Plugins: Add module hash field to plugin model (#116119)

* add module hash field to plugin model * fix tests * fix lint issues
2026-01-13 14:35:45 +00:00
parent 86652a6515
commit aa9b587cc1
43 changed files with 767 additions and 620 deletions
@@ -0,0 +1,90 @@
+package pluginassets
+
+import (
+	"encoding/base64"
+	"encoding/hex"
+	"path"
+	"path/filepath"
+
+	"github.com/grafana/grafana/pkg/plugins"
+	"github.com/grafana/grafana/pkg/plugins/config"
+	"github.com/grafana/grafana/pkg/plugins/pluginscdn"
+)
+
+// CalculateModuleHash calculates the module.js SHA256 hash for a plugin in the format expected by the browser for SRI checks.
+// The module hash is read from the plugin's cached manifest.
+// For nested plugins, the module hash is read from the root parent plugin's manifest.
+// If the plugin is unsigned or not a CDN plugin, an empty string is returned.
+func CalculateModuleHash(p *plugins.Plugin, cfg *config.PluginManagementCfg, cdn *pluginscdn.Service) string {
+	if cfg == nil || !cfg.Features.SriChecksEnabled {
+		return ""
+	}
+
+	if !p.Signature.IsValid() {
+		return ""
+	}
+
+	rootParent := findRootParent(p)
+	if rootParent.Manifest == nil {
+		return ""
+	}
+
+	if !rootParent.Manifest.IsV2() {
+		return ""
+	}
+
+	if !cdnEnabled(rootParent, cdn) {
+		return ""
+	}
+
+	modulePath := getModulePathInManifest(p, rootParent)
+	moduleHash, ok := rootParent.Manifest.Files[modulePath]
+	if !ok {
+		return ""
+	}
+
+	return convertHashForSRI(moduleHash)
+}
+
+// findRootParent returns the root parent plugin (the one that contains the manifest).
+// For non-nested plugins, it returns the plugin itself.
+func findRootParent(p *plugins.Plugin) *plugins.Plugin {
+	root := p
+	for root.Parent != nil {
+		root = root.Parent
+	}
+	return root
+}
+
+// getModulePathInManifest returns the path to module.js as it appears in the manifest.
+// For nested plugins, this is the relative path from the root parent to the plugin's module.js.
+// For non-nested plugins, this is simply "module.js".
+func getModulePathInManifest(p *plugins.Plugin, rootParent *plugins.Plugin) string {
+	if p == rootParent {
+		return "module.js"
+	}
+
+	// Calculate the relative path from root parent to this plugin
+	relPath, err := rootParent.FS.Rel(p.FS.Base())
+	if err != nil {
+		return ""
+	}
+
+	// MANIFEST.txt uses forward slashes as path separators
+	pluginRootPath := filepath.ToSlash(relPath)
+	return path.Join(pluginRootPath, "module.js")
+}
+
+// convertHashForSRI takes a SHA256 hash string and returns it as expected by the browser for SRI checks.
+func convertHashForSRI(h string) string {
+	hb, err := hex.DecodeString(h)
+	if err != nil {
+		return ""
+	}
+	return "sha256-" + base64.StdEncoding.EncodeToString(hb)
+}
+
+// cdnEnabled checks if a plugin is loaded via CDN
+func cdnEnabled(p *plugins.Plugin, cdn *pluginscdn.Service) bool {
+	return p.FS.Type().CDN() || cdn.PluginSupported(p.ID)
+}
@@ -0,0 +1,356 @@
+package pluginassets
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/grafana/grafana/pkg/plugins"
+	"github.com/grafana/grafana/pkg/plugins/config"
+	"github.com/grafana/grafana/pkg/plugins/pluginscdn"
+)
+
+func TestConvertHashForSRI(t *testing.T) {
+	for _, tc := range []struct {
+		hash    string
+		expHash string
+		expErr  bool
+	}{
+		{
+			hash:    "ddfcb449445064e6c39f0c20b15be3cb6a55837cf4781df23d02de005f436811",
+			expHash: "sha256-3fy0SURQZObDnwwgsVvjy2pVg3z0eB3yPQLeAF9DaBE=",
+		},
+		{
+			hash:   "not-a-valid-hash",
+			expErr: true,
+		},
+	} {
+		t.Run(tc.hash, func(t *testing.T) {
+			r := convertHashForSRI(tc.hash)
+			if tc.expErr {
+				// convertHashForSRI returns empty string on error
+				require.Empty(t, r)
+			} else {
+				require.Equal(t, tc.expHash, r)
+			}
+		})
+	}
+}
+
+func TestCalculateModuleHash(t *testing.T) {
+	const (
+		pluginID       = "grafana-test-datasource"
+		parentPluginID = "grafana-test-app"
+	)
+
+	// Helper to create a plugin with manifest
+	createPluginWithManifest := func(id string, manifest *plugins.PluginManifest, parent *plugins.Plugin) *plugins.Plugin {
+		p := &plugins.Plugin{
+			JSONData: plugins.JSONData{
+				ID: id,
+			},
+			Signature: plugins.SignatureStatusValid,
+			Manifest:  manifest,
+		}
+		if parent != nil {
+			p.Parent = parent
+		}
+		return p
+	}
+
+	// Helper to create a v2 manifest
+	createV2Manifest := func(files map[string]string) *plugins.PluginManifest {
+		return &plugins.PluginManifest{
+			ManifestVersion: "2.0.0",
+			Files:           files,
+		}
+	}
+
+	for _, tc := range []struct {
+		name          string
+		plugin        *plugins.Plugin
+		cfg           *config.PluginManagementCfg
+		cdn           *pluginscdn.Service
+		expModuleHash string
+	}{
+		{
+			name: "should return empty string when cfg is nil",
+			plugin: createPluginWithManifest(pluginID, createV2Manifest(map[string]string{
+				"module.js": "5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03",
+			}), nil),
+			cfg:           nil,
+			cdn:           nil,
+			expModuleHash: "",
+		},
+		{
+			name: "should return empty string when SRI checks are disabled",
+			plugin: createPluginWithManifest(pluginID, createV2Manifest(map[string]string{
+				"module.js": "5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03",
+			}), nil),
+			cfg:           &config.PluginManagementCfg{Features: config.Features{SriChecksEnabled: false}},
+			cdn:           pluginscdn.ProvideService(&config.PluginManagementCfg{}),
+			expModuleHash: "",
+		},
+		{
+			name: "should return empty string for unsigned plugin",
+			plugin: &plugins.Plugin{
+				JSONData:  plugins.JSONData{ID: pluginID},
+				Signature: plugins.SignatureStatusUnsigned,
+				Manifest:  createV2Manifest(map[string]string{"module.js": "5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03"}),
+				FS:        plugins.NewLocalFS(filepath.Join("testdata", "module-hash-valid")),
+			},
+			cfg:           &config.PluginManagementCfg{Features: config.Features{SriChecksEnabled: true}},
+			cdn:           pluginscdn.ProvideService(&config.PluginManagementCfg{}),
+			expModuleHash: "",
+		},
+		{
+			name: "should return module hash for valid plugin",
+			plugin: &plugins.Plugin{
+				JSONData:  plugins.JSONData{ID: pluginID},
+				Signature: plugins.SignatureStatusValid,
+				Manifest:  createV2Manifest(map[string]string{"module.js": "5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03"}),
+				FS:        plugins.NewLocalFS(filepath.Join("testdata", "module-hash-valid")),
+			},
+			cfg: &config.PluginManagementCfg{
+				PluginsCDNURLTemplate: "https://cdn.example.com",
+				Features:              config.Features{SriChecksEnabled: true},
+				PluginSettings: config.PluginSettings{
+					pluginID: {"cdn": "true"},
+				},
+			},
+			cdn: func() *pluginscdn.Service {
+				cfg := &config.PluginManagementCfg{
+					PluginsCDNURLTemplate: "https://cdn.example.com",
+					PluginSettings: config.PluginSettings{
+						pluginID: {"cdn": "true"},
+					},
+				}
+				return pluginscdn.ProvideService(cfg)
+			}(),
+			expModuleHash: "sha256-WJG1tSLV3whtD/CxEPvZ0hu0/HFjrzTQgoai6Eb2vgM=",
+		},
+		{
+			name: "should return empty string when manifest is nil",
+			plugin: &plugins.Plugin{
+				JSONData:  plugins.JSONData{ID: pluginID},
+				Signature: plugins.SignatureStatusValid,
+				Manifest:  nil,
+				FS:        plugins.NewLocalFS(filepath.Join("testdata", "module-hash-valid")),
+			},
+			cfg:           &config.PluginManagementCfg{Features: config.Features{SriChecksEnabled: true}},
+			cdn:           pluginscdn.ProvideService(&config.PluginManagementCfg{}),
+			expModuleHash: "",
+		},
+		{
+			name: "should return empty string for v1 manifest",
+			plugin: &plugins.Plugin{
+				JSONData:  plugins.JSONData{ID: pluginID},
+				Signature: plugins.SignatureStatusValid,
+				Manifest: &plugins.PluginManifest{
+					ManifestVersion: "1.0.0",
+					Files:           map[string]string{"module.js": "5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03"},
+				},
+				FS: plugins.NewLocalFS(filepath.Join("testdata", "module-hash-valid")),
+			},
+			cfg:           &config.PluginManagementCfg{Features: config.Features{SriChecksEnabled: true}},
+			cdn:           pluginscdn.ProvideService(&config.PluginManagementCfg{}),
+			expModuleHash: "",
+		},
+		{
+			name: "should return empty string when module.js is not in manifest",
+			plugin: &plugins.Plugin{
+				JSONData:  plugins.JSONData{ID: pluginID},
+				Signature: plugins.SignatureStatusValid,
+				Manifest:  createV2Manifest(map[string]string{"plugin.json": "129fab4e0584d18c778ebdfa5fe1a68edf2e5c5aeb8290b2c68182c857cb59f8"}),
+				FS:        plugins.NewLocalFS(filepath.Join("testdata", "module-hash-valid")),
+			},
+			cfg:           &config.PluginManagementCfg{Features: config.Features{SriChecksEnabled: true}},
+			cdn:           pluginscdn.ProvideService(&config.PluginManagementCfg{}),
+			expModuleHash: "",
+		},
+		{
+			name: "missing module.js entry from MANIFEST.txt should not return module hash",
+			plugin: &plugins.Plugin{
+				JSONData:  plugins.JSONData{ID: pluginID},
+				Signature: plugins.SignatureStatusValid,
+				Manifest:  createV2Manifest(map[string]string{"plugin.json": "129fab4e0584d18c778ebdfa5fe1a68edf2e5c5aeb8290b2c68182c857cb59f8"}),
+				FS:        plugins.NewLocalFS(filepath.Join("testdata", "module-hash-no-module-js")),
+			},
+			cfg:           &config.PluginManagementCfg{Features: config.Features{SriChecksEnabled: true}},
+			cdn:           pluginscdn.ProvideService(&config.PluginManagementCfg{}),
+			expModuleHash: "",
+		},
+		{
+			name: "signed status but missing MANIFEST.txt should not return module hash",
+			plugin: &plugins.Plugin{
+				JSONData:  plugins.JSONData{ID: pluginID},
+				Signature: plugins.SignatureStatusValid,
+				Manifest:  nil,
+				FS:        plugins.NewLocalFS(filepath.Join("testdata", "module-hash-no-manifest-txt")),
+			},
+			cfg:           &config.PluginManagementCfg{Features: config.Features{SriChecksEnabled: true}},
+			cdn:           pluginscdn.ProvideService(&config.PluginManagementCfg{}),
+			expModuleHash: "",
+		},
+		{
+			// parentPluginID           (/)
+			// └── pluginID             (/datasource)
+			name: "nested plugin should return module hash from parent MANIFEST.txt",
+			plugin: func() *plugins.Plugin {
+				parent := &plugins.Plugin{
+					JSONData:  plugins.JSONData{ID: parentPluginID},
+					Signature: plugins.SignatureStatusValid,
+					Manifest: createV2Manifest(map[string]string{
+						"module.js":            "266c19bc148b22ddef2a288fc5f8f40855bda22ccf60be53340b4931e469ae2a",
+						"datasource/module.js": "04d70db091d96c4775fb32ba5a8f84cc22893eb43afdb649726661d4425c6711",
+					}),
+					FS: plugins.NewLocalFS(filepath.Join("testdata", "module-hash-valid-nested")),
+				}
+				return &plugins.Plugin{
+					JSONData:  plugins.JSONData{ID: pluginID},
+					Signature: plugins.SignatureStatusValid,
+					Parent:    parent,
+					FS:        plugins.NewLocalFS(filepath.Join("testdata", "module-hash-valid-nested", "datasource")),
+				}
+			}(),
+			cfg: &config.PluginManagementCfg{
+				PluginsCDNURLTemplate: "https://cdn.example.com",
+				Features:              config.Features{SriChecksEnabled: true},
+				PluginSettings: config.PluginSettings{
+					pluginID:       {"cdn": "true"},
+					parentPluginID: {"cdn": "true"},
+				},
+			},
+			cdn: func() *pluginscdn.Service {
+				cfg := &config.PluginManagementCfg{
+					PluginsCDNURLTemplate: "https://cdn.example.com",
+					PluginSettings: config.PluginSettings{
+						pluginID:       {"cdn": "true"},
+						parentPluginID: {"cdn": "true"},
+					},
+				}
+				return pluginscdn.ProvideService(cfg)
+			}(),
+			expModuleHash: "sha256-BNcNsJHZbEd1+zK6Wo+EzCKJPrQ6/bZJcmZh1EJcZxE=",
+		},
+		{
+			// parentPluginID           (/)
+			// └── pluginID             (/panels/one)
+			name: "nested plugin deeper than one subfolder should return module hash from parent MANIFEST.txt",
+			plugin: func() *plugins.Plugin {
+				parent := &plugins.Plugin{
+					JSONData:  plugins.JSONData{ID: parentPluginID},
+					Signature: plugins.SignatureStatusValid,
+					Manifest: createV2Manifest(map[string]string{
+						"module.js":            "266c19bc148b22ddef2a288fc5f8f40855bda22ccf60be53340b4931e469ae2a",
+						"panels/one/module.js": "cbd1ac2284645a0e1e9a8722a729f5bcdd2b831222728709c6360beecdd6143f",
+						"datasource/module.js": "04d70db091d96c4775fb32ba5a8f84cc22893eb43afdb649726661d4425c6711",
+					}),
+					FS: plugins.NewLocalFS(filepath.Join("testdata", "module-hash-valid-nested")),
+				}
+				return &plugins.Plugin{
+					JSONData:  plugins.JSONData{ID: pluginID},
+					Signature: plugins.SignatureStatusValid,
+					Parent:    parent,
+					FS:        plugins.NewLocalFS(filepath.Join("testdata", "module-hash-valid-nested", "panels", "one")),
+				}
+			}(),
+			cfg: &config.PluginManagementCfg{
+				PluginsCDNURLTemplate: "https://cdn.example.com",
+				Features:              config.Features{SriChecksEnabled: true},
+				PluginSettings: config.PluginSettings{
+					pluginID:       {"cdn": "true"},
+					parentPluginID: {"cdn": "true"},
+				},
+			},
+			cdn: func() *pluginscdn.Service {
+				cfg := &config.PluginManagementCfg{
+					PluginsCDNURLTemplate: "https://cdn.example.com",
+					PluginSettings: config.PluginSettings{
+						pluginID:       {"cdn": "true"},
+						parentPluginID: {"cdn": "true"},
+					},
+				}
+				return pluginscdn.ProvideService(cfg)
+			}(),
+			expModuleHash: "sha256-y9GsIoRkWg4emocipyn1vN0rgxIicocJxjYL7s3WFD8=",
+		},
+		{
+			// grand-parent-app         (/)
+			// ├── parent-datasource    (/datasource)
+			// │   └── child-panel      (/datasource/panels/one)
+			name: "nested plugin of a nested plugin should return module hash from grandparent MANIFEST.txt",
+			plugin: func() *plugins.Plugin {
+				grandparent := &plugins.Plugin{
+					JSONData:  plugins.JSONData{ID: "grand-parent-app"},
+					Signature: plugins.SignatureStatusValid,
+					Manifest: createV2Manifest(map[string]string{
+						"module.js":                       "266c19bc148b22ddef2a288fc5f8f40855bda22ccf60be53340b4931e469ae2a",
+						"datasource/module.js":            "04d70db091d96c4775fb32ba5a8f84cc22893eb43afdb649726661d4425c6711",
+						"datasource/panels/one/module.js": "cbd1ac2284645a0e1e9a8722a729f5bcdd2b831222728709c6360beecdd6143f",
+					}),
+					FS: plugins.NewLocalFS(filepath.Join("testdata", "module-hash-valid-deeply-nested")),
+				}
+				parent := &plugins.Plugin{
+					JSONData:  plugins.JSONData{ID: "parent-datasource"},
+					Signature: plugins.SignatureStatusValid,
+					Parent:    grandparent,
+					FS:        plugins.NewLocalFS(filepath.Join("testdata", "module-hash-valid-deeply-nested", "datasource")),
+				}
+				return &plugins.Plugin{
+					JSONData:  plugins.JSONData{ID: "child-panel"},
+					Signature: plugins.SignatureStatusValid,
+					Parent:    parent,
+					FS:        plugins.NewLocalFS(filepath.Join("testdata", "module-hash-valid-deeply-nested", "datasource", "panels", "one")),
+				}
+			}(),
+			cfg: &config.PluginManagementCfg{
+				PluginsCDNURLTemplate: "https://cdn.example.com",
+				Features:              config.Features{SriChecksEnabled: true},
+				PluginSettings: config.PluginSettings{
+					"child-panel":       {"cdn": "true"},
+					"parent-datasource": {"cdn": "true"},
+					"grand-parent-app":  {"cdn": "true"},
+				},
+			},
+			cdn: func() *pluginscdn.Service {
+				cfg := &config.PluginManagementCfg{
+					PluginsCDNURLTemplate: "https://cdn.example.com",
+					PluginSettings: config.PluginSettings{
+						"child-panel":       {"cdn": "true"},
+						"parent-datasource": {"cdn": "true"},
+						"grand-parent-app":  {"cdn": "true"},
+					},
+				}
+				return pluginscdn.ProvideService(cfg)
+			}(),
+			expModuleHash: "sha256-y9GsIoRkWg4emocipyn1vN0rgxIicocJxjYL7s3WFD8=",
+		},
+		{
+			name: "nested plugin should not return module hash when parent manifest is nil",
+			plugin: func() *plugins.Plugin {
+				parent := &plugins.Plugin{
+					JSONData:  plugins.JSONData{ID: parentPluginID},
+					Signature: plugins.SignatureStatusValid,
+					Manifest:  nil, // Parent has no manifest
+					FS:        plugins.NewLocalFS(filepath.Join("testdata", "module-hash-valid-nested")),
+				}
+				return &plugins.Plugin{
+					JSONData:  plugins.JSONData{ID: pluginID},
+					Signature: plugins.SignatureStatusValid,
+					Parent:    parent,
+					FS:        plugins.NewLocalFS(filepath.Join("testdata", "module-hash-valid-nested", "panels", "one")),
+				}
+			}(),
+			cfg:           &config.PluginManagementCfg{Features: config.Features{SriChecksEnabled: true}},
+			cdn:           pluginscdn.ProvideService(&config.PluginManagementCfg{}),
+			expModuleHash: "",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			result := CalculateModuleHash(tc.plugin, tc.cfg, tc.cdn)
+			require.Equal(t, tc.expModuleHash, result)
+		})
+	}
+}
@@ -0,0 +1 @@
+hello parent
@@ -0,0 +1,15 @@
+{
+  "type": "app",
+  "name": "Test",
+  "id": "test-app",
+  "backend": true,
+  "executable": "test",
+  "state": "alpha",
+  "info": {
+    "version": "1.0.0",
+    "description": "Test",
+    "author": {
+      "name": "Giuseppe Guerra"
+    }
+  }
+}
@@ -0,0 +1,29 @@
+
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+{
+  "manifestVersion": "2.0.0",
+  "signatureType": "grafana",
+  "signedByOrg": "grafana",
+  "signedByOrgName": "Grafana Labs",
+  "plugin": "test-app",
+  "version": "1.0.0",
+  "time": 1726230812215,
+  "keyId": "7e4d0c6a708866e7",
+  "files": {
+    "plugin.json": "31f04aceb2a9b14c2e501f38a4de5ab1c7a3e7306f58353fa5c1a86b716c971c",
+    "something.js": "266c19bc148b22ddef2a288fc5f8f40855bda22ccf60be53340b4931e469ae2a"
+  }
+}
+-----BEGIN PGP SIGNATURE-----
+Version: OpenPGP.js v4.10.11
+Comment: https://openpgpjs.org
+
+wrkEARMKAAYFAmbkMRwAIQkQfk0ManCIZucWIQTzOyW2kQdOhGNlcPN+TQxq
+cIhm53UWAgkBE2oxqyzBji86eCOzLmCT7IgQaoSMMF48tu+XdgwFS5/NU5su
+deKad3taDnSU9a7GkCaisRVQOWy/UtFS1FNQTtkCCQBc1cZ6JsPWh2Pd60h0
+9U5aviYde6g1DCKO1riaUzHzrruBiHmHWjzr2aYwACb89vs2XcZqvue1Byb+
+y2inBDhHvQ==
+=qMej
+-----END PGP SIGNATURE-----
@@ -0,0 +1,15 @@
+{
+  "type": "app",
+  "name": "Test",
+  "id": "test-app",
+  "backend": true,
+  "executable": "test",
+  "state": "alpha",
+  "info": {
+    "version": "1.0.0",
+    "description": "Test",
+    "author": {
+      "name": "Giuseppe Guerra"
+    }
+  }
+}
@@ -0,0 +1 @@
+hello parent
@@ -0,0 +1,33 @@
+
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+{
+  "manifestVersion": "2.0.0",
+  "signatureType": "grafana",
+  "signedByOrg": "grafana",
+  "signedByOrgName": "Grafana Labs",
+  "plugin": "test-app",
+  "version": "1.0.0",
+  "time": 1726234125061,
+  "keyId": "7e4d0c6a708866e7",
+  "files": {
+    "datasource/module.js": "04d70db091d96c4775fb32ba5a8f84cc22893eb43afdb649726661d4425c6711",
+    "datasource/plugin.json": "3fd712717a21617cc76f9043efcd43d4ebf5564dd155a28e4e3c736739f6931e",
+    "datasource/panels/one/module.js": "cbd1ac2284645a0e1e9a8722a729f5bcdd2b831222728709c6360beecdd6143f",
+    "datasource/panels/one/plugin.json": "b9b4556a7220ea77650ffd228da6d441e68df3405d50dab5773c10f4afae5ad3",
+    "module.js": "266c19bc148b22ddef2a288fc5f8f40855bda22ccf60be53340b4931e469ae2a",
+    "plugin.json": "31f04aceb2a9b14c2e501f38a4de5ab1c7a3e7306f58353fa5c1a86b716c971c"
+  }
+}
+-----BEGIN PGP SIGNATURE-----
+Version: OpenPGP.js v4.10.11
+Comment: https://openpgpjs.org
+
+wrkEARMKAAYFAmbkPg0AIQkQfk0ManCIZucWIQTzOyW2kQdOhGNlcPN+TQxq
+cIhm5xTlAgkB3mG37KEdlP34nC69NbmriMpDH6PyyJ0IUwXB/SMTr4Gc2SvG
+cVHvih/0WqVjYKxxQI0QHoYpBQW2jPx0YJLFof8CCQBHpdEEXNTYOOZWG6Cg
+M3wB3AdCO+ChjXkKosbWqiMDfVqHFoLoLurwWxwOjvk/xTvX5GFbOxSfISyU
+8iW03F5/Sw==
+=wobV
+-----END PGP SIGNATURE-----
@@ -0,0 +1 @@
+hello datasource
@@ -0,0 +1 @@
+hello panel
@@ -0,0 +1,13 @@
+{
+  "type": "panel",
+  "name": "Test Panel",
+  "id": "test-panel",
+  "state": "alpha",
+  "info": {
+    "version": "1.0.0",
+    "description": "Test",
+    "author": {
+      "name": "Giuseppe Guerra"
+    }
+  }
+}
@@ -0,0 +1,15 @@
+{
+  "type": "datasource",
+  "name": "Test Datasource",
+  "id": "test-datasource",
+  "backend": true,
+  "executable": "test",
+  "state": "alpha",
+  "info": {
+    "version": "1.0.0",
+    "description": "Test",
+    "author": {
+      "name": "Giuseppe Guerra"
+    }
+  }
+}
@@ -0,0 +1 @@
+hello parent
@@ -0,0 +1,15 @@
+{
+  "type": "app",
+  "name": "Test",
+  "id": "test-app",
+  "backend": true,
+  "executable": "test",
+  "state": "alpha",
+  "info": {
+    "version": "1.0.0",
+    "description": "Test",
+    "author": {
+      "name": "Giuseppe Guerra"
+    }
+  }
+}
@@ -0,0 +1,33 @@
+
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+{
+  "manifestVersion": "2.0.0",
+  "signatureType": "grafana",
+  "signedByOrg": "grafana",
+  "signedByOrgName": "Grafana Labs",
+  "plugin": "test-app",
+  "version": "1.0.0",
+  "time": 1726230803822,
+  "keyId": "7e4d0c6a708866e7",
+  "files": {
+    "module.js": "266c19bc148b22ddef2a288fc5f8f40855bda22ccf60be53340b4931e469ae2a",
+    "plugin.json": "31f04aceb2a9b14c2e501f38a4de5ab1c7a3e7306f58353fa5c1a86b716c971c",
+    "datasource/module.js": "04d70db091d96c4775fb32ba5a8f84cc22893eb43afdb649726661d4425c6711",
+    "datasource/plugin.json": "3fd712717a21617cc76f9043efcd43d4ebf5564dd155a28e4e3c736739f6931e",
+    "panels/one/module.js": "cbd1ac2284645a0e1e9a8722a729f5bcdd2b831222728709c6360beecdd6143f",
+    "panels/one/plugin.json": "b9b4556a7220ea77650ffd228da6d441e68df3405d50dab5773c10f4afae5ad3"
+  }
+}
+-----BEGIN PGP SIGNATURE-----
+Version: OpenPGP.js v4.10.11
+Comment: https://openpgpjs.org
+
+wrkEARMKAAYFAmbkMRQAIQkQfk0ManCIZucWIQTzOyW2kQdOhGNlcPN+TQxq
+cIhm50C8AgkAmzQpeYPnCgYimLGp5UGnCTrkbUEEqW+qXESrhi5T5ZuM+SzT
+BcRlC5pP6+wuyXAIdfppzWQ/umkkoaTIuub0TXQCCQHVcpWKy4acRL9TlORQ
+1VzVEV9PW0+x606HsDDHkterKQZgr5X6I/sTbSpBDMWPCMxqAk9fZn3G4iuq
+MyS+hwUZDQ==
+=7/Rd
+-----END PGP SIGNATURE-----
@@ -0,0 +1 @@
+hello datasource
@@ -0,0 +1,15 @@
+{
+  "type": "datasource",
+  "name": "Test Datasource",
+  "id": "test-datasource",
+  "backend": true,
+  "executable": "test",
+  "state": "alpha",
+  "info": {
+    "version": "1.0.0",
+    "description": "Test",
+    "author": {
+      "name": "Giuseppe Guerra"
+    }
+  }
+}
@@ -0,0 +1 @@
+hello parent
@@ -0,0 +1 @@
+hello panel
@@ -0,0 +1,13 @@
+{
+  "type": "panel",
+  "name": "Test Panel",
+  "id": "test-panel",
+  "state": "alpha",
+  "info": {
+    "version": "1.0.0",
+    "description": "Test",
+    "author": {
+      "name": "Giuseppe Guerra"
+    }
+  }
+}
@@ -0,0 +1,15 @@
+{
+  "type": "app",
+  "name": "Test",
+  "id": "test-app",
+  "backend": true,
+  "executable": "test",
+  "state": "alpha",
+  "info": {
+    "version": "1.0.0",
+    "description": "Test",
+    "author": {
+      "name": "Giuseppe Guerra"
+    }
+  }
+}
@@ -0,0 +1,32 @@
+
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+{
+  "manifestVersion": "2.0.0",
+  "signatureType": "private",
+  "signedByOrg": "giuseppeguerra",
+  "signedByOrgName": "giuseppeguerra",
+  "rootUrls": [
+    "http://127.0.0.1:3000/"
+  ],
+  "plugin": "test-datasource",
+  "version": "1.0.0",
+  "time": 1725959570435,
+  "keyId": "7e4d0c6a708866e7",
+  "files": {
+    "module.js": "5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03",
+    "plugin.json": "129fab4e0584d18c778ebdfa5fe1a68edf2e5c5aeb8290b2c68182c857cb59f8"
+  }
+}
+-----BEGIN PGP SIGNATURE-----
+Version: OpenPGP.js v4.10.11
+Comment: https://openpgpjs.org
+
+wrkEARMKAAYFAmbgDZIAIQkQfk0ManCIZucWIQTzOyW2kQdOhGNlcPN+TQxq
+cIhm5wbfAgkAXmKJcM8uAKb3TepYW/oyGhRLR8L6eM9mCoYwKkatITKJ6bRe
+Wnz37AMcPx0DahgfCzCXRLo4CspPJylr2JV8DagCCQCfCjHgLFhKGpBP71Y1
+mgcQ1/CJefb6B2H45G25MwUFTlSTGLDqW4QMi2kQvXnnUMjXquv2+iVd6qyz
+0Rqvpou/QQ==
+=QNmr
+-----END PGP SIGNATURE-----
@@ -0,0 +1 @@
+hello
@@ -0,0 +1,15 @@
+{
+  "type": "datasource",
+  "name": "Test",
+  "id": "test-datasource",
+  "backend": true,
+  "executable": "test",
+  "state": "alpha",
+  "info": {
+    "version": "1.0.0",
+    "description": "Test",
+    "author": {
+      "name": "Giuseppe Guerra"
+    }
+  }
+}