November 2019 - Arch-excludes - Fedora mailing-lists

Architecture specific change in rpms/grafana.git
by githook-noreply＠fedoraproject.org 27 Nov '19

27 Nov '19

The package rpms/grafana.git has added or updated architecture specific content in its spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s): https://src.fedoraproject.org/cgit/rpms/grafana.git/commit/?id=25db04d28639… https://src.fedoraproject.org/cgit/rpms/grafana.git/commit/?id=47a36c908182…. Change: +ExclusiveArch: %{grafana_arches} +ExclusiveArch: %{grafana_arches} Thanks. Full change: ============ commit 47a36c908182bb085b189cfad0937bd0d9928028 Author: Mark Goodwin <mgoodwin(a)redhat.com> Date: Wed Nov 27 10:35:10 2019 +1100 Update to latest upstream sources v6.3.6 diff --git a/.gitignore b/.gitignore index c89ab6b..f73aa3f 100644 --- a/.gitignore +++ b/.gitignore @@ -6,3 +6,5 @@ /grafana_webpack-6.2.2.tar.gz /grafana-6.3.5.tar.gz /grafana_webpack-6.3.5.tar.gz +/grafana-6.3.6.tar.gz +/grafana_webpack-6.3.6.tar.gz diff --git a/003-new-files.patch b/003-new-files.patch index cf0c325..2cac75d 100644 --- a/003-new-files.patch +++ b/003-new-files.patch @@ -1,9 +1,9 @@ diff --git a/conf/distro-defaults.ini b/conf/distro-defaults.ini new file mode 100644 -index 000000000..e7a0c5062 +index 0000000000..e337ba0b57 --- /dev/null +++ b/conf/distro-defaults.ini -@@ -0,0 +1,683 @@ +@@ -0,0 +1,685 @@ +##################### Grafana Configuration Defaults for distros ##################### +# +# Do not modify this file in grafana installs @@ -598,8 +598,10 @@ index 000000000..e7a0c5062 +#################################### Internal Grafana Metrics ############ +# Metrics available at HTTP API Url /metrics +[metrics] -+enabled = true -+interval_seconds = 10 ++enabled = true ++interval_seconds = 10 ++# Disable total stats (stat_totals_*) metrics to be generated ++disable_total_stats = false + +#If both are set, basic auth will be required for the metrics endpoint. +basic_auth_username = @@ -689,7 +691,7 @@ index 000000000..e7a0c5062 +license_path = diff --git a/docs/man/man1/grafana-cli.1 b/docs/man/man1/grafana-cli.1 new file mode 100644 -index 000000000..171748fcd +index 0000000000..171748fcda --- /dev/null +++ b/docs/man/man1/grafana-cli.1 @@ -0,0 +1,51 @@ @@ -746,7 +748,7 @@ index 000000000..171748fcd +.BR http://docs.grafana.org/ . diff --git a/docs/man/man1/grafana-server.1 b/docs/man/man1/grafana-server.1 new file mode 100644 -index 000000000..30b7c1306 +index 0000000000..30b7c1306f --- /dev/null +++ b/docs/man/man1/grafana-server.1 @@ -0,0 +1,156 @@ @@ -908,7 +910,7 @@ index 000000000..30b7c1306 +.BR http://docs.grafana.org/ . diff --git a/packaging/rpm/spec/README b/packaging/rpm/spec/README new file mode 100644 -index 000000000..f97c2a26b +index 0000000000..f97c2a26be --- /dev/null +++ b/packaging/rpm/spec/README @@ -0,0 +1,7 @@ @@ -921,10 +923,10 @@ index 000000000..f97c2a26b + diff --git a/packaging/rpm/spec/grafana.spec b/packaging/rpm/spec/grafana.spec new file mode 100644 -index 000000000..81d21aaf4 +index 0000000000..fb9200cb62 --- /dev/null +++ b/packaging/rpm/spec/grafana.spec -@@ -0,0 +1,737 @@ +@@ -0,0 +1,766 @@ +%global grafana_arches %{lua: go_arches = {} + for arch in rpm.expand("%{go_arches}"):gmatch("%S+") do + go_arches[arch] = 1 @@ -935,15 +937,20 @@ index 000000000..81d21aaf4 + end +end} + -+# Unbundle grafana vendor sources and instead use BuildRequires ++# Unbundle Grafana vendor sources and instead use BuildRequires +# only on platforms that have enough golang devel support. +%if 0%{?rhel} == 0 +%global unbundle_vendor_sources 1 +%endif + ++%if 0%{?fedora} >= 30 ++# Use vendor sources until both Fedora and Grafana properly support golang modules ++%global unbundle_vendor_sources 0 ++%endif ++ + +Name: grafana -+Version: 6.3.4 ++Version: 6.3.6 +Release: 1%{?dist} +Summary: Metrics dashboard and graph editor +License: ASL 2.0 @@ -962,12 +969,14 @@ index 000000000..81d21aaf4 +Patch1: 001-login-oauth-use-oauth2-exchange.patch +Patch2: 002-remove-jaeger-tracing.patch +Patch3: 003-new-files.patch -+Patch4: 004-fix-uaparser-32bit.patch ++Patch4: 004-xerrors.patch ++Patch5: 005-mute-shellcheck-grafana-cli.patch + +# Intersection of go_arches and nodejs_arches +ExclusiveArch: %{grafana_arches} + +# omit golang debugsource, see BZ995136 and related ++%global dwz_low_mem_die_limit 0 +%global _debugsource_template %{nil} + +%global GRAFANA_USER %{name} @@ -992,6 +1001,7 @@ index 000000000..81d21aaf4 +Recommends: grafana-postgres = %{version}-%{release} +Recommends: grafana-prometheus = %{version}-%{release} +Recommends: grafana-stackdriver = %{version}-%{release} ++Recommends: grafana-pcp + +%if 0%{?unbundle_vendor_sources} +# golang build deps. These allow us to unbundle vendor golang source. @@ -1121,7 +1131,11 @@ index 000000000..81d21aaf4 +BuildRequires: golang(gopkg.in/square/go-jose.v2) +BuildRequires: golang(gopkg.in/square/go-jose.v2/cipher) +BuildRequires: golang(gopkg.in/square/go-jose.v2/json) ++%if 0%{fedora} >= 31 ++BuildRequires: golang(gopkg.in/yaml.v2) ++%else +BuildRequires: golang(github.com/go-yaml/yaml) ++%endif +BuildRequires: golang(golang.org/x/sync/errgroup) +BuildRequires: golang(gopkg.in/ldap.v3) +BuildRequires: golang(gopkg.in/mail.v2) @@ -1323,6 +1337,7 @@ index 000000000..81d21aaf4 +%patch2 -p1 +%patch3 -p1 +%patch4 -p1 ++%patch5 -p1 + +# Set up build subdirs and links +mkdir -p %{_builddir}/src/github.com/grafana @@ -1335,9 +1350,8 @@ index 000000000..81d21aaf4 +%if 0%{?unbundle_vendor_sources} +# Unbundle all grafana vendor sources, as per BuildRequires above. +# An exception is grafana-plugin-model, which is part of grafana. -+# Another exception is xerrors, which is a transition package -+# for the new Go 1.13 error values, see https://github.com/golang/xerrors -+cp --parents -a vendor/github.com/grafana vendor/golang.org/x/xerrors \ ++cp --parents -a vendor/github.com/grafana \ ++ vendor/golang.org/x/xerrors \ + vendor/github.com/robfig vendor/github.com/crewjam/saml \ + vendor/github.com/ua-parser/uap-go/uaparser \ + vendor/github.com/beevik/etree \ @@ -1349,15 +1363,19 @@ index 000000000..81d21aaf4 + + +%build -+# Build the server-side binaries: grafana-server and grafana-cli -+%if 0%{?gobuild} -+# use modern go macros such as in recent Fedora -+export GOPATH=%{_builddir}:%{gopath} -+%gobuild -o grafana-cli ./pkg/cmd/grafana-cli -+%gobuild -o grafana-server ./pkg/cmd/grafana-server -+%else ++# Build the server-side binaries +cd %{_builddir}/src/github.com/grafana/grafana ++%global archbindir bin/`go env GOOS`-`go env GOARCH` ++echo _builddir=%{_builddir} archbindir=%{archbindir} ++[ ! -d %{archbindir} ] && mkdir -p %{archbindir} +export GOPATH=%{_builddir}:%{gopath} ++# export GO111MODULE=off ++%if 0%{?fedora} >= 31 ++# native fedora golang build but without modules (no grafana support yet) ++go build -mod=vendor -o %{archbindir}/grafana-cli ./pkg/cmd/grafana-cli ++go build -mod=vendor -o %{archbindir}/grafana-server ./pkg/cmd/grafana-server ++%else ++# use the grafana build.go script. +go run build.go build +%endif + @@ -1381,8 +1399,8 @@ index 000000000..81d21aaf4 +install -p -m 755 packaging/wrappers/grafana-cli %{buildroot}%{_sbindir}/%{name}-cli + +# binaries -+install -p -m 755 bin/%{_arch}/%{name}-server %{buildroot}%{_sbindir} -+install -p -m 755 bin/%{_arch}/%{name}-cli %{buildroot}%{_datadir}/%{name}/bin ++install -p -m 755 %{archbindir}/%{name}-server %{buildroot}%{_sbindir} ++install -p -m 755 %{archbindir}/%{name}-cli %{buildroot}%{_datadir}/%{name}/bin + +# man pages +install -d %{buildroot}%{_mandir}/man1 @@ -1444,6 +1462,7 @@ index 000000000..81d21aaf4 +rm -f pkg/services/provisioning/dashboards/file_reader_test.go +rm -f pkg/services/sqlstore/alert_test.go +rm -f pkg/services/sqlstore/apikey_test.go ++export GO111MODULE=off +go test ./pkg/... + + @@ -1543,7 +1562,19 @@ index 000000000..81d21aaf4 + + +%changelog ++* Wed Nov 20 2019 Mark Goodwin <mgoodwin(a)redhat.com> 6.3.6-1 ++- add weak depenency on grafana-pcp ++- add patch to mute shellcheck SC1090 for grafana-cli ++- update to 6.3.6 upstream community sources, see CHANGELOG ++ ++* Thu Sep 05 2019 Mark Goodwin <mgoodwin(a)redhat.com> 6.3.5-1 ++- drop uaparser patch now it's upstream ++- add xerrors patch, see https://github.com/golang/go/issues/32246 ++- use vendor sources on rawhide until modules are fully supported ++- update to latest upstream community sources, see CHANGELOG ++ +* Fri Aug 30 2019 Mark Goodwin <mgoodwin(a)redhat.com> 6.3.4-1 ++- include fix for CVE-2019-15043 +- add patch for uaparser on 32bit systems +- update to latest upstream community sources, see CHANGELOG + @@ -1664,7 +1695,7 @@ index 000000000..81d21aaf4 +- native RPM spec build with current tagged v5.2.5 sources diff --git a/packaging/rpm/spec/make_grafana_webpack.sh b/packaging/rpm/spec/make_grafana_webpack.sh new file mode 100755 -index 000000000..47a8025ff +index 0000000000..47a8025ff4 --- /dev/null +++ b/packaging/rpm/spec/make_grafana_webpack.sh @@ -0,0 +1,61 @@ diff --git a/005-mute-shellcheck-grafana-cli.patch b/005-mute-shellcheck-grafana-cli.patch new file mode 100644 index 0000000..5a92c64 --- /dev/null +++ b/005-mute-shellcheck-grafana-cli.patch @@ -0,0 +1,12 @@ +diff --git a/packaging/wrappers/grafana-cli b/packaging/wrappers/grafana-cli +index 9cad151c0d..4c963d90ac 100755 +--- a/packaging/wrappers/grafana-cli ++++ b/packaging/wrappers/grafana-cli +@@ -24,6 +24,7 @@ if [ ! -x $EXECUTABLE ]; then + fi + + # overwrite settings from default file ++#shellcheck disable=SC1090 + if [ -f "$DEFAULT" ]; then + . "$DEFAULT" + fi diff --git a/grafana.spec b/grafana.spec index 0b2849d..fb9200c 100644 --- a/grafana.spec +++ b/grafana.spec @@ -14,14 +14,14 @@ end} %global unbundle_vendor_sources 1 %endif -%if 0%{?fedora} >= 31 +%if 0%{?fedora} >= 30 # Use vendor sources until both Fedora and Grafana properly support golang modules %global unbundle_vendor_sources 0 %endif Name: grafana -Version: 6.3.5 +Version: 6.3.6 Release: 1%{?dist} Summary: Metrics dashboard and graph editor License: ASL 2.0 @@ -41,6 +41,7 @@ Patch1: 001-login-oauth-use-oauth2-exchange.patch Patch2: 002-remove-jaeger-tracing.patch Patch3: 003-new-files.patch Patch4: 004-xerrors.patch +Patch5: 005-mute-shellcheck-grafana-cli.patch # Intersection of go_arches and nodejs_arches ExclusiveArch: %{grafana_arches} @@ -71,6 +72,7 @@ Recommends: grafana-opentsdb = %{version}-%{release} Recommends: grafana-postgres = %{version}-%{release} Recommends: grafana-prometheus = %{version}-%{release} Recommends: grafana-stackdriver = %{version}-%{release} +Recommends: grafana-pcp %if 0%{?unbundle_vendor_sources} # golang build deps. These allow us to unbundle vendor golang source. @@ -406,6 +408,7 @@ The Grafana stackdriver datasource. %patch2 -p1 %patch3 -p1 %patch4 -p1 +%patch5 -p1 # Set up build subdirs and links mkdir -p %{_builddir}/src/github.com/grafana @@ -630,6 +633,11 @@ go test ./pkg/... %changelog +* Wed Nov 20 2019 Mark Goodwin <mgoodwin(a)redhat.com> 6.3.6-1 +- add weak depenency on grafana-pcp +- add patch to mute shellcheck SC1090 for grafana-cli +- update to 6.3.6 upstream community sources, see CHANGELOG + * Thu Sep 05 2019 Mark Goodwin <mgoodwin(a)redhat.com> 6.3.5-1 - drop uaparser patch now it's upstream - add xerrors patch, see https://github.com/golang/go/issues/32246 diff --git a/sources b/sources index 6e15cea..c79831f 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (grafana-6.3.5.tar.gz) = c0151583bbed121290b091d40aae655ca22901d80ab02eafb5fea96f80bdcb88d070c4d778284d7c4605a420fe8918c82a67a51325cc71d605e4212a6a1c9162 -SHA512 (grafana_webpack-6.3.5.tar.gz) = 3967ee64501886994d26c6d6c1f949db9732d1dafbe7dd105ff5de4dc26c4d87831fcc6195f086262e86aa9c10e4be7f012bee8d6c95eb52f835837d3ac6d126 +SHA512 (grafana-6.3.6.tar.gz) = 141ba6db2dfa376471dc43cb9be432bad73de39a5e5f587d394484c6f49a5d3a67dacc0fec45ab658c6a5729ee073f2572baddee14fc6b0e2ed0d5582414be6c +SHA512 (grafana_webpack-6.3.6.tar.gz) = 076c921fdd7cb59869b521ef0eb88d74b80005da49df6b7cde450b34ce1236e3595b26ab6e45ade50e8b219914ef476413e40790a0842daf7e726e671a9327bd commit 25db04d286390b3176cef5aee54b1484c2b3fd46 Author: Mark Goodwin <mgoodwin(a)redhat.com> Date: Thu Sep 5 17:15:31 2019 +1000 update to latest upstream sources v6.3.5 Resolves: bz1735308 diff --git a/.gitignore b/.gitignore index a533fb5..c89ab6b 100644 --- a/.gitignore +++ b/.gitignore @@ -4,3 +4,5 @@ /grafana_webpack-6.1.6.tar.gz /grafana-6.2.2.tar.gz /grafana_webpack-6.2.2.tar.gz +/grafana-6.3.5.tar.gz +/grafana_webpack-6.3.5.tar.gz diff --git a/001-login-oauth-use-oauth2-exchange.patch b/001-login-oauth-use-oauth2-exchange.patch index d62067d..ff59d44 100644 --- a/001-login-oauth-use-oauth2-exchange.patch +++ b/001-login-oauth-use-oauth2-exchange.patch @@ -1,5 +1,5 @@ diff --git a/pkg/api/login_oauth.go b/pkg/api/login_oauth.go -index a3599bc7a..0c6579847 100644 +index a46c97238..76fc8480c 100644 --- a/pkg/api/login_oauth.go +++ b/pkg/api/login_oauth.go @@ -125,7 +125,7 @@ func (hs *HTTPServer) OAuthLogin(ctx *m.ReqContext) { diff --git a/002-remove-jaeger-tracing.patch b/002-remove-jaeger-tracing.patch index 1f624cc..0d20b5e 100644 --- a/002-remove-jaeger-tracing.patch +++ b/002-remove-jaeger-tracing.patch @@ -1,34 +1,36 @@ diff --git a/pkg/cmd/grafana-server/server.go b/pkg/cmd/grafana-server/server.go -index 2ac326ed3..20943918c 100644 +index 85d6db43e..6de99b58b 100644 --- a/pkg/cmd/grafana-server/server.go +++ b/pkg/cmd/grafana-server/server.go -@@ -21,7 +21,6 @@ import ( +@@ -23,7 +23,6 @@ import ( _ "github.com/grafana/grafana/pkg/infra/metrics" _ "github.com/grafana/grafana/pkg/infra/remotecache" _ "github.com/grafana/grafana/pkg/infra/serverlock" - _ "github.com/grafana/grafana/pkg/infra/tracing" _ "github.com/grafana/grafana/pkg/infra/usagestats" - "github.com/grafana/grafana/pkg/log" "github.com/grafana/grafana/pkg/login" + "github.com/grafana/grafana/pkg/login/social" diff --git a/pkg/infra/tracing/tracing.go b/pkg/infra/tracing/tracing.go deleted file mode 100644 -index fd7258b7a..000000000 +index d1511a533..000000000 --- a/pkg/infra/tracing/tracing.go +++ /dev/null -@@ -1,129 +0,0 @@ +@@ -1,148 +0,0 @@ -package tracing - -import ( - "context" +- "fmt" - "io" - "strings" - -- "github.com/grafana/grafana/pkg/log" +- "github.com/grafana/grafana/pkg/infra/log" - "github.com/grafana/grafana/pkg/registry" - "github.com/grafana/grafana/pkg/setting" - - opentracing "github.com/opentracing/opentracing-go" - jaegercfg "github.com/uber/jaeger-client-go/config" +- "github.com/uber/jaeger-client-go/zipkin" -) - -func init() { @@ -36,13 +38,15 @@ index fd7258b7a..000000000 -} - -type TracingService struct { -- enabled bool -- address string -- customTags map[string]string -- samplerType string -- samplerParam float64 -- log log.Logger -- closer io.Closer +- enabled bool +- address string +- customTags map[string]string +- samplerType string +- samplerParam float64 +- log log.Logger +- closer io.Closer +- zipkinPropagation bool +- disableSharedZipkinSpans bool - - Cfg *setting.Cfg `inject:""` -} @@ -72,6 +76,8 @@ index fd7258b7a..000000000 - ts.customTags = splitTagSettings(section.Key("always_included_tag").MustString("")) - ts.samplerType = section.Key("sampler_type").MustString("") - ts.samplerParam = section.Key("sampler_param").MustFloat64(1) +- ts.zipkinPropagation = section.Key("zipkin_propagation").MustBool(false) +- ts.disableSharedZipkinSpans = section.Key("disable_shared_zipkin_spans").MustBool(false) -} - -func (ts *TracingService) initGlobalTracer() error { @@ -97,6 +103,18 @@ index fd7258b7a..000000000 - options = append(options, jaegercfg.Tag(tag, value)) - } - +- if ts.zipkinPropagation { +- zipkinPropagator := zipkin.NewZipkinB3HTTPHeaderPropagator() +- options = append(options, +- jaegercfg.Injector(opentracing.HTTPHeaders, zipkinPropagator), +- jaegercfg.Extractor(opentracing.HTTPHeaders, zipkinPropagator), +- ) +- +- if !ts.disableSharedZipkinSpans { +- options = append(options, jaegercfg.ZipkinSharedRPCSpan(true)) +- } +- } +- - tracer, closer, err := cfg.NewTracer(options...) - if err != nil { - return err @@ -142,8 +160,9 @@ index fd7258b7a..000000000 - jlw.logger.Error(msg) -} - --func (jlw *jaegerLogWrapper) Infof(msg string, args ...interface{}) { -- jlw.logger.Info(msg, args) +-func (jlw *jaegerLogWrapper) Infof(format string, args ...interface{}) { +- msg := fmt.Sprintf(format, args...) +- jlw.logger.Info(msg) -} diff --git a/pkg/infra/tracing/tracing_test.go b/pkg/infra/tracing/tracing_test.go deleted file mode 100644 diff --git a/003-new-files.patch b/003-new-files.patch index 0701856..cf0c325 100644 --- a/003-new-files.patch +++ b/003-new-files.patch @@ -1,9 +1,9 @@ diff --git a/conf/distro-defaults.ini b/conf/distro-defaults.ini new file mode 100644 -index 000000000..eeb974369 +index 000000000..e7a0c5062 --- /dev/null +++ b/conf/distro-defaults.ini -@@ -0,0 +1,601 @@ +@@ -0,0 +1,683 @@ +##################### Grafana Configuration Defaults for distros ##################### +# +# Do not modify this file in grafana installs @@ -53,6 +53,9 @@ index 000000000..eeb974369 +# The full public facing url +root_url = %(protocol)s://%(domain)s:%(http_port)s/ + ++# Serve Grafana from subpath specified in `root_url` setting. By default it is set to `false` for compatibility reasons. ++serve_from_sub_path = false ++ +# Log web requests +router_logging = false + @@ -119,7 +122,7 @@ index 000000000..eeb974369 + +# cache connectionstring options +# database: will use Grafana primary database. -+# redis: config like redis server e.g. `addr=127.0.0.1:6379,pool_size=100,db=grafana` ++# redis: config like redis server e.g. `addr=127.0.0.1:6379,pool_size=100,db=0`. Only addr is required. +# memcache: 127.0.0.1:11211 +connstr = + @@ -185,6 +188,31 @@ index 000000000..eeb974369 +# set to true if you want to allow browsers to render Grafana in a <frame>, <iframe>, <embed> or <object>. default is false. +allow_embedding = false + ++# Set to true if you want to enable http strict transport security (HSTS) response header. ++# This is only sent when HTTPS is enabled in this configuration. ++# HSTS tells browsers that the site should only be accessed using HTTPS. ++# The default will change to true in the next minor release, 6.3. ++strict_transport_security = false ++ ++# Sets how long a browser should cache HSTS. Only applied if strict_transport_security is enabled. ++strict_transport_security_max_age_seconds = 86400 ++ ++# Set to true if to enable HSTS preloading option. Only applied if strict_transport_security is enabled. ++strict_transport_security_preload = false ++ ++# Set to true if to enable the HSTS includeSubDomains option. Only applied if strict_transport_security is enabled. ++strict_transport_security_subdomains = false ++ ++# Set to true to enable the X-Content-Type-Options response header. ++# The X-Content-Type-Options response HTTP header is a marker used by the server to indicate that the MIME types advertised ++# in the Content-Type headers should not be changed and be followed. The default will change to true in the next minor release, 6.3. ++x_content_type_options = false ++ ++# Set to true to enable the X-XSS-Protection header, which tells browsers to stop pages from loading ++# when they detect reflected cross-site scripting (XSS) attacks. The default will change to true in the next minor release, 6.3. ++x_xss_protection = false ++ ++ +#################################### Snapshots ########################### +[snapshots] +# snapshot sharing options @@ -192,6 +220,10 @@ index 000000000..eeb974369 +external_snapshot_url = https://snapshots-origin.raintank.io +external_snapshot_name = Publish to snapshot.raintank.io + ++# Set to true to enable this Grafana instance act as an external snapshot server and allow unauthenticated requests for ++# creating and deleting snapshots. ++public_mode = false ++ +# remove expired snapshot +snapshot_remove_expired = true + @@ -265,6 +297,9 @@ index 000000000..eeb974369 +# This setting is ignored if multiple OAuth providers are configured. +oauth_auto_login = false + ++# limit of api_key seconds to live before expiration ++api_key_max_seconds_to_live = -1 ++ +#################################### Anonymous Auth ###################### +[auth.anonymous] +# enable anonymous access @@ -352,6 +387,47 @@ index 000000000..eeb974369 +tls_client_ca = +send_client_credentials_via_post = false + ++#################################### SAML Auth ########################### ++[auth.saml] # Enterprise only ++# Defaults to false. If true, the feature is enabled ++enabled = false ++ ++# Base64-encoded public X.509 certificate. Used to sign requests to the IdP ++certificate = ++ ++# Path to the public X.509 certificate. Used to sign requests to the IdP ++certificate_path = ++ ++# Base64-encoded private key. Used to decrypt assertions from the IdP ++private_key = ++ ++# Path to the private key. Used to decrypt assertions from the IdP ++private_key_path = ++ ++# Base64-encoded IdP SAML metadata XML. Used to verify and obtain binding locations from the IdP ++idp_metadata = ++ ++# Path to the SAML metadata XML. Used to verify and obtain binding locations from the IdP ++idp_metadata_path = ++ ++# URL to fetch SAML IdP metadata. Used to verify and obtain binding locations from the IdP ++idp_metadata_url = ++ ++# Duration, since the IdP issued a response and the SP is allowed to process it. Defaults to 90 seconds ++max_issue_delay = 90s ++ ++# Duration, for how long the SP's metadata should be valid. Defaults to 48 hours ++metadata_valid_duration = 48h ++ ++# Friendly name or name of the attribute within the SAML assertion to use as the user's name ++assertion_attribute_name = displayName ++ ++# Friendly name or name of the attribute within the SAML assertion to use as the user's login handle ++assertion_attribute_login = mail ++ ++# Friendly name or name of the attribute within the SAML assertion to use as the user's email ++assertion_attribute_email = mail ++ +#################################### Basic Auth ########################## +[auth.basic] +enabled = true @@ -373,7 +449,8 @@ index 000000000..eeb974369 +allow_sign_up = true + +# LDAP backround sync (Enterprise only) -+sync_cron = @hourly ++# At 1 am every day ++sync_cron = "0 0 1 * * *" +active_sync_enabled = false + +#################################### SMTP / Emailing ##################### @@ -556,6 +633,11 @@ index 000000000..eeb974369 +# and indicates the initial sampling rate before the actual one +# is received from the mothership +sampler_param = 1 ++# Whether or not to use Zipkin span propagation (x-b3- HTTP headers). ++zipkin_propagation = false ++# Setting this to true disables shared RPC spans. ++# Not disabling is the most common setting when using Zipkin elsewhere in your infrastructure. ++disable_shared_zipkin_spans = false + +#################################### External Image Storage ############## +[external_image_storage] @@ -839,10 +921,10 @@ index 000000000..f97c2a26b + diff --git a/packaging/rpm/spec/grafana.spec b/packaging/rpm/spec/grafana.spec new file mode 100644 -index 000000000..85f0dd6aa +index 000000000..81d21aaf4 --- /dev/null +++ b/packaging/rpm/spec/grafana.spec -@@ -0,0 +1,715 @@ +@@ -0,0 +1,737 @@ +%global grafana_arches %{lua: go_arches = {} + for arch in rpm.expand("%{go_arches}"):gmatch("%S+") do + go_arches[arch] = 1 @@ -861,7 +943,7 @@ index 000000000..85f0dd6aa + + +Name: grafana -+Version: 6.2.2 ++Version: 6.3.4 +Release: 1%{?dist} +Summary: Metrics dashboard and graph editor +License: ASL 2.0 @@ -880,6 +962,7 @@ index 000000000..85f0dd6aa +Patch1: 001-login-oauth-use-oauth2-exchange.patch +Patch2: 002-remove-jaeger-tracing.patch +Patch3: 003-new-files.patch ++Patch4: 004-fix-uaparser-32bit.patch + +# Intersection of go_arches and nodejs_arches +ExclusiveArch: %{grafana_arches} @@ -895,7 +978,7 @@ index 000000000..85f0dd6aa +%{?systemd_requires} +Requires(pre): shadow-utils + -+BuildRequires: systemd, golang, go-srpm-macros ++BuildRequires: git, systemd, golang, go-srpm-macros + +Recommends: grafana-cloudwatch = %{version}-%{release} +Recommends: grafana-elasticsearch = %{version}-%{release} @@ -1042,6 +1125,7 @@ index 000000000..85f0dd6aa +BuildRequires: golang(golang.org/x/sync/errgroup) +BuildRequires: golang(gopkg.in/ldap.v3) +BuildRequires: golang(gopkg.in/mail.v2) ++BuildRequires: golang(github.com/jonboulle/clockwork) +%endif + +# Declare all nodejs modules bundled in the webpack - this is for security @@ -1238,6 +1322,7 @@ index 000000000..85f0dd6aa +%patch1 -p1 +%patch2 -p1 +%patch3 -p1 ++%patch4 -p1 + +# Set up build subdirs and links +mkdir -p %{_builddir}/src/github.com/grafana @@ -1253,7 +1338,11 @@ index 000000000..85f0dd6aa +# Another exception is xerrors, which is a transition package +# for the new Go 1.13 error values, see https://github.com/golang/xerrors +cp --parents -a vendor/github.com/grafana vendor/golang.org/x/xerrors \ -+ vendor/github.com/robfig/cron %{_builddir} ++ vendor/github.com/robfig vendor/github.com/crewjam/saml \ ++ vendor/github.com/ua-parser/uap-go/uaparser \ ++ vendor/github.com/beevik/etree \ ++ vendor/github.com/russellhaering/goxmldsig \ ++ %{_builddir} +rm -r vendor # remove all vendor sources +mv %{_builddir}/vendor vendor # put back what we're keeping +%endif @@ -1283,15 +1372,18 @@ index 000000000..85f0dd6aa +[ ! -d bin/arm64 ] && ln -sf linux-arm64 bin/aarch64 +[ ! -d bin/aarch64 ] && ln -sf linux-aarch64 bin/aarch64 + -+# binaries ++# dirs, shared files, public html, webpack +install -d %{buildroot}%{_sbindir} -+install -p -m 755 bin/%{_arch}/%{name}-server %{buildroot}%{_sbindir} -+install -p -m 755 bin/%{_arch}/%{name}-cli %{buildroot}%{_sbindir} -+ -+# other shared files, public html, webpack -+install -d %{buildroot}%{_datadir}/%{name} ++install -d %{buildroot}%{_datadir}/%{name}/bin +cp -a conf public %{buildroot}%{_datadir}/%{name} + ++# wrappers ++install -p -m 755 packaging/wrappers/grafana-cli %{buildroot}%{_sbindir}/%{name}-cli ++ ++# binaries ++install -p -m 755 bin/%{_arch}/%{name}-server %{buildroot}%{_sbindir} ++install -p -m 755 bin/%{_arch}/%{name}-cli %{buildroot}%{_datadir}/%{name}/bin ++ +# man pages +install -d %{buildroot}%{_mandir}/man1 +install -p -m 644 docs/man/man1/* %{buildroot}%{_mandir}/man1 @@ -1351,6 +1443,7 @@ index 000000000..85f0dd6aa +rm -f pkg/services/provisioning/dashboards/file_reader_linux_test.go +rm -f pkg/services/provisioning/dashboards/file_reader_test.go +rm -f pkg/services/sqlstore/alert_test.go ++rm -f pkg/services/sqlstore/apikey_test.go +go test ./pkg/... + + @@ -1373,6 +1466,7 @@ index 000000000..85f0dd6aa +%attr(-, %{GRAFANA_USER}, %{GRAFANA_GROUP}) %dir %{_sharedstatedir}/%{name}/plugins + +# shared directory and all files therein, except some datasources ++%{_datadir}/%{name}/bin +%{_datadir}/%{name}/public + +# built-in datasources that are sub-packaged @@ -1449,6 +1543,16 @@ index 000000000..85f0dd6aa + + +%changelog ++* Fri Aug 30 2019 Mark Goodwin <mgoodwin(a)redhat.com> 6.3.4-1 ++- add patch for uaparser on 32bit systems ++- update to latest upstream community sources, see CHANGELOG ++ ++* Wed Jul 31 2019 Mark Goodwin <mgoodwin(a)redhat.com> 6.2.5-1 ++- update to latest upstream community sources, see CHANGELOG ++ ++* Thu Jul 25 2019 Fedora Release Engineering <releng(a)fedoraproject.org> - 6.2.2-2 ++- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild ++ +* Fri Jun 07 2019 Mark Goodwin <mgoodwin(a)redhat.com> 6.2.2-1 +- split out some datasource plugins to sub-packages +- update to latest upstream community sources, see CHANGELOG diff --git a/004-xerrors.patch b/004-xerrors.patch new file mode 100644 index 0000000..fc0612a --- /dev/null +++ b/004-xerrors.patch @@ -0,0 +1,146 @@ +diff --git a/go.mod b/go.mod +index 13f7c66bb..e0615affa 100644 +--- a/go.mod ++++ b/go.mod +@@ -77,7 +77,6 @@ require ( + golang.org/x/oauth2 v0.0.0-20190319182350-c85d3e98c914 + golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6 + golang.org/x/sys v0.0.0-20190415081028-16da32be82c5 // indirect +- golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373 + gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect + gopkg.in/asn1-ber.v1 v1.0.0-20181015200546-f715ec2f112d // indirect + gopkg.in/bufio.v1 v1.0.0-20140618132640-567b2bfa514e // indirect +diff --git a/vendor/golang.org/x/xerrors/adaptor_go1_12.go b/vendor/golang.org/x/xerrors/adaptor.go +similarity index 99% +rename from vendor/golang.org/x/xerrors/adaptor_go1_12.go +rename to vendor/golang.org/x/xerrors/adaptor.go +index 6b9f2f0c7..4317f2483 100644 +--- a/vendor/golang.org/x/xerrors/adaptor_go1_12.go ++++ b/vendor/golang.org/x/xerrors/adaptor.go +@@ -2,8 +2,6 @@ + // Use of this source code is governed by a BSD-style + // license that can be found in the LICENSE file. + +-// +build !go1.13 +- + package xerrors + + import ( +diff --git a/vendor/golang.org/x/xerrors/adaptor_go1_13.go b/vendor/golang.org/x/xerrors/adaptor_go1_13.go +deleted file mode 100644 +index 57f519dc5..000000000 +--- a/vendor/golang.org/x/xerrors/adaptor_go1_13.go ++++ /dev/null +@@ -1,55 +0,0 @@ +-// Copyright 2018 The Go Authors. All rights reserved. +-// Use of this source code is governed by a BSD-style +-// license that can be found in the LICENSE file. +- +-// +build go1.13 +- +-package xerrors +- +-import ( +- "errors" +- "fmt" +- "strconv" +-) +- +-// A Frame contains part of a call stack. +-type Frame = errors.Frame +- +-// Caller returns a Frame that describes a frame on the caller's stack. +-// The argument skip is the number of frames to skip over. +-// Caller(0) returns the frame for the caller of Caller. +-var Caller func(skip int) Frame = errors.Caller +- +-// FormatError calls the FormatError method of f with an errors.Printer +-// configured according to s and verb, and writes the result to s. +-func FormatError(f Formatter, s fmt.State, verb rune) { +- // Assuming this function is only called from the Format method, and given +- // that FormatError takes precedence over Format, it cannot be called from +- // any package that supports errors.Formatter. It is therefore safe to +- // disregard that State may be a specific printer implementation and use one +- // of our choice instead. +- +- width, okW := s.Width() +- prec, okP := s.Precision() +- +- // Construct format string from State s. +- format := []byte{'%'} +- if s.Flag('-') { +- format = append(format, '-') +- } +- if s.Flag('+') { +- format = append(format, '+') +- } +- if s.Flag(' ') { +- format = append(format, ' ') +- } +- if okW { +- format = strconv.AppendInt(format, int64(width), 10) +- } +- if okP { +- format = append(format, '.') +- format = strconv.AppendInt(format, int64(prec), 10) +- } +- format = append(format, string(verb)...) +- fmt.Fprintf(s, string(format), f) +-} +diff --git a/vendor/golang.org/x/xerrors/format_go1_12.go b/vendor/golang.org/x/xerrors/format.go +similarity index 98% +rename from vendor/golang.org/x/xerrors/format_go1_12.go +rename to vendor/golang.org/x/xerrors/format.go +index ba856feab..1bc9c26b9 100644 +--- a/vendor/golang.org/x/xerrors/format_go1_12.go ++++ b/vendor/golang.org/x/xerrors/format.go +@@ -2,8 +2,6 @@ + // Use of this source code is governed by a BSD-style + // license that can be found in the LICENSE file. + +-// +build !go1.13 +- + package xerrors + + // A Formatter formats error messages. +diff --git a/vendor/golang.org/x/xerrors/format_go1_13.go b/vendor/golang.org/x/xerrors/format_go1_13.go +deleted file mode 100644 +index 95c65968b..000000000 +--- a/vendor/golang.org/x/xerrors/format_go1_13.go ++++ /dev/null +@@ -1,19 +0,0 @@ +-// Copyright 2018 The Go Authors. All rights reserved. +-// Use of this source code is governed by a BSD-style +-// license that can be found in the LICENSE file. +- +-// +build go1.13 +- +-package xerrors +- +-import "errors" +- +-// A Formatter formats error messages. +-type Formatter = errors.Formatter +- +-// A Printer formats error messages. +-// +-// The most common implementation of Printer is the one provided by package fmt +-// during Printf (as of Go 1.13). Localization packages such as golang.org/x/text/message +-// typically provide their own implementations. +-type Printer = errors.Printer +diff --git a/vendor/golang.org/x/xerrors/frame_go1_12.go b/vendor/golang.org/x/xerrors/frame.go +similarity index 98% +rename from vendor/golang.org/x/xerrors/frame_go1_12.go +rename to vendor/golang.org/x/xerrors/frame.go +index 6740f7fa6..0de628ec5 100644 +--- a/vendor/golang.org/x/xerrors/frame_go1_12.go ++++ b/vendor/golang.org/x/xerrors/frame.go +@@ -2,8 +2,6 @@ + // Use of this source code is governed by a BSD-style + // license that can be found in the LICENSE file. + +-// +build !go1.13 +- + package xerrors + + import ( diff --git a/grafana.spec b/grafana.spec index b12ce8f..0b2849d 100644 --- a/grafana.spec +++ b/grafana.spec @@ -8,16 +8,21 @@ end end} -# Unbundle grafana vendor sources and instead use BuildRequires +# Unbundle Grafana vendor sources and instead use BuildRequires # only on platforms that have enough golang devel support. %if 0%{?rhel} == 0 %global unbundle_vendor_sources 1 %endif +%if 0%{?fedora} >= 31 +# Use vendor sources until both Fedora and Grafana properly support golang modules +%global unbundle_vendor_sources 0 +%endif + Name: grafana -Version: 6.2.2 -Release: 2%{?dist} +Version: 6.3.5 +Release: 1%{?dist} Summary: Metrics dashboard and graph editor License: ASL 2.0 URL: https://grafana.org @@ -35,11 +40,13 @@ Source2: make_grafana_webpack.sh Patch1: 001-login-oauth-use-oauth2-exchange.patch Patch2: 002-remove-jaeger-tracing.patch Patch3: 003-new-files.patch +Patch4: 004-xerrors.patch # Intersection of go_arches and nodejs_arches ExclusiveArch: %{grafana_arches} # omit golang debugsource, see BZ995136 and related +%global dwz_low_mem_die_limit 0 %global _debugsource_template %{nil} %global GRAFANA_USER %{name} @@ -50,7 +57,7 @@ ExclusiveArch: %{grafana_arches} %{?systemd_requires} Requires(pre): shadow-utils -BuildRequires: systemd, golang, go-srpm-macros +BuildRequires: git, systemd, golang, go-srpm-macros Recommends: grafana-cloudwatch = %{version}-%{release} Recommends: grafana-elasticsearch = %{version}-%{release} @@ -193,10 +200,15 @@ BuildRequires: golang(github.com/go-redis/redis) BuildRequires: golang(gopkg.in/square/go-jose.v2) BuildRequires: golang(gopkg.in/square/go-jose.v2/cipher) BuildRequires: golang(gopkg.in/square/go-jose.v2/json) +%if 0%{fedora} >= 31 +BuildRequires: golang(gopkg.in/yaml.v2) +%else BuildRequires: golang(github.com/go-yaml/yaml) +%endif BuildRequires: golang(golang.org/x/sync/errgroup) BuildRequires: golang(gopkg.in/ldap.v3) BuildRequires: golang(gopkg.in/mail.v2) +BuildRequires: golang(github.com/jonboulle/clockwork) %endif # Declare all nodejs modules bundled in the webpack - this is for security @@ -393,6 +405,7 @@ The Grafana stackdriver datasource. %patch1 -p1 %patch2 -p1 %patch3 -p1 +%patch4 -p1 # Set up build subdirs and links mkdir -p %{_builddir}/src/github.com/grafana @@ -405,25 +418,32 @@ rm -f public/sass/.sass-lint.yml public/test/.jshintrc %if 0%{?unbundle_vendor_sources} # Unbundle all grafana vendor sources, as per BuildRequires above. # An exception is grafana-plugin-model, which is part of grafana. -# Another exception is xerrors, which is a transition package -# for the new Go 1.13 error values, see https://github.com/golang/xerrors -cp --parents -a vendor/github.com/grafana vendor/golang.org/x/xerrors \ - vendor/github.com/robfig/cron %{_builddir} +cp --parents -a vendor/github.com/grafana \ + vendor/golang.org/x/xerrors \ + vendor/github.com/robfig vendor/github.com/crewjam/saml \ + vendor/github.com/ua-parser/uap-go/uaparser \ + vendor/github.com/beevik/etree \ + vendor/github.com/russellhaering/goxmldsig \ + %{_builddir} rm -r vendor # remove all vendor sources mv %{_builddir}/vendor vendor # put back what we're keeping %endif %build -# Build the server-side binaries: grafana-server and grafana-cli -%if 0%{?gobuild} -# use modern go macros such as in recent Fedora -export GOPATH=%{_builddir}:%{gopath} -%gobuild -o grafana-cli ./pkg/cmd/grafana-cli -%gobuild -o grafana-server ./pkg/cmd/grafana-server -%else +# Build the server-side binaries cd %{_builddir}/src/github.com/grafana/grafana +%global archbindir bin/`go env GOOS`-`go env GOARCH` +echo _builddir=%{_builddir} archbindir=%{archbindir} +[ ! -d %{archbindir} ] && mkdir -p %{archbindir} export GOPATH=%{_builddir}:%{gopath} +# export GO111MODULE=off +%if 0%{?fedora} >= 31 +# native fedora golang build but without modules (no grafana support yet) +go build -mod=vendor -o %{archbindir}/grafana-cli ./pkg/cmd/grafana-cli +go build -mod=vendor -o %{archbindir}/grafana-server ./pkg/cmd/grafana-server +%else +# use the grafana build.go script. go run build.go build %endif @@ -438,15 +458,18 @@ go run build.go build [ ! -d bin/arm64 ] && ln -sf linux-arm64 bin/aarch64 [ ! -d bin/aarch64 ] && ln -sf linux-aarch64 bin/aarch64 -# binaries +# dirs, shared files, public html, webpack install -d %{buildroot}%{_sbindir} -install -p -m 755 bin/%{_arch}/%{name}-server %{buildroot}%{_sbindir} -install -p -m 755 bin/%{_arch}/%{name}-cli %{buildroot}%{_sbindir} - -# other shared files, public html, webpack -install -d %{buildroot}%{_datadir}/%{name} +install -d %{buildroot}%{_datadir}/%{name}/bin cp -a conf public %{buildroot}%{_datadir}/%{name} +# wrappers +install -p -m 755 packaging/wrappers/grafana-cli %{buildroot}%{_sbindir}/%{name}-cli + +# binaries +install -p -m 755 %{archbindir}/%{name}-server %{buildroot}%{_sbindir} +install -p -m 755 %{archbindir}/%{name}-cli %{buildroot}%{_datadir}/%{name}/bin + # man pages install -d %{buildroot}%{_mandir}/man1 install -p -m 644 docs/man/man1/* %{buildroot}%{_mandir}/man1 @@ -506,6 +529,8 @@ export GOPATH=%{_builddir}:%{gopath} rm -f pkg/services/provisioning/dashboards/file_reader_linux_test.go rm -f pkg/services/provisioning/dashboards/file_reader_test.go rm -f pkg/services/sqlstore/alert_test.go +rm -f pkg/services/sqlstore/apikey_test.go +export GO111MODULE=off go test ./pkg/... @@ -528,6 +553,7 @@ go test ./pkg/... %attr(-, %{GRAFANA_USER}, %{GRAFANA_GROUP}) %dir %{_sharedstatedir}/%{name}/plugins # shared directory and all files therein, except some datasources +%{_datadir}/%{name}/bin %{_datadir}/%{name}/public # built-in datasources that are sub-packaged @@ -604,6 +630,20 @@ go test ./pkg/... %changelog +* Thu Sep 05 2019 Mark Goodwin <mgoodwin(a)redhat.com> 6.3.5-1 +- drop uaparser patch now it's upstream +- add xerrors patch, see https://github.com/golang/go/issues/32246 +- use vendor sources on rawhide until modules are fully supported +- update to latest upstream community sources, see CHANGELOG + +* Fri Aug 30 2019 Mark Goodwin <mgoodwin(a)redhat.com> 6.3.4-1 +- include fix for CVE-2019-15043 +- add patch for uaparser on 32bit systems +- update to latest upstream community sources, see CHANGELOG + +* Wed Jul 31 2019 Mark Goodwin <mgoodwin(a)redhat.com> 6.2.5-1 +- update to latest upstream community sources, see CHANGELOG + * Thu Jul 25 2019 Fedora Release Engineering <releng(a)fedoraproject.org> - 6.2.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild diff --git a/sources b/sources index 7aa1917..6e15cea 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (grafana-6.2.2.tar.gz) = fffa2a04c5249e6159297280313b7d6cbec2f86fc59e48200405905848dda524bb522cf34a1cf2f55855104e93c72e69284875f0dbea447cc8f551948c03e8af -SHA512 (grafana_webpack-6.2.2.tar.gz) = db09ff6cf5c1292bca01dfb5c0c1e615890c229c510785af11406bc945f135b19d14fcda6a483c6a438dde567f8d43d59298aec638c6780a788b60bb9b734d64 +SHA512 (grafana-6.3.5.tar.gz) = c0151583bbed121290b091d40aae655ca22901d80ab02eafb5fea96f80bdcb88d070c4d778284d7c4605a420fe8918c82a67a51325cc71d605e4212a6a1c9162 +SHA512 (grafana_webpack-6.3.5.tar.gz) = 3967ee64501886994d26c6d6c1f949db9732d1dafbe7dd105ff5de4dc26c4d87831fcc6195f086262e86aa9c10e4be7f012bee8d6c95eb52f835837d3ac6d126

1 0

Architecture specific change in rpms/grafana.git
by githook-noreply＠fedoraproject.org 27 Nov '19

27 Nov '19

The package rpms/grafana.git has added or updated architecture specific content in its spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s): https://src.fedoraproject.org/cgit/rpms/grafana.git/commit/?id=47a36c908182…. Change: +ExclusiveArch: %{grafana_arches} Thanks. Full change: ============ commit 47a36c908182bb085b189cfad0937bd0d9928028 Author: Mark Goodwin <mgoodwin(a)redhat.com> Date: Wed Nov 27 10:35:10 2019 +1100 Update to latest upstream sources v6.3.6 diff --git a/.gitignore b/.gitignore index c89ab6b..f73aa3f 100644 --- a/.gitignore +++ b/.gitignore @@ -6,3 +6,5 @@ /grafana_webpack-6.2.2.tar.gz /grafana-6.3.5.tar.gz /grafana_webpack-6.3.5.tar.gz +/grafana-6.3.6.tar.gz +/grafana_webpack-6.3.6.tar.gz diff --git a/003-new-files.patch b/003-new-files.patch index cf0c325..2cac75d 100644 --- a/003-new-files.patch +++ b/003-new-files.patch @@ -1,9 +1,9 @@ diff --git a/conf/distro-defaults.ini b/conf/distro-defaults.ini new file mode 100644 -index 000000000..e7a0c5062 +index 0000000000..e337ba0b57 --- /dev/null +++ b/conf/distro-defaults.ini -@@ -0,0 +1,683 @@ +@@ -0,0 +1,685 @@ +##################### Grafana Configuration Defaults for distros ##################### +# +# Do not modify this file in grafana installs @@ -598,8 +598,10 @@ index 000000000..e7a0c5062 +#################################### Internal Grafana Metrics ############ +# Metrics available at HTTP API Url /metrics +[metrics] -+enabled = true -+interval_seconds = 10 ++enabled = true ++interval_seconds = 10 ++# Disable total stats (stat_totals_*) metrics to be generated ++disable_total_stats = false + +#If both are set, basic auth will be required for the metrics endpoint. +basic_auth_username = @@ -689,7 +691,7 @@ index 000000000..e7a0c5062 +license_path = diff --git a/docs/man/man1/grafana-cli.1 b/docs/man/man1/grafana-cli.1 new file mode 100644 -index 000000000..171748fcd +index 0000000000..171748fcda --- /dev/null +++ b/docs/man/man1/grafana-cli.1 @@ -0,0 +1,51 @@ @@ -746,7 +748,7 @@ index 000000000..171748fcd +.BR http://docs.grafana.org/ . diff --git a/docs/man/man1/grafana-server.1 b/docs/man/man1/grafana-server.1 new file mode 100644 -index 000000000..30b7c1306 +index 0000000000..30b7c1306f --- /dev/null +++ b/docs/man/man1/grafana-server.1 @@ -0,0 +1,156 @@ @@ -908,7 +910,7 @@ index 000000000..30b7c1306 +.BR http://docs.grafana.org/ . diff --git a/packaging/rpm/spec/README b/packaging/rpm/spec/README new file mode 100644 -index 000000000..f97c2a26b +index 0000000000..f97c2a26be --- /dev/null +++ b/packaging/rpm/spec/README @@ -0,0 +1,7 @@ @@ -921,10 +923,10 @@ index 000000000..f97c2a26b + diff --git a/packaging/rpm/spec/grafana.spec b/packaging/rpm/spec/grafana.spec new file mode 100644 -index 000000000..81d21aaf4 +index 0000000000..fb9200cb62 --- /dev/null +++ b/packaging/rpm/spec/grafana.spec -@@ -0,0 +1,737 @@ +@@ -0,0 +1,766 @@ +%global grafana_arches %{lua: go_arches = {} + for arch in rpm.expand("%{go_arches}"):gmatch("%S+") do + go_arches[arch] = 1 @@ -935,15 +937,20 @@ index 000000000..81d21aaf4 + end +end} + -+# Unbundle grafana vendor sources and instead use BuildRequires ++# Unbundle Grafana vendor sources and instead use BuildRequires +# only on platforms that have enough golang devel support. +%if 0%{?rhel} == 0 +%global unbundle_vendor_sources 1 +%endif + ++%if 0%{?fedora} >= 30 ++# Use vendor sources until both Fedora and Grafana properly support golang modules ++%global unbundle_vendor_sources 0 ++%endif ++ + +Name: grafana -+Version: 6.3.4 ++Version: 6.3.6 +Release: 1%{?dist} +Summary: Metrics dashboard and graph editor +License: ASL 2.0 @@ -962,12 +969,14 @@ index 000000000..81d21aaf4 +Patch1: 001-login-oauth-use-oauth2-exchange.patch +Patch2: 002-remove-jaeger-tracing.patch +Patch3: 003-new-files.patch -+Patch4: 004-fix-uaparser-32bit.patch ++Patch4: 004-xerrors.patch ++Patch5: 005-mute-shellcheck-grafana-cli.patch + +# Intersection of go_arches and nodejs_arches +ExclusiveArch: %{grafana_arches} + +# omit golang debugsource, see BZ995136 and related ++%global dwz_low_mem_die_limit 0 +%global _debugsource_template %{nil} + +%global GRAFANA_USER %{name} @@ -992,6 +1001,7 @@ index 000000000..81d21aaf4 +Recommends: grafana-postgres = %{version}-%{release} +Recommends: grafana-prometheus = %{version}-%{release} +Recommends: grafana-stackdriver = %{version}-%{release} ++Recommends: grafana-pcp + +%if 0%{?unbundle_vendor_sources} +# golang build deps. These allow us to unbundle vendor golang source. @@ -1121,7 +1131,11 @@ index 000000000..81d21aaf4 +BuildRequires: golang(gopkg.in/square/go-jose.v2) +BuildRequires: golang(gopkg.in/square/go-jose.v2/cipher) +BuildRequires: golang(gopkg.in/square/go-jose.v2/json) ++%if 0%{fedora} >= 31 ++BuildRequires: golang(gopkg.in/yaml.v2) ++%else +BuildRequires: golang(github.com/go-yaml/yaml) ++%endif +BuildRequires: golang(golang.org/x/sync/errgroup) +BuildRequires: golang(gopkg.in/ldap.v3) +BuildRequires: golang(gopkg.in/mail.v2) @@ -1323,6 +1337,7 @@ index 000000000..81d21aaf4 +%patch2 -p1 +%patch3 -p1 +%patch4 -p1 ++%patch5 -p1 + +# Set up build subdirs and links +mkdir -p %{_builddir}/src/github.com/grafana @@ -1335,9 +1350,8 @@ index 000000000..81d21aaf4 +%if 0%{?unbundle_vendor_sources} +# Unbundle all grafana vendor sources, as per BuildRequires above. +# An exception is grafana-plugin-model, which is part of grafana. -+# Another exception is xerrors, which is a transition package -+# for the new Go 1.13 error values, see https://github.com/golang/xerrors -+cp --parents -a vendor/github.com/grafana vendor/golang.org/x/xerrors \ ++cp --parents -a vendor/github.com/grafana \ ++ vendor/golang.org/x/xerrors \ + vendor/github.com/robfig vendor/github.com/crewjam/saml \ + vendor/github.com/ua-parser/uap-go/uaparser \ + vendor/github.com/beevik/etree \ @@ -1349,15 +1363,19 @@ index 000000000..81d21aaf4 + + +%build -+# Build the server-side binaries: grafana-server and grafana-cli -+%if 0%{?gobuild} -+# use modern go macros such as in recent Fedora -+export GOPATH=%{_builddir}:%{gopath} -+%gobuild -o grafana-cli ./pkg/cmd/grafana-cli -+%gobuild -o grafana-server ./pkg/cmd/grafana-server -+%else ++# Build the server-side binaries +cd %{_builddir}/src/github.com/grafana/grafana ++%global archbindir bin/`go env GOOS`-`go env GOARCH` ++echo _builddir=%{_builddir} archbindir=%{archbindir} ++[ ! -d %{archbindir} ] && mkdir -p %{archbindir} +export GOPATH=%{_builddir}:%{gopath} ++# export GO111MODULE=off ++%if 0%{?fedora} >= 31 ++# native fedora golang build but without modules (no grafana support yet) ++go build -mod=vendor -o %{archbindir}/grafana-cli ./pkg/cmd/grafana-cli ++go build -mod=vendor -o %{archbindir}/grafana-server ./pkg/cmd/grafana-server ++%else ++# use the grafana build.go script. +go run build.go build +%endif + @@ -1381,8 +1399,8 @@ index 000000000..81d21aaf4 +install -p -m 755 packaging/wrappers/grafana-cli %{buildroot}%{_sbindir}/%{name}-cli + +# binaries -+install -p -m 755 bin/%{_arch}/%{name}-server %{buildroot}%{_sbindir} -+install -p -m 755 bin/%{_arch}/%{name}-cli %{buildroot}%{_datadir}/%{name}/bin ++install -p -m 755 %{archbindir}/%{name}-server %{buildroot}%{_sbindir} ++install -p -m 755 %{archbindir}/%{name}-cli %{buildroot}%{_datadir}/%{name}/bin + +# man pages +install -d %{buildroot}%{_mandir}/man1 @@ -1444,6 +1462,7 @@ index 000000000..81d21aaf4 +rm -f pkg/services/provisioning/dashboards/file_reader_test.go +rm -f pkg/services/sqlstore/alert_test.go +rm -f pkg/services/sqlstore/apikey_test.go ++export GO111MODULE=off +go test ./pkg/... + + @@ -1543,7 +1562,19 @@ index 000000000..81d21aaf4 + + +%changelog ++* Wed Nov 20 2019 Mark Goodwin <mgoodwin(a)redhat.com> 6.3.6-1 ++- add weak depenency on grafana-pcp ++- add patch to mute shellcheck SC1090 for grafana-cli ++- update to 6.3.6 upstream community sources, see CHANGELOG ++ ++* Thu Sep 05 2019 Mark Goodwin <mgoodwin(a)redhat.com> 6.3.5-1 ++- drop uaparser patch now it's upstream ++- add xerrors patch, see https://github.com/golang/go/issues/32246 ++- use vendor sources on rawhide until modules are fully supported ++- update to latest upstream community sources, see CHANGELOG ++ +* Fri Aug 30 2019 Mark Goodwin <mgoodwin(a)redhat.com> 6.3.4-1 ++- include fix for CVE-2019-15043 +- add patch for uaparser on 32bit systems +- update to latest upstream community sources, see CHANGELOG + @@ -1664,7 +1695,7 @@ index 000000000..81d21aaf4 +- native RPM spec build with current tagged v5.2.5 sources diff --git a/packaging/rpm/spec/make_grafana_webpack.sh b/packaging/rpm/spec/make_grafana_webpack.sh new file mode 100755 -index 000000000..47a8025ff +index 0000000000..47a8025ff4 --- /dev/null +++ b/packaging/rpm/spec/make_grafana_webpack.sh @@ -0,0 +1,61 @@ diff --git a/005-mute-shellcheck-grafana-cli.patch b/005-mute-shellcheck-grafana-cli.patch new file mode 100644 index 0000000..5a92c64 --- /dev/null +++ b/005-mute-shellcheck-grafana-cli.patch @@ -0,0 +1,12 @@ +diff --git a/packaging/wrappers/grafana-cli b/packaging/wrappers/grafana-cli +index 9cad151c0d..4c963d90ac 100755 +--- a/packaging/wrappers/grafana-cli ++++ b/packaging/wrappers/grafana-cli +@@ -24,6 +24,7 @@ if [ ! -x $EXECUTABLE ]; then + fi + + # overwrite settings from default file ++#shellcheck disable=SC1090 + if [ -f "$DEFAULT" ]; then + . "$DEFAULT" + fi diff --git a/grafana.spec b/grafana.spec index 0b2849d..fb9200c 100644 --- a/grafana.spec +++ b/grafana.spec @@ -14,14 +14,14 @@ end} %global unbundle_vendor_sources 1 %endif -%if 0%{?fedora} >= 31 +%if 0%{?fedora} >= 30 # Use vendor sources until both Fedora and Grafana properly support golang modules %global unbundle_vendor_sources 0 %endif Name: grafana -Version: 6.3.5 +Version: 6.3.6 Release: 1%{?dist} Summary: Metrics dashboard and graph editor License: ASL 2.0 @@ -41,6 +41,7 @@ Patch1: 001-login-oauth-use-oauth2-exchange.patch Patch2: 002-remove-jaeger-tracing.patch Patch3: 003-new-files.patch Patch4: 004-xerrors.patch +Patch5: 005-mute-shellcheck-grafana-cli.patch # Intersection of go_arches and nodejs_arches ExclusiveArch: %{grafana_arches} @@ -71,6 +72,7 @@ Recommends: grafana-opentsdb = %{version}-%{release} Recommends: grafana-postgres = %{version}-%{release} Recommends: grafana-prometheus = %{version}-%{release} Recommends: grafana-stackdriver = %{version}-%{release} +Recommends: grafana-pcp %if 0%{?unbundle_vendor_sources} # golang build deps. These allow us to unbundle vendor golang source. @@ -406,6 +408,7 @@ The Grafana stackdriver datasource. %patch2 -p1 %patch3 -p1 %patch4 -p1 +%patch5 -p1 # Set up build subdirs and links mkdir -p %{_builddir}/src/github.com/grafana @@ -630,6 +633,11 @@ go test ./pkg/... %changelog +* Wed Nov 20 2019 Mark Goodwin <mgoodwin(a)redhat.com> 6.3.6-1 +- add weak depenency on grafana-pcp +- add patch to mute shellcheck SC1090 for grafana-cli +- update to 6.3.6 upstream community sources, see CHANGELOG + * Thu Sep 05 2019 Mark Goodwin <mgoodwin(a)redhat.com> 6.3.5-1 - drop uaparser patch now it's upstream - add xerrors patch, see https://github.com/golang/go/issues/32246 diff --git a/sources b/sources index 6e15cea..c79831f 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (grafana-6.3.5.tar.gz) = c0151583bbed121290b091d40aae655ca22901d80ab02eafb5fea96f80bdcb88d070c4d778284d7c4605a420fe8918c82a67a51325cc71d605e4212a6a1c9162 -SHA512 (grafana_webpack-6.3.5.tar.gz) = 3967ee64501886994d26c6d6c1f949db9732d1dafbe7dd105ff5de4dc26c4d87831fcc6195f086262e86aa9c10e4be7f012bee8d6c95eb52f835837d3ac6d126 +SHA512 (grafana-6.3.6.tar.gz) = 141ba6db2dfa376471dc43cb9be432bad73de39a5e5f587d394484c6f49a5d3a67dacc0fec45ab658c6a5729ee073f2572baddee14fc6b0e2ed0d5582414be6c +SHA512 (grafana_webpack-6.3.6.tar.gz) = 076c921fdd7cb59869b521ef0eb88d74b80005da49df6b7cde450b34ce1236e3595b26ab6e45ade50e8b219914ef476413e40790a0842daf7e726e671a9327bd

1 0

Architecture specific change in rpms/erlang-xmpp.git
by githook-noreply＠fedoraproject.org 26 Nov '19

26 Nov '19

The package rpms/erlang-xmpp.git has added or updated architecture specific content in its spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s): https://src.fedoraproject.org/cgit/rpms/erlang-xmpp.git/commit/?id=3a445f6b…. Change: -ExcludeArch: s390x Thanks. Full change: ============ commit 3a445f6b13de3eb862a99c06381ce4d80b17daeb Author: Randy Barlow <randy(a)electronsweatshop.com> Date: Tue Nov 26 15:35:28 2019 -0500 Bring xmpp back to s390x (#1775737) Signed-off-by: Randy Barlow <randy(a)electronsweatshop.com> diff --git a/erlang-xmpp.spec b/erlang-xmpp.spec index a81d8fa..ce73687 100644 --- a/erlang-xmpp.spec +++ b/erlang-xmpp.spec @@ -9,7 +9,7 @@ Name: erlang-%{srcname} Version: 1.4.2 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Erlang/Elixir XMPP parsing and serialization library License: ASL 2.0 @@ -18,9 +18,6 @@ Source0: https://github.com/processone/xmpp/archive/%{version}/xmpp-%{version # https://github.com/processone/xmpp/pull/3 Patch0: 0001-Allow-fxml.hrl-to-be-found-from-system-libs.patch -# Remove this when https://bugzilla.redhat.com/show_bug.cgi?id=1770256 is resolved -ExcludeArch: s390x - BuildRequires: gcc BuildRequires: erlang-ezlib >= %{ezlib_ver} BuildRequires: erlang-fast_tls >= %{fast_tls_ver} @@ -72,6 +69,9 @@ install -p -D -m 755 priv/lib/* --target-directory=%{buildroot}%{erlang_appdir}/ %changelog +* Tue Nov 26 2019 Randy Barlow <bowlofeggs(a)fedoraproject.org> - 1.4.2-2 +- Bring xmpp back to s390x (#1775737). + * Thu Nov 14 2019 Randy Barlow <bowlofeggs(a)fedoraproject.org> - 1.4.2-1 - Update to 1.4.2 (#1742454). - https://github.com/processone/xmpp/blob/1.4.2/CHANGELOG.md

1 0

Architecture specific change in rpms/xen.git
by githook-noreply＠fedoraproject.org 26 Nov '19

26 Nov '19

The package rpms/xen.git has added or updated architecture specific content in its spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s): https://src.fedoraproject.org/cgit/rpms/xen.git/commit/?id=45331b704417bcfb…. Change: +%ifarch %{ix86} x86_64 Thanks. Full change: ============ commit 45331b704417bcfbe3130a9e7d6ae07857d9c572 Author: Michael Young <m.a.young(a)durham.ac.uk> Date: Tue Nov 26 20:31:47 2019 +0000 Device quarantine for alternate pci assignment methods [XSA-306] diff --git a/xen.spec b/xen.spec index b48dc81..826387e 100644 --- a/xen.spec +++ b/xen.spec @@ -67,7 +67,7 @@ Summary: Xen is a virtual machine monitor Name: xen Version: 4.11.2 -Release: 3%{?dist} +Release: 4%{?dist} License: GPLv2+ and LGPLv2+ and BSD URL: http://xen.org/ Source0: https://downloads.xenproject.org/release/xen/%{version}/xen-%{version}.tar.… @@ -153,6 +153,7 @@ Patch70: xsa304-4.11-2.patch Patch71: xsa304-4.11-3.patch Patch72: xsa305-4.11-1.patch Patch73: xsa305-4.11-2.patch +Patch74: xsa306-4.11.patch %if %build_qemutrad @@ -388,6 +389,9 @@ manage Xen virtual machines. %patch71 -p1 %patch72 -p1 %patch73 -p1 +%ifarch %{ix86} x86_64 +%patch74 -p1 +%endif # qemu-xen-traditional patches pushd tools/qemu-xen-traditional @@ -987,6 +991,9 @@ fi %endif %changelog +* Tue Nov 26 2019 Michael Young <m.a.young(a)durham.ac.uk> - 4.11.2-4 +- Device quarantine for alternate pci assignment methods [XSA-306] + * Tue Nov 12 2019 Michael Young <m.a.young(a)durham.ac.uk> - 4.11.2-3 - add missing XSA-299 patches - x86: Machine Check Error on Page Size Change DoS [XSA-304, CVE-2018-12207] diff --git a/xsa306-4.11.patch b/xsa306-4.11.patch new file mode 100644 index 0000000..320121c --- /dev/null +++ b/xsa306-4.11.patch @@ -0,0 +1,94 @@ +From: Jan Beulich <jbeulich(a)suse.com> +Subject: IOMMU: default to always quarantining PCI devices + +XSA-302 relies on the use of libxl's "assignable-add" feature to prepare +devices to be assigned to untrusted guests. + +Unfortunately, this is not considered a strictly required step for +device assignment. The PCI passthrough documentation on the wiki +describes alternate ways of preparing devices for assignment, and +libvirt uses its own ways as well. Hosts where these alternate methods +are used will still leave the system in a vulnerable state after the +device comes back from a guest. + +Default to always quarantining PCI devices, but provide a command line +option to revert back to prior behavior (such that people who both +sufficiently trust their guests and want to be able to use devices in +Dom0 again after they had been in use by a guest wouldn't need to +"manually" move such devices back from DomIO to Dom0). + +This is XSA-306. + +Reported-by: Marek Marczykowski-Grecki <marmarek(a)invisiblethingslab.com> +Signed-off-by: Jan Beulich <jbeulich(a)suse.com> +Reviewed-by: Wei Liu <wl(a)xen.org> + +--- a/docs/misc/xen-command-line.markdown ++++ b/docs/misc/xen-command-line.markdown +@@ -1112,7 +1112,7 @@ detection of systems known to misbehave + > Default: `new` unless directed-EOI is supported + + ### iommu +-> `= List of [ <boolean> | force | required | intremap | intpost | qinval | snoop | sharept | dom0-passthrough | dom0-strict | amd-iommu-perdev-intremap | workaround_bios_bug | igfx | crash-disable | verbose | debug ]` ++> `= List of [ <boolean> | force | required | quarantine | intremap | intpost | qinval | snoop | sharept | dom0-passthrough | dom0-strict | amd-iommu-perdev-intremap | workaround_bios_bug | igfx | crash-disable | verbose | debug ]` + + > Sub-options: + +@@ -1132,6 +1132,15 @@ detection of systems known to misbehave + >> Don't continue booting unless IOMMU support is found and can be initialized + >> successfully. + ++> `quarantine` ++ ++> Default: `true` ++ ++>> Control Xen's behavior when de-assigning devices from guests. If enabled, ++>> Xen always quarantines such devices; they must be explicitly assigned back ++>> to Dom0 before they can be used there again. If disabled, Xen will only ++>> quarantine devices the toolstack hass arranged for getting quarantined. ++ + > `intremap` + + > Default: `true` +--- a/xen/drivers/passthrough/iommu.c ++++ b/xen/drivers/passthrough/iommu.c +@@ -52,6 +52,7 @@ custom_param("iommu", parse_iommu_param) + bool_t __initdata iommu_enable = 1; + bool_t __read_mostly iommu_enabled; + bool_t __read_mostly force_iommu; ++bool __read_mostly iommu_quarantine = true; + bool_t __hwdom_initdata iommu_dom0_strict; + bool_t __read_mostly iommu_verbose; + bool_t __read_mostly iommu_workaround_bios_bug; +@@ -99,6 +100,8 @@ static int __init parse_iommu_param(cons + else if ( !cmdline_strcmp(s, "force") || + !cmdline_strcmp(s, "required") ) + force_iommu = val; ++ else if ( !cmdline_strcmp(s, "quarantine") ) ++ iommu_quarantine = val; + else if ( !cmdline_strcmp(s, "workaround_bios_bug") ) + iommu_workaround_bios_bug = val; + else if ( !cmdline_strcmp(s, "igfx") ) +--- a/xen/drivers/passthrough/pci.c ++++ b/xen/drivers/passthrough/pci.c +@@ -1511,7 +1511,8 @@ int deassign_device(struct domain *d, u1 + return -ENODEV; + + /* De-assignment from dom_io should de-quarantine the device */ +- target = (pdev->quarantine && pdev->domain != dom_io) ? ++ target = ((pdev->quarantine || iommu_quarantine) && ++ pdev->domain != dom_io) ? + dom_io : hardware_domain; + + while ( pdev->phantom_stride ) +--- a/xen/include/xen/iommu.h ++++ b/xen/include/xen/iommu.h +@@ -29,7 +29,7 @@ + #include <asm/iommu.h> + + extern bool_t iommu_enable, iommu_enabled; +-extern bool_t force_iommu, iommu_verbose; ++extern bool force_iommu, iommu_quarantine, iommu_verbose; + extern bool_t iommu_workaround_bios_bug, iommu_igfx, iommu_passthrough; + extern bool_t iommu_snoop, iommu_qinval, iommu_intremap, iommu_intpost; + extern bool_t iommu_hap_pt_share;

1 0

Architecture specific change in rpms/erlang-stringprep.git
by githook-noreply＠fedoraproject.org 26 Nov '19

26 Nov '19

The package rpms/erlang-stringprep.git has added or updated architecture specific content in its spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s): https://src.fedoraproject.org/cgit/rpms/erlang-stringprep.git/commit/?id=f3…. Change: -ExcludeArch: s390x Thanks. Full change: ============ commit f38589ca911bf6c2acce8b2480afb7fb54e664f1 Author: Randy Barlow <randy(a)electronsweatshop.com> Date: Tue Nov 26 14:51:24 2019 -0500 Bring stringprep back to s390x (#1772970) Signed-off-by: Randy Barlow <randy(a)electronsweatshop.com> diff --git a/erlang-stringprep.spec b/erlang-stringprep.spec index a64c1be..ff17f95 100644 --- a/erlang-stringprep.spec +++ b/erlang-stringprep.spec @@ -5,16 +5,13 @@ Name: erlang-%{srcname} Version: 1.0.17 -Release: 1%{?dist} +Release: 2%{?dist} License: ASL 2.0 and TCL Summary: A framework for preparing Unicode strings to help input and comparison URL: https://github.com/processone/stringprep/ Source0: https://github.com/processone/stringprep/archive/%{version}/%{srcname}-%{ve… -# Remove this when https://bugzilla.redhat.com/show_bug.cgi?id=1770256 is resolved -ExcludeArch: s390x - Provides: erlang-p1_stringprep = %{version}-%{release} Obsoletes: erlang-p1_stringprep < 1.0.3 @@ -61,6 +58,9 @@ install -pm755 priv/lib/* $RPM_BUILD_ROOT%{_erllibdir}/%{srcname}-%{version}/pri %changelog +* Tue Nov 26 2019 Randy Barlow <bowlofeggs(a)fedoraproject.org> - 1.0.17-2 +- Bring stringprep back to s390x (#1772971). + * Thu Nov 14 2019 Randy Barlow <bowlofeggs(a)fedoraproject.org> - 1.0.17-1 - Update to 1.0.17 (#1742461). - https://github.com/processone/stringprep/blob/1.0.17/CHANGELOG.md

1 0

Architecture specific change in rpms/erlang-mqtree.git
by githook-noreply＠fedoraproject.org 26 Nov '19

26 Nov '19

The package rpms/erlang-mqtree.git has added or updated architecture specific content in its spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s): https://src.fedoraproject.org/cgit/rpms/erlang-mqtree.git/commit/?id=277cb4…. Change: -ExcludeArch: s390x Thanks. Full change: ============ commit 277cb442e3c76e578418c96df708656574789246 Author: Randy Barlow <randy(a)electronsweatshop.com> Date: Tue Nov 26 14:49:58 2019 -0500 Bring mqtree back to s390x (#1772970) Signed-off-by: Randy Barlow <randy(a)electronsweatshop.com> diff --git a/erlang-mqtree.spec b/erlang-mqtree.spec index de68a24..a4a12e2 100644 --- a/erlang-mqtree.spec +++ b/erlang-mqtree.spec @@ -5,7 +5,7 @@ Name: erlang-%{srcname} Version: 1.0.5 -Release: 1%{?dist} +Release: 2%{?dist} # c_src/uthash.h is unspecified BSD License: ASL 2.0 and BSD @@ -13,9 +13,6 @@ Summary: Index tree for MQTT topic filters URL: https://github.com/processone/mqtree/ Source0: %{url}/archive/%{version}/%{srcname}-%{version}.tar.gz -# Remove this when https://bugzilla.redhat.com/show_bug.cgi?id=1770256 is resolved -ExcludeArch: s390x - BuildRequires: erlang-p1_utils >= %{p1_utils_ver} BuildRequires: erlang-rebar BuildRequires: gcc @@ -54,6 +51,9 @@ install -pm755 priv/lib/* %{buildroot}%{_erllibdir}/%{srcname}-%{version}/priv/l %changelog +* Tue Nov 26 2019 Randy Barlow <bowlofeggs(a)fedoraproject.org> - 1.0.5-2 +- Bring mqtree back to s390x (#1772970). + * Thu Nov 14 2019 Randy Barlow <bowlofeggs(a)fedoraproject.org> - 1.0.5-1 - Update to 1.0.5 (#1742469) - https://github.com/processone/mqtree/compare/1.0.3...1.0.5

1 0

Architecture specific change in rpms/erlang-fast_yaml.git
by githook-noreply＠fedoraproject.org 26 Nov '19

26 Nov '19

The package rpms/erlang-fast_yaml.git has added or updated architecture specific content in its spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s): https://src.fedoraproject.org/cgit/rpms/erlang-fast_yaml.git/commit/?id=9ad…. Change: -ExcludeArch: s390x Thanks. Full change: ============ commit 9ada048d575f6a09fab441047416fb7c2a066d6a Author: Randy Barlow <randy(a)electronsweatshop.com> Date: Tue Nov 26 14:48:48 2019 -0500 Bring fast_yaml back to s390x (#1772969) Signed-off-by: Randy Barlow <randy(a)electronsweatshop.com> diff --git a/erlang-fast_yaml.spec b/erlang-fast_yaml.spec index 8e4d37b..6676f4b 100644 --- a/erlang-fast_yaml.spec +++ b/erlang-fast_yaml.spec @@ -4,16 +4,13 @@ Name: erlang-%{srcname} Version: 1.0.21 -Release: 1%{?dist} +Release: 2%{?dist} License: ASL 2.0 Summary: An Erlang wrapper for libyaml "C" library URL: https://github.com/processone/fast_yaml/ Source0: https://github.com/processone/%{srcname}/archive/%{version}/%{srcname}-%{ve… -# Remove this when https://bugzilla.redhat.com/show_bug.cgi?id=1770256 is resolved -ExcludeArch: s390x - Provides: erlang-p1_yaml = %{version}-%{release} Obsoletes: erlang-p1_yaml < 1.0.2 @@ -57,6 +54,9 @@ install -pm755 priv/lib/* $RPM_BUILD_ROOT%{_libdir}/erlang/lib/%{srcname}-%{vers %changelog +* Tue Nov 26 2019 Randy Barlow <bowlofeggs(a)fedoraproject.org> - 1.0.21-2 +- Bring fast_yaml back to s390x (#1772969). + * Thu Nov 14 2019 Randy Barlow <bowlofeggs(a)fedoraproject.org> - 1.0.21-1 - Update to 1.0.21 (1742455). - https://github.com/processone/fast_yaml/blob/1.0.20/CHANGELOG.md

1 0

Architecture specific change in rpms/erlang-fast_xml.git
by githook-noreply＠fedoraproject.org 26 Nov '19

26 Nov '19

The package rpms/erlang-fast_xml.git has added or updated architecture specific content in its spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s): https://src.fedoraproject.org/cgit/rpms/erlang-fast_xml.git/commit/?id=431a…. Change: -ExcludeArch: s390x Thanks. Full change: ============ commit 431a54263fd3d04abee40f0e6c760a2a1437779a Author: Randy Barlow <randy(a)electronsweatshop.com> Date: Tue Nov 26 14:47:08 2019 -0500 Bring fast_xml back to s390x (#1772968) Signed-off-by: Randy Barlow <randy(a)electronsweatshop.com> diff --git a/erlang-fast_xml.spec b/erlang-fast_xml.spec index 3736e40..ab5f9d3 100644 --- a/erlang-fast_xml.spec +++ b/erlang-fast_xml.spec @@ -4,16 +4,13 @@ Name: erlang-%{srcname} Version: 1.1.37 -Release: 1%{?dist} +Release: 2%{?dist} License: ASL 2.0 Summary: Fast Expat based Erlang XML parsing and manipulation library URL: https://github.com/processone/fast_xml/ Source0: https://github.com/processone/fast_xml/archive/%{version}/%{srcname}-%{vers… -# Remove this when https://bugzilla.redhat.com/show_bug.cgi?id=1770256 is resolved -ExcludeArch: s390x - Provides: erlang-p1_xml = %{version}-%{release} Obsoletes: erlang-p1_xml < 1.1.11 @@ -61,6 +58,9 @@ install -p -D -m 755 priv/lib/* --target-directory=$RPM_BUILD_ROOT%{_erllibdir}/ %changelog +* Tue Nov 26 2019 Randy Barlow <bowlofeggs(a)fedoraproject.org> - 1.1.37-2 +- Bring fast_xml back to s390x (#1772968). + * Thu Nov 14 2019 Randy Barlow <bowlofeggs(a)fedoraproject.org> - 1.1.37-1 - Update to 1.1.37 (#1742456). - https://github.com/processone/fast_xml/blob/1.1.37/CHANGELOG.md

1 0

Architecture specific change in rpms/xen.git
by githook-noreply＠fedoraproject.org 26 Nov '19

26 Nov '19

The package rpms/xen.git has added or updated architecture specific content in its spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s): https://src.fedoraproject.org/cgit/rpms/xen.git/commit/?id=b6c6fc0ef1b06d51…. Change: +%ifarch %{ix86} x86_64 Thanks. Full change: ============ commit b6c6fc0ef1b06d51f99d184f9c00ad575420ce85 Author: Michael Young <m.a.young(a)durham.ac.uk> Date: Tue Nov 26 18:34:05 2019 +0000 Device quarantine for alternate pci assignment methods [XSA-306] diff --git a/xen.spec b/xen.spec index 5e7cb22..7009a35 100644 --- a/xen.spec +++ b/xen.spec @@ -58,7 +58,7 @@ Summary: Xen is a virtual machine monitor Name: xen Version: 4.12.1 -Release: 6%{?dist} +Release: 7%{?dist} License: GPLv2+ and LGPLv2+ and BSD URL: http://xen.org/ Source0: https://downloads.xenproject.org/release/xen/%{version}/xen-%{version}.tar.… @@ -141,6 +141,7 @@ Patch78: xsa304-4.12-2.patch Patch79: xsa304-4.12-3.patch Patch80: xsa305-4.12-1.patch Patch81: xsa305-4.12-2.patch +Patch82: xsa306-4.12.patch %if %build_qemutrad @@ -368,6 +369,9 @@ manage Xen virtual machines. %patch79 -p1 %patch80 -p1 %patch81 -p1 +%ifarch %{ix86} x86_64 +%patch82 -p1 +%endif # qemu-xen-traditional patches pushd tools/qemu-xen-traditional @@ -931,6 +935,9 @@ fi %endif %changelog +* Tue Nov 26 2019 Michael Young <m.a.young(a)durham.ac.uk> - 4.12.1-7 +- Device quarantine for alternate pci assignment methods [XSA-306] + * Tue Nov 12 2019 Michael Young <m.a.young(a)durham.ac.uk> - 4.12.1-6 - add missing XSA-299 patches diff --git a/xsa306-4.12.patch b/xsa306-4.12.patch new file mode 100644 index 0000000..13147b5 --- /dev/null +++ b/xsa306-4.12.patch @@ -0,0 +1,91 @@ +From: Jan Beulich <jbeulich(a)suse.com> +Subject: IOMMU: default to always quarantining PCI devices + +XSA-302 relies on the use of libxl's "assignable-add" feature to prepare +devices to be assigned to untrusted guests. + +Unfortunately, this is not considered a strictly required step for +device assignment. The PCI passthrough documentation on the wiki +describes alternate ways of preparing devices for assignment, and +libvirt uses its own ways as well. Hosts where these alternate methods +are used will still leave the system in a vulnerable state after the +device comes back from a guest. + +Default to always quarantining PCI devices, but provide a command line +option to revert back to prior behavior (such that people who both +sufficiently trust their guests and want to be able to use devices in +Dom0 again after they had been in use by a guest wouldn't need to +"manually" move such devices back from DomIO to Dom0). + +This is XSA-306. + +Reported-by: Marek Marczykowski-Grecki <marmarek(a)invisiblethingslab.com> +Signed-off-by: Jan Beulich <jbeulich(a)suse.com> +Reviewed-by: Wei Liu <wl(a)xen.org> + +--- a/docs/misc/xen-command-line.pandoc ++++ b/docs/misc/xen-command-line.pandoc +@@ -1171,7 +1171,7 @@ detection of systems known to misbehave + > Default: `new` unless directed-EOI is supported + + ### iommu +- = List of [ <bool>, verbose, debug, force, required, ++ = List of [ <bool>, verbose, debug, force, required, quarantine, + sharept, intremap, intpost, crash-disable, + snoop, qinval, igfx, amd-iommu-perdev-intremap, + dom0-{passthrough,strict} ] +@@ -1209,6 +1209,12 @@ boolean (e.g. `iommu=no`) can override t + will prevent Xen from booting if IOMMUs aren't discovered and enabled + successfully. + ++* The `quarantine` boolean can be used to control Xen's behavior when ++ de-assigning devices from guests. If enabled (the default), Xen always ++ quarantines such devices; they must be explicitly assigned back to Dom0 ++ before they can be used there again. If disabled, Xen will only ++ quarantine devices the toolstack hass arranged for getting quarantined. ++ + * The `sharept` boolean controls whether the IOMMU pagetables are shared + with the CPU-side HAP pagetables, or allocated separately. Sharing + reduces the memory overhead, but doesn't work in combination with CPU-side +--- a/xen/drivers/passthrough/iommu.c ++++ b/xen/drivers/passthrough/iommu.c +@@ -30,6 +30,7 @@ bool_t __initdata iommu_enable = 1; + bool_t __read_mostly iommu_enabled; + bool_t __read_mostly force_iommu; + bool_t __read_mostly iommu_verbose; ++bool __read_mostly iommu_quarantine = true; + bool_t __read_mostly iommu_igfx = 1; + bool_t __read_mostly iommu_snoop = 1; + bool_t __read_mostly iommu_qinval = 1; +@@ -74,6 +75,8 @@ static int __init parse_iommu_param(cons + else if ( (val = parse_boolean("force", s, ss)) >= 0 || + (val = parse_boolean("required", s, ss)) >= 0 ) + force_iommu = val; ++ else if ( (val = parse_boolean("quarantine", s, ss)) >= 0 ) ++ iommu_quarantine = val; + else if ( (val = parse_boolean("igfx", s, ss)) >= 0 ) + iommu_igfx = val; + else if ( (val = parse_boolean("verbose", s, ss)) >= 0 ) +--- a/xen/drivers/passthrough/pci.c ++++ b/xen/drivers/passthrough/pci.c +@@ -1548,7 +1548,8 @@ int deassign_device(struct domain *d, u1 + return -ENODEV; + + /* De-assignment from dom_io should de-quarantine the device */ +- target = (pdev->quarantine && pdev->domain != dom_io) ? ++ target = ((pdev->quarantine || iommu_quarantine) && ++ pdev->domain != dom_io) ? + dom_io : hardware_domain; + + while ( pdev->phantom_stride ) +--- a/xen/include/xen/iommu.h ++++ b/xen/include/xen/iommu.h +@@ -53,7 +53,7 @@ static inline bool_t dfn_eq(dfn_t x, dfn + } + + extern bool_t iommu_enable, iommu_enabled; +-extern bool_t force_iommu, iommu_verbose, iommu_igfx; ++extern bool force_iommu, iommu_quarantine, iommu_verbose, iommu_igfx; + extern bool_t iommu_snoop, iommu_qinval, iommu_intremap, iommu_intpost; + extern bool_t iommu_hap_pt_share; + extern bool_t iommu_debug;

1 0

Architecture specific change in rpms/erlang-fast_tls.git
by githook-noreply＠fedoraproject.org 26 Nov '19

26 Nov '19

The package rpms/erlang-fast_tls.git has added or updated architecture specific content in its spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s): https://src.fedoraproject.org/cgit/rpms/erlang-fast_tls.git/commit/?id=a0fa…. Change: -ExcludeArch: s390x Thanks. Full change: ============ commit a0fa9bcc8b039ac3a13b1bc447b61c4d4b383e2f Author: Randy Barlow <randy(a)electronsweatshop.com> Date: Tue Nov 26 14:00:12 2019 -0500 Bring fast_tls back to s390x (#1772967) Signed-off-by: Randy Barlow <randy(a)electronsweatshop.com> diff --git a/erlang-fast_tls.spec b/erlang-fast_tls.spec index 2eabe49..745a70c 100644 --- a/erlang-fast_tls.spec +++ b/erlang-fast_tls.spec @@ -4,7 +4,7 @@ Name: erlang-%{srcname} Version: 1.1.2 -Release: 1%{?dist} +Release: 2%{?dist} License: ASL 2.0 Summary: TLS / SSL native driver for Erlang / Elixir @@ -14,9 +14,6 @@ Source0: https://github.com/processone/%{srcname}/archive/%{version}/fast_tls-%{ # https://fedoraproject.org/wiki/Packaging:CryptoPolicies Patch0: 0000-Use-the-system-ciphers-by-default.patch -# Remove this when https://bugzilla.redhat.com/show_bug.cgi?id=1770256 is resolved -ExcludeArch: s390x - Provides: erlang-p1_tls = %{version}-%{release} Obsoletes: erlang-p1_tls < 1.0.1 @@ -59,6 +56,9 @@ install -pm755 priv/lib/* $RPM_BUILD_ROOT%{_erllibdir}/%{srcname}-%{version}/pri %changelog +* Tue Nov 26 2019 Randy Barlow <bowlofeggs(a)fedoraproject.org> - 1.1.2-2 +- Bring fast_tls back to s390x (#1772967). + * Thu Nov 14 2019 Randy Barlow <bowlofeggs(a)fedoraproject.org> - 1.1.2-1 - Update to 1.1.2 (#1742457). - https://github.com/processone/fast_tls/blob/1.1.2/CHANGELOG.md

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Arch-excludes November 2019