move module hash

2026-01-14 15:38:46 +00:00
parent c1a46fdcb5
commit 6a955eb6d1
33 changed files with 668 additions and 123 deletions
@@ -2,19 +2,16 @@ package pluginassets

 import (
 	"context"
-	"encoding/base64"
-	"encoding/hex"
-	"fmt"
-	"path"
-	"path/filepath"
-	"sync"

 	"github.com/Masterminds/semver/v3"

 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/plugins"
 	"github.com/grafana/grafana/pkg/plugins/config"
+	"github.com/grafana/grafana/pkg/plugins/manager/registry"
 	"github.com/grafana/grafana/pkg/plugins/manager/signature"
+	"github.com/grafana/grafana/pkg/plugins/pluginassets"
+	"github.com/grafana/grafana/pkg/plugins/pluginassets/modulehash"
 	"github.com/grafana/grafana/pkg/plugins/pluginscdn"
 	"github.com/grafana/grafana/pkg/services/pluginsintegration/pluginstore"
 )
@@ -28,24 +25,27 @@ var (
 	scriptLoadingMinSupportedVersion = semver.MustParse(CreatePluginVersionScriptSupportEnabled)
 )

-func ProvideService(cfg *config.PluginManagementCfg, cdn *pluginscdn.Service, sig *signature.Signature, store pluginstore.Store) *Service {
+func ProvideService(cfg *config.PluginManagementCfg, cdn *pluginscdn.Service,
+	calc *modulehash.ModuleHashCalculator) *Service {
 	return &Service{
-		cfg:       cfg,
-		cdn:       cdn,
-		signature: sig,
-		store:     store,
-		log:       log.New("pluginassets"),
+		cfg:  cfg,
+		cdn:  cdn,
+		log:  log.New("pluginassets"),
+		calc: calc,
 	}
 }

-type Service struct {
-	cfg       *config.PluginManagementCfg
-	cdn       *pluginscdn.Service
-	signature *signature.Signature
-	store     pluginstore.Store
-	log       log.Logger
+func ProvideModuleHashCalculator(cfg *config.PluginManagementCfg, cdn *pluginscdn.Service,
+	signature *signature.Signature, reg registry.Service) *modulehash.ModuleHashCalculator {
+	return modulehash.NewModuleHashCalculator(cfg, reg, cdn, signature)
+}

-	moduleHashCache sync.Map
+type Service struct {
+	cfg  *config.PluginManagementCfg
+	cdn  *pluginscdn.Service
+	calc *modulehash.ModuleHashCalculator
+
+	log log.Logger
 }

 // LoadingStrategy calculates the loading strategy for a plugin.
@@ -83,92 +83,8 @@ func (s *Service) LoadingStrategy(_ context.Context, p pluginstore.Plugin) plugi
 }

 // ModuleHash returns the module.js SHA256 hash for a plugin in the format expected by the browser for SRI checks.
-// The module hash is read from the plugin's MANIFEST.txt file.
-// The plugin can also be a nested plugin.
-// If the plugin is unsigned, an empty string is returned.
-// The results are cached to avoid repeated reads from the MANIFEST.txt file.
 func (s *Service) ModuleHash(ctx context.Context, p pluginstore.Plugin) string {
-	k := s.moduleHashCacheKey(p)
-	cachedValue, ok := s.moduleHashCache.Load(k)
-	if ok {
-		return cachedValue.(string)
-	}
-	mh, err := s.moduleHash(ctx, p, "")
-	if err != nil {
-		s.log.Error("Failed to calculate module hash", "plugin", p.ID, "error", err)
-	}
-	s.moduleHashCache.Store(k, mh)
-	return mh
-}
-
-// moduleHash is the underlying function for ModuleHash. See its documentation for more information.
-// If the plugin is not a CDN plugin, the function will return an empty string.
-// It will read the module hash from the MANIFEST.txt in the [[plugins.FS]] of the provided plugin.
-// If childFSBase is provided, the function will try to get the hash from MANIFEST.txt for the provided children's
-// module.js file, rather than for the provided plugin.
-func (s *Service) moduleHash(ctx context.Context, p pluginstore.Plugin, childFSBase string) (r string, err error) {
-	if !s.cfg.Features.SriChecksEnabled {
-		return "", nil
-	}
-
-	// Ignore unsigned plugins
-	if !p.Signature.IsValid() {
-		return "", nil
-	}
-
-	if p.Parent != nil {
-		// Nested plugin
-		parent, ok := s.store.Plugin(ctx, p.Parent.ID)
-		if !ok {
-			return "", fmt.Errorf("parent plugin plugin %q for child plugin %q not found", p.Parent.ID, p.ID)
-		}
-
-		// The module hash is contained within the parent's MANIFEST.txt file.
-		// For example, the parent's MANIFEST.txt will contain an entry similar to this:
-		//
-		// ```
-		// "datasource/module.js": "1234567890abcdef..."
-		// ```
-		//
-		// Recursively call moduleHash with the parent plugin and with the children plugin folder path
-		// to get the correct module hash for the nested plugin.
-		if childFSBase == "" {
-			childFSBase = p.Base()
-		}
-		return s.moduleHash(ctx, parent, childFSBase)
-	}
-
-	// Only CDN plugins are supported for SRI checks.
-	// CDN plugins have the version as part of the URL, which acts as a cache-buster.
-	// Needed due to: https://github.com/grafana/plugin-tools/pull/1426
-	// FS plugins build before this change will have SRI mismatch issues.
-	if !s.cdnEnabled(p.ID, p.FS) {
-		return "", nil
-	}
-
-	manifest, err := s.signature.ReadPluginManifestFromFS(ctx, p.FS)
-	if err != nil {
-		return "", fmt.Errorf("read plugin manifest: %w", err)
-	}
-	if !manifest.IsV2() {
-		return "", nil
-	}
-
-	var childPath string
-	if childFSBase != "" {
-		// Calculate the relative path of the child plugin folder from the parent plugin folder.
-		childPath, err = p.FS.Rel(childFSBase)
-		if err != nil {
-			return "", fmt.Errorf("rel path: %w", err)
-		}
-		// MANIFETS.txt uses forward slashes as path separators.
-		childPath = filepath.ToSlash(childPath)
-	}
-	moduleHash, ok := manifest.Files[path.Join(childPath, "module.js")]
-	if !ok {
-		return "", nil
-	}
-	return convertHashForSRI(moduleHash)
+	return s.calc.ModuleHash(ctx, p.ID, p.Info.Version)
 }

 func (s *Service) compatibleCreatePluginVersion(ps map[string]string) bool {
@@ -188,17 +104,3 @@ func (s *Service) compatibleCreatePluginVersion(ps map[string]string) bool {
 func (s *Service) cdnEnabled(pluginID string, fs plugins.FS) bool {
 	return s.cdn.PluginSupported(pluginID) || fs.Type().CDN()
 }
-
-// convertHashForSRI takes a SHA256 hash string and returns it as expected by the browser for SRI checks.
-func convertHashForSRI(h string) (string, error) {
-	hb, err := hex.DecodeString(h)
-	if err != nil {
-		return "", fmt.Errorf("hex decode string: %w", err)
-	}
-	return "sha256-" + base64.StdEncoding.EncodeToString(hb), nil
-}
-
-// moduleHashCacheKey returns a unique key for the module hash cache.
-func (s *Service) moduleHashCacheKey(p pluginstore.Plugin) string {
-	return p.ID + ":" + p.Info.Version
-}
@@ -1 +0,0 @@
-hello parent
@@ -1,15 +0,0 @@
-{
-  "type": "app",
-  "name": "Test",
-  "id": "test-app",
-  "backend": true,
-  "executable": "test",
-  "state": "alpha",
-  "info": {
-    "version": "1.0.0",
-    "description": "Test",
-    "author": {
-      "name": "Giuseppe Guerra"
-    }
-  }
-}
@@ -1,29 +0,0 @@
-
-----BEGIN PGP SIGNED MESSAGE-----
-Hash: SHA512
-
-{
-  "manifestVersion": "2.0.0",
-  "signatureType": "grafana",
-  "signedByOrg": "grafana",
-  "signedByOrgName": "Grafana Labs",
-  "plugin": "test-app",
-  "version": "1.0.0",
-  "time": 1726230812215,
-  "keyId": "7e4d0c6a708866e7",
-  "files": {
-    "plugin.json": "31f04aceb2a9b14c2e501f38a4de5ab1c7a3e7306f58353fa5c1a86b716c971c",
-    "something.js": "266c19bc148b22ddef2a288fc5f8f40855bda22ccf60be53340b4931e469ae2a"
-  }
-}
-----BEGIN PGP SIGNATURE-----
-Version: OpenPGP.js v4.10.11
-Comment: https://openpgpjs.org
-
-wrkEARMKAAYFAmbkMRwAIQkQfk0ManCIZucWIQTzOyW2kQdOhGNlcPN+TQxq
-cIhm53UWAgkBE2oxqyzBji86eCOzLmCT7IgQaoSMMF48tu+XdgwFS5/NU5su
-deKad3taDnSU9a7GkCaisRVQOWy/UtFS1FNQTtkCCQBc1cZ6JsPWh2Pd60h0
-9U5aviYde6g1DCKO1riaUzHzrruBiHmHWjzr2aYwACb89vs2XcZqvue1Byb+
-y2inBDhHvQ==
-=qMej
-----END PGP SIGNATURE-----
@@ -1,15 +0,0 @@
-{
-  "type": "app",
-  "name": "Test",
-  "id": "test-app",
-  "backend": true,
-  "executable": "test",
-  "state": "alpha",
-  "info": {
-    "version": "1.0.0",
-    "description": "Test",
-    "author": {
-      "name": "Giuseppe Guerra"
-    }
-  }
-}
@@ -1 +0,0 @@
-hello parent
@@ -1,33 +0,0 @@
-
-----BEGIN PGP SIGNED MESSAGE-----
-Hash: SHA512
-
-{
-  "manifestVersion": "2.0.0",
-  "signatureType": "grafana",
-  "signedByOrg": "grafana",
-  "signedByOrgName": "Grafana Labs",
-  "plugin": "test-app",
-  "version": "1.0.0",
-  "time": 1726234125061,
-  "keyId": "7e4d0c6a708866e7",
-  "files": {
-    "datasource/module.js": "04d70db091d96c4775fb32ba5a8f84cc22893eb43afdb649726661d4425c6711",
-    "datasource/plugin.json": "3fd712717a21617cc76f9043efcd43d4ebf5564dd155a28e4e3c736739f6931e",
-    "datasource/panels/one/module.js": "cbd1ac2284645a0e1e9a8722a729f5bcdd2b831222728709c6360beecdd6143f",
-    "datasource/panels/one/plugin.json": "b9b4556a7220ea77650ffd228da6d441e68df3405d50dab5773c10f4afae5ad3",
-    "module.js": "266c19bc148b22ddef2a288fc5f8f40855bda22ccf60be53340b4931e469ae2a",
-    "plugin.json": "31f04aceb2a9b14c2e501f38a4de5ab1c7a3e7306f58353fa5c1a86b716c971c"
-  }
-}
-----BEGIN PGP SIGNATURE-----
-Version: OpenPGP.js v4.10.11
-Comment: https://openpgpjs.org
-
-wrkEARMKAAYFAmbkPg0AIQkQfk0ManCIZucWIQTzOyW2kQdOhGNlcPN+TQxq
-cIhm5xTlAgkB3mG37KEdlP34nC69NbmriMpDH6PyyJ0IUwXB/SMTr4Gc2SvG
-cVHvih/0WqVjYKxxQI0QHoYpBQW2jPx0YJLFof8CCQBHpdEEXNTYOOZWG6Cg
-M3wB3AdCO+ChjXkKosbWqiMDfVqHFoLoLurwWxwOjvk/xTvX5GFbOxSfISyU
-8iW03F5/Sw==
-=wobV
-----END PGP SIGNATURE-----
@@ -1 +0,0 @@
-hello datasource
@@ -1 +0,0 @@
-hello panel
@@ -1,13 +0,0 @@
-{
-  "type": "panel",
-  "name": "Test Panel",
-  "id": "test-panel",
-  "state": "alpha",
-  "info": {
-    "version": "1.0.0",
-    "description": "Test",
-    "author": {
-      "name": "Giuseppe Guerra"
-    }
-  }
-}
@@ -1,15 +0,0 @@
-{
-  "type": "datasource",
-  "name": "Test Datasource",
-  "id": "test-datasource",
-  "backend": true,
-  "executable": "test",
-  "state": "alpha",
-  "info": {
-    "version": "1.0.0",
-    "description": "Test",
-    "author": {
-      "name": "Giuseppe Guerra"
-    }
-  }
-}
@@ -1 +0,0 @@
-hello parent
@@ -1,15 +0,0 @@
-{
-  "type": "app",
-  "name": "Test",
-  "id": "test-app",
-  "backend": true,
-  "executable": "test",
-  "state": "alpha",
-  "info": {
-    "version": "1.0.0",
-    "description": "Test",
-    "author": {
-      "name": "Giuseppe Guerra"
-    }
-  }
-}
@@ -1,33 +0,0 @@
-
-----BEGIN PGP SIGNED MESSAGE-----
-Hash: SHA512
-
-{
-  "manifestVersion": "2.0.0",
-  "signatureType": "grafana",
-  "signedByOrg": "grafana",
-  "signedByOrgName": "Grafana Labs",
-  "plugin": "test-app",
-  "version": "1.0.0",
-  "time": 1726230803822,
-  "keyId": "7e4d0c6a708866e7",
-  "files": {
-    "module.js": "266c19bc148b22ddef2a288fc5f8f40855bda22ccf60be53340b4931e469ae2a",
-    "plugin.json": "31f04aceb2a9b14c2e501f38a4de5ab1c7a3e7306f58353fa5c1a86b716c971c",
-    "datasource/module.js": "04d70db091d96c4775fb32ba5a8f84cc22893eb43afdb649726661d4425c6711",
-    "datasource/plugin.json": "3fd712717a21617cc76f9043efcd43d4ebf5564dd155a28e4e3c736739f6931e",
-    "panels/one/module.js": "cbd1ac2284645a0e1e9a8722a729f5bcdd2b831222728709c6360beecdd6143f",
-    "panels/one/plugin.json": "b9b4556a7220ea77650ffd228da6d441e68df3405d50dab5773c10f4afae5ad3"
-  }
-}
-----BEGIN PGP SIGNATURE-----
-Version: OpenPGP.js v4.10.11
-Comment: https://openpgpjs.org
-
-wrkEARMKAAYFAmbkMRQAIQkQfk0ManCIZucWIQTzOyW2kQdOhGNlcPN+TQxq
-cIhm50C8AgkAmzQpeYPnCgYimLGp5UGnCTrkbUEEqW+qXESrhi5T5ZuM+SzT
-BcRlC5pP6+wuyXAIdfppzWQ/umkkoaTIuub0TXQCCQHVcpWKy4acRL9TlORQ
-1VzVEV9PW0+x606HsDDHkterKQZgr5X6I/sTbSpBDMWPCMxqAk9fZn3G4iuq
-MyS+hwUZDQ==
-=7/Rd
-----END PGP SIGNATURE-----
@@ -1 +0,0 @@
-hello datasource
@@ -1,15 +0,0 @@
-{
-  "type": "datasource",
-  "name": "Test Datasource",
-  "id": "test-datasource",
-  "backend": true,
-  "executable": "test",
-  "state": "alpha",
-  "info": {
-    "version": "1.0.0",
-    "description": "Test",
-    "author": {
-      "name": "Giuseppe Guerra"
-    }
-  }
-}
@@ -1 +0,0 @@
-hello parent
@@ -1 +0,0 @@
-hello panel
@@ -1,13 +0,0 @@
-{
-  "type": "panel",
-  "name": "Test Panel",
-  "id": "test-panel",
-  "state": "alpha",
-  "info": {
-    "version": "1.0.0",
-    "description": "Test",
-    "author": {
-      "name": "Giuseppe Guerra"
-    }
-  }
-}
@@ -1,15 +0,0 @@
-{
-  "type": "app",
-  "name": "Test",
-  "id": "test-app",
-  "backend": true,
-  "executable": "test",
-  "state": "alpha",
-  "info": {
-    "version": "1.0.0",
-    "description": "Test",
-    "author": {
-      "name": "Giuseppe Guerra"
-    }
-  }
-}
@@ -1,32 +0,0 @@
-
-----BEGIN PGP SIGNED MESSAGE-----
-Hash: SHA512
-
-{
-  "manifestVersion": "2.0.0",
-  "signatureType": "private",
-  "signedByOrg": "giuseppeguerra",
-  "signedByOrgName": "giuseppeguerra",
-  "rootUrls": [
-    "http://127.0.0.1:3000/"
-  ],
-  "plugin": "test-datasource",
-  "version": "1.0.0",
-  "time": 1725959570435,
-  "keyId": "7e4d0c6a708866e7",
-  "files": {
-    "module.js": "5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03",
-    "plugin.json": "129fab4e0584d18c778ebdfa5fe1a68edf2e5c5aeb8290b2c68182c857cb59f8"
-  }
-}
-----BEGIN PGP SIGNATURE-----
-Version: OpenPGP.js v4.10.11
-Comment: https://openpgpjs.org
-
-wrkEARMKAAYFAmbgDZIAIQkQfk0ManCIZucWIQTzOyW2kQdOhGNlcPN+TQxq
-cIhm5wbfAgkAXmKJcM8uAKb3TepYW/oyGhRLR8L6eM9mCoYwKkatITKJ6bRe
-Wnz37AMcPx0DahgfCzCXRLo4CspPJylr2JV8DagCCQCfCjHgLFhKGpBP71Y1
-mgcQ1/CJefb6B2H45G25MwUFTlSTGLDqW4QMi2kQvXnnUMjXquv2+iVd6qyz
-0Rqvpou/QQ==
-=QNmr
-----END PGP SIGNATURE-----
@@ -1 +0,0 @@
-hello
@@ -1,15 +0,0 @@
-{
-  "type": "datasource",
-  "name": "Test",
-  "id": "test-datasource",
-  "backend": true,
-  "executable": "test",
-  "state": "alpha",
-  "info": {
-    "version": "1.0.0",
-    "description": "Test",
-    "author": {
-      "name": "Giuseppe Guerra"
-    }
-  }
-}