fixes postgresql AVC denial
|
|
|
|
|
|
|
|
|
|
* Thu Nov 30 2023 Sam Feifer <sfeifer@redhat.com> 9.2.10-12
|
|
|
|
|
- Resolves RHEL-7505
|
|
|
|
|
- Fixes additional selinux denials found when testing on certain architectures
|
|
|
|
|
|
|
|
|
|
* Tue Nov 21 2023 Sam Feifer <sfeifer@redhat.com> 9.2.10-11
|
|
|
|
|
- Resolves RHEL-7505
|
|
|
|
|
- Fixes selinux denials found when testing on certain architectures
|
|
|
|
|
|
|
|
|
|
* Wed Nov 15 2023 Sam Feifer <sfeifer@redhat.com> 9.2.10-10
|
|
|
|
|
- Resolves RHEL-7505
|
|
|
|
|
* Fri Dec 1 2023 Sam Feifer <sfeifer@redhat.com> 9.2.10-12
|
|
|
|
|
- Resolves RHEL-7503
|
|
|
|
|
- Adds a selinux policy for grafana
|
|
|
|
|
- Resolves RHEL-12666
|
|
|
|
|
- Resolves RHEL-12650
|
|
|
|
|
- fix CVE-2023-39325 CVE-2023-44487 rapid stream resets can cause excessive work
|
|
|
|
|
|
|
|
|
|
* Fri Jul 21 2023 Stan Cox <scox@redhat.com> 9.2.10-6
|
|
|
|
|
- Add /usr/share/grafana to systemd-sysusers --replace
|
|
|
|
|
|
|
|
|
|
* Thu Jul 20 2023 Stan Cox <scox@redhat.com> 9.2.10-5
|
|
|
|
|
- resolve CVE-2023-3128 grafana: account takeover possible when using Azure AD OAuth
|
|
|
|
|
|
|
|
|
|
* Thu Jun 8 2023 Stan Cox <scox@redhat.com> 9.2.10-3
|
|
|
|
|
- bumps exporter-toolkit to v0.7.3, sanitize-url@npm to 6.0.2, skip problematic s390 tests, License AGPL-3.0-only.
|
|
|
|
|
* Thu Jun 8 2023 Stan Cox <scox@redhat.com> 9.2.10-4
|
|
|
|
|
- bumps exporter-toolkit to v0.7.3, sanitize-url@npm to 6.0.2, skip problematic s390 tests.
|
|
|
|
|
|
|
|
|
|
* Mon May 15 2023 Stan Cox <scox@redhat.com> 9.2.10-2
|
|
|
|
|
- Update to 9.2.10
|
|
|
|
|
* Thu May 25 2023 Stan Cox <scox@redhat.com> 9.2.10-3
|
|
|
|
|
- Use systemd-sysusers --replace
|
|
|
|
|
|
|
|
|
|
* Tue May 23 2023 Jan Kurik <jkurik@redhat.com> 9.2.10-2
|
|
|
|
|
- Use systemd-sysusers instead of sysusers_create_compat, which is not available in RHEL-8
|
|
|
|
|
|
|
|
|
|
* Thu May 04 2023 Stan Cox <scox@redhat.com> 9.2.10-1
|
|
|
|
|
- Update to 9.2.10
|
|
|
|
|
|
|
|
|
|
* Tue Nov 01 2022 Stan Cox <scox@redhat.com> 9.0.9-2
|
|
|
|
|
- resolve CVE-2022-39229 grafana: Using email as a username can prevent other users from signing in
|
|
|
|
|
- resolve CVE-2022-2880 CVE-2022-41715 grafana: various flaws
|
|
|
|
|
|
|
|
|
|
* Wed Sep 21 2022 Andreas Gerstmayr <agerstmayr@redhat.com> 9.0.9-1
|
|
|
|
|
- update to 9.0.9 tagged upstream community sources, see CHANGELOG
|
|
|
|
|
- resolve CVE-2022-35957 grafana: Escalation from admin to server admin when auth proxy is used (rhbz#2125530)
|
|
|
|
|
|
|
|
|
|
* Tue Sep 20 2022 Andreas Gerstmayr <agerstmayr@redhat.com> 9.0.8-2
|
|
|
|
|
- bump NVR
|
|
|
|
|
|
|
|
|
|
* Thu Sep 15 2022 Andreas Gerstmayr <agerstmayr@redhat.com> 9.0.8-1
|
|
|
|
|
- update to 9.0.8 tagged upstream community sources, see CHANGELOG
|
|
|
|
|
- do not list /usr/share/grafana/conf twice
|
|
|
|
|
- drop makefile in favor of create_bundles.sh script
|
|
|
|
|
- sync provides/obsoletes with CentOS versions
|
|
|
|
|
- drop husky patch
|
|
|
|
|
* Mon Oct 31 2022 Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.15-4
|
|
|
|
|
- resolve CVE-2022-39229 grafana: using email as a username can block other users from signing in
|
|
|
|
|
- resolve CVE-2022-27664 golang: net/http: handle server errors after sending GOAWAY
|
|
|
|
|
- resolve CVE-2022-41715 golang: regexp/syntax: limit memory used by parsing regexps
|
|
|
|
|
- resolve CVE-2022-2880 golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters
|
|
|
|
|
- run integration tests in check phase
|
|
|
|
|
- update FIPS patch with latest changes in Go packaging
|
|
|
|
|
|
|
|
|
|
* Thu Aug 11 2022 Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.15-3
|
|
|
|
|
* Wed Aug 10 2022 Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.15-3
|
|
|
|
|
- resolve CVE-2022-1962 golang: go/parser: stack exhaustion in all Parse* functions
|
|
|
|
|
- resolve CVE-2022-1705 golang: net/http: improper sanitization of Transfer-Encoding header
|
|
|
|
|
- resolve CVE-2022-32148 golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working
|
|
|
|
|
@ -1095,7 +1074,7 @@ fi
|
|
|
|
|
- resolve CVE-2022-28131 golang: encoding/xml: stack exhaustion in Decoder.Skip
|
|
|
|
|
- resolve CVE-2022-30633 golang: encoding/xml: stack exhaustion in Unmarshal
|
|
|
|
|
|
|
|
|
|
* Tue Jul 26 2022 Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.15-2
|
|
|
|
|
* Wed Jul 20 2022 Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.15-2
|
|
|
|
|
- resolve CVE-2022-31107 grafana: OAuth account takeover
|
|
|
|
|
|
|
|
|
|
* Fri Apr 22 2022 Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.15-1
|
|
|
|
|
@ -1109,10 +1088,6 @@ fi
|
|
|
|
|
- declare Node.js dependencies of subpackages
|
|
|
|
|
- make vendor and webpack tarballs reproducible
|
|
|
|
|
|
|
|
|
|
* Tue Jan 18 2022 Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.11-3
|
|
|
|
|
- use HMAC-SHA-256 instead of SHA-1 to generate password reset tokens
|
|
|
|
|
- update FIPS tests in check phase
|
|
|
|
|
|
|
|
|
|
* Thu Dec 16 2021 Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.11-2
|
|
|
|
|
- resolve CVE-2021-44716 golang: net/http: limit growth of header canonicalization cache
|
|
|
|
|
- resolve CVE-2021-43813 grafana: directory traversal vulnerability for *.md files
|
|
|
|
|
@ -1124,9 +1099,8 @@ fi
|
|
|
|
|
* Thu Sep 30 2021 Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.10-1
|
|
|
|
|
- update to 7.5.10 tagged upstream community sources, see CHANGELOG
|
|
|
|
|
|
|
|
|
|
* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 7.5.9-3
|
|
|
|
|
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
|
|
|
|
|
Related: rhbz#1991688
|
|
|
|
|
* Mon Aug 16 2021 Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.9-3
|
|
|
|
|
- rebuild to resolve CVE-2021-34558
|
|
|
|
|
|
|
|
|
|
* Thu Jul 08 2021 Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.9-2
|
|
|
|
|
- remove unused dependency property-information
|
|
|
|
|
@ -1135,10 +1109,6 @@ fi
|
|
|
|
|
* Fri Jun 25 2021 Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.9-1
|
|
|
|
|
- update to 7.5.9 tagged upstream community sources, see CHANGELOG
|
|
|
|
|
|
|
|
|
|
* Tue Jun 22 2021 Mohan Boddu <mboddu@redhat.com> - 7.5.8-2
|
|
|
|
|
- Rebuilt for RHEL 9 BETA for openssl 3.0
|
|
|
|
|
Related: rhbz#1971065
|
|
|
|
|
|
|
|
|
|
* Mon Jun 21 2021 Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.8-1
|
|
|
|
|
- update to 7.5.8 tagged upstream community sources, see CHANGELOG
|
|
|
|
|
- remove unused dependencies selfsigned, http-signature and gofpdf
|
|
|
|
|
@ -1150,12 +1120,6 @@ fi
|
|
|
|
|
* Tue May 25 2021 Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.7-1
|
|
|
|
|
- update to 7.5.7 tagged upstream community sources, see CHANGELOG
|
|
|
|
|
|
|
|
|
|
* Thu Apr 15 2021 Mohan Boddu <mboddu@redhat.com> - 7.3.6-4
|
|
|
|
|
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
|
|
|
|
|
|
|
|
|
|
* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 7.3.6-3
|
|
|
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
|
|
|
|
|
|
|
|
|
|
* Fri Jan 22 2021 Andreas Gerstmayr <agerstmayr@redhat.com> 7.3.6-2
|
|
|
|
|
- change working dir to $GRAFANA_HOME in grafana-cli wrapper (fixes Red Hat BZ #1916083)
|
|
|
|
|
- add pcp-redis-datasource to allow_loading_unsigned_plugins config option
|
|
|
|
|
@ -1166,24 +1130,17 @@ fi
|
|
|
|
|
|
|
|
|
|
* Wed Nov 25 2020 Andreas Gerstmayr <agerstmayr@redhat.com> 7.3.4-1
|
|
|
|
|
- update to 7.3.4 tagged upstream community sources, see CHANGELOG
|
|
|
|
|
|
|
|
|
|
* Tue Nov 10 2020 Andreas Gerstmayr <agerstmayr@redhat.com> 7.3.1-1
|
|
|
|
|
- update to 7.3.1 tagged upstream community sources, see CHANGELOG
|
|
|
|
|
- bundle golang dependencies
|
|
|
|
|
- optionally bundle node.js dependencies and build and test frontend as part of the specfile
|
|
|
|
|
- change default provisioning path to /etc/grafana/provisioning (changed in version 7.1.1-1)
|
|
|
|
|
- merge all datasources into main grafana package
|
|
|
|
|
- change default provisioning path to /etc/grafana/provisioning
|
|
|
|
|
- resolve https://bugzilla.redhat.com/show_bug.cgi?id=1843170
|
|
|
|
|
|
|
|
|
|
* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 7.1.1-2
|
|
|
|
|
- Second attempt - Rebuilt for
|
|
|
|
|
https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
|
|
|
|
|
|
|
|
|
|
* Thu Jul 30 2020 Andreas Gerstmayr <agerstmayr@redhat.com> 7.1.1-1
|
|
|
|
|
- update to 7.1.1 tagged upstream community sources, see CHANGELOG
|
|
|
|
|
- merge all datasources into main grafana package
|
|
|
|
|
- bundle golang dependencies
|
|
|
|
|
* Thu Aug 20 2020 Andreas Gerstmayr <agerstmayr@redhat.com> 6.7.4-3
|
|
|
|
|
- apply patch for CVE-2020-13430 also to sources, not only to compiled webpack
|
|
|
|
|
|
|
|
|
|
* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 6.7.4-2
|
|
|
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
|
|
|
|
|
* Wed Aug 19 2020 Andreas Gerstmayr <agerstmayr@redhat.com> 6.7.4-2
|
|
|
|
|
- security fix for CVE-2020-13430
|
|
|
|
|
|
|
|
|
|
* Fri Jun 05 2020 Andreas Gerstmayr <agerstmayr@redhat.com> 6.7.4-1
|
|
|
|
|
- update to 6.7.4 tagged upstream community sources, see CHANGELOG
|
|
|
|
|
|
