Re: www/grafana downloading executables (plugins) at runtime

[Edgar Fuß <ef%math.uni-bonn.de@localhost>]

> This [a package downloading and trying to execute random executables, 
semi-fortunately not for the platform it was compiled for] is unfortunately 
by design.
Then this is BAD (Broken As Designed).

The world seems to have gone completely nuts.

Grafana is a tool for visualizing data. Without a "plugin" (or whatever 
other method) to acquire data, there's no data to visualize. So, unless 
there's any datasource (the Grafana term) it can acquire data from without 
a plugin, www/grafana is completely useless for any purpose on NetBSD and 
several other platforms.
(Unless you happen to use Prometheus, are pointed to 
www/grafana-datasource-prometheus and mangle your Grafana installation 
according to its DESCR.)

> The plugins are cryptographically signed by the upstream so at least it's 
> not downloading something that was not marked as trusted by the gpg key 
> they included at time of packaging.
I don't agree with some random company being able to execute arbitrary code 
on my servers at any time of their choosing, even if it needs to be signed 
by them.

> If your platform is not among the ones officially supported by the upstream
> you need to package the applicable datasource plugin for pkgsrc.
Those "platforms officially supported by upstream" seem to be darwin
(amd64 and arm64), linux (amd64, arm, arm64 and s390) and MS-Win
(amd64 and arm64).
The "applicable datasources" seem to be Prometheus. Full Stop.

> See www/grafana-prometheus-datasource for an example.
Thanks for the pointer.

> The DESCR for that package also explains how to disable the plugin
> preinstaller.
Thanks for that, too.

> I'm not against patching the grafana package to do that by default 
In my opinion it's completely out of the question /not/ to patch that 
auto-downloading out of the default configuration.

> but it will break some turnkey functionality on Darwin and Linux
Wait, what? We cripple the package for NetBSD users for some "turnkey 
functionality" for Linux on S/390? I think people in favour of that
"turnkey functionality" know where to find Linux, Node.js and whatnot.

After all, I had that "turnkey functionality" in 11.0.

When did Grafana Labs introduce this "feature"? I read all the marketing^W 
"release notes" from 11.1 through 13.3 but didn't notice this fundamental 
change.

> We should probably package more of the datasources in pkgsrc before
> going that route.
In my opinion, we should move www/grafana to www/grafana13 (with the 
auto-loading patched out of the default config and a note that it's 
useless without a datasource plugin), roll www/grafana back to a version 
lacking this mis-feature and import all relevant (whatever that means) 
datasources before thinking to move ro 13.x.

Unfortunately, I have no idea how import such a datasource plugin, namely 
how to create the go-modules.mk file.
Looking at www/grafana-prometheus-datasource, it seems to contain a lot 
of code that could (with some s/prometheus/other-datasource/) be shared,
so maybe better moved to www/grafana13/datasource.mk.

(I guess we should also patch out the "cloud migration" out of the default 
config. Plus whatever similar features they introduced.)

I can't help, but the world has gone completely nuts.