IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

Signing: allow unsigned plugin in dev mode (#24242)

Browse Source
This commit is contained in:
Ryan McKinley 2020-05-04 11:57:11 -07:00 committed by GitHub
parent 83683d87f8
commit 3487e518ab
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 28 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
pkg/plugins/plugins.go
View File

@ -282,26 +282,32 @@ func (scanner *PluginScanner) loadPlugin(pluginJsonFilePath string) error {
pluginCommon.PluginDir = filepath.Dir(pluginJsonFilePath)
// For the time being, we choose to only require back-end plugins to be signed
// NOTE: the state is calculated again for when setting metadata on the object
if pluginCommon.Backend && scanner.requireSigned {
scanner.log.Debug("Plugin signature required, validating", "pluginID", pluginCommon.Id,
"pluginDir", pluginCommon.PluginDir)
allowUnsigned := false
for _, plug := range scanner.cfg.PluginsAllowUnsigned {
if plug == pluginCommon.Id {
allowUnsigned = true
break
}
}
if sig := GetPluginSignatureState(&pluginCommon); sig != PluginSignatureValid && !allowUnsigned {
switch sig {
case PluginSignatureUnsigned:
return fmt.Errorf("plugin %q is unsigned", pluginCommon.Id)
case PluginSignatureInvalid:
return fmt.Errorf("plugin %q has an invalid signature", pluginCommon.Id)
case PluginSignatureModified:
return fmt.Errorf("plugin %q's signature has been modified", pluginCommon.Id)
default:
return fmt.Errorf("unrecognized plugin signature state %v", sig)
sig := GetPluginSignatureState(&pluginCommon)
if sig != PluginSignatureValid {
scanner.log.Debug("Invalid Plugin Signature", "pluginID", pluginCommon.Id, "pluginDir", pluginCommon.PluginDir, "state", sig)
if sig == PluginSignatureUnsigned {
allowUnsigned := false
for _, plug := range scanner.cfg.PluginsAllowUnsigned {
if plug == pluginCommon.Id {
allowUnsigned = true
break
}
}
if setting.Env != setting.DEV && !allowUnsigned {
return fmt.Errorf("plugin %q is unsigned", pluginCommon.Id)
}
scanner.log.Warn("Running an unsigned backend plugin", "pluginID", pluginCommon.Id, "pluginDir", pluginCommon.PluginDir)
} else {
switch sig {
case PluginSignatureInvalid:
return fmt.Errorf("plugin %q has an invalid signature", pluginCommon.Id)
case PluginSignatureModified:
return fmt.Errorf("plugin %q's signature has been modified", pluginCommon.Id)
default:
return fmt.Errorf("unrecognized plugin signature state %v", sig)
}
}
}
}

3
pkg/plugins/plugins_test.go
View File

@ -18,15 +18,18 @@ import (
func TestPluginManager_Init(t *testing.T) {
origRootPath := setting.StaticRootPath
origRaw := setting.Raw
origEnv := setting.Env
t.Cleanup(func() {
setting.StaticRootPath = origRootPath
setting.Raw = origRaw
setting.Env = origEnv
})
var err error
setting.StaticRootPath, err = filepath.Abs("../../public/")
require.NoError(t, err)
setting.Raw = ini.Empty()
setting.Env = setting.PROD
t.Run("Base case", func(t *testing.T) {
pm := &PluginManager{