Plugins: Support nested plugin signature validation on Windows (#79467)

* rework

* fix

* fix backend start

* fix tests

* fix

* print env

* enable CGO

* undo changes

* undo whitespace change

pkg/plugins/manager/loader/finder/local.go

@@ -7,7 +7,6 @@ import (
 	"io"
 	"os"
 	"path/filepath"
-	"runtime"
 	"strings"
 
 	"github.com/grafana/grafana/pkg/infra/fs"
@@ -111,28 +110,34 @@ func (l *Local) Find(ctx context.Context, src plugins.PluginSource) ([]*plugins.
 		}
 	}
 
-	result := make([]*plugins.FoundBundle, 0, len(foundPlugins))
+	// Track child plugins and add them to their parent.
-	for dir := range foundPlugins {
+	childPlugins := make(map[string]struct{})
-		ancestors := strings.Split(dir, string(filepath.Separator))
+	for dir, p := range res {
-		ancestors = ancestors[0 : len(ancestors)-1]
+		// Check if this plugin is the parent of another plugin.
+		for dir2, p2 := range res {
+			if dir == dir2 {
+				continue
+			}
 
-		pluginPath := ""
+			relPath, err := filepath.Rel(dir, dir2)
-		if runtime.GOOS != "windows" && filepath.IsAbs(dir) {
+			if err != nil {
-			pluginPath = "/"
+				l.log.Error("Cannot calculate relative path. Skipping", "pluginId", p2.Primary.JSONData.ID, "err", err)
-		}
+				continue
-		add := true
+			}
-		for _, ancestor := range ancestors {
+			if !strings.Contains(relPath, "..") {
-			pluginPath = filepath.Join(pluginPath, ancestor)
+				child := p2.Primary
-			if _, ok := foundPlugins[pluginPath]; ok {
+				l.log.Debug("Adding child", "parent", p.Primary.JSONData.ID, "child", child.JSONData.ID, "relPath", relPath)
-				if fp, exists := res[pluginPath]; exists {
+				p.Children = append(p.Children, &child)
-					fp.Children = append(fp.Children, &res[dir].Primary)
+				childPlugins[dir2] = struct{}{}
-					add = false
-					break
-				}
 			}
 		}
-		if add {
+	}
-			result = append(result, res[dir])
+
+	// Remove child plugins from the result (they are already tracked via their parent).
+	result := make([]*plugins.FoundBundle, 0, len(res))
+	for k := range res {
+		if _, ok := childPlugins[k]; !ok {
+			result = append(result, res[k])
 		}
 	}