Re: www/grafana downloading executables (plugins) at runtime

[Tobias Nygren <tnn%NetBSD.org@localhost>]

On Wed, 21 Oct 2026 12:12:21 +0200
Edgar Fuß <ef%math.uni-bonn.de@localhost> wrote:

> > This [a package downloading and trying to execute random executables, 
> semi-fortunately not for the platform it was compiled for] is unfortunately 
> by design.
> Then this is BAD (Broken As Designed).
> 
> The world seems to have gone completely nuts.
> 
> Grafana is a tool for visualizing data. Without a "plugin" (or whatever 
> other method) to acquire data, there's no data to visualize. So, unless 
> there's any datasource (the Grafana term) it can acquire data from without 
> a plugin, www/grafana is completely useless for any purpose on NetBSD and 
> several other platforms.
> (Unless you happen to use Prometheus, are pointed to 
> www/grafana-datasource-prometheus and mangle your Grafana installation 
> according to its DESCR.)
> 
> > The plugins are cryptographically signed by the upstream so at least it's 
> > not downloading something that was not marked as trusted by the gpg key 
> > they included at time of packaging.
> I don't agree with some random company being able to execute arbitrary code 
> on my servers at any time of their choosing, even if it needs to be signed 
> by them.
> 
> > If your platform is not among the ones officially supported by the upstream
> > you need to package the applicable datasource plugin for pkgsrc.
> Those "platforms officially supported by upstream" seem to be darwin
> (amd64 and arm64), linux (amd64, arm, arm64 and s390) and MS-Win
> (amd64 and arm64).
> The "applicable datasources" seem to be Prometheus. Full Stop.
> 
> > See www/grafana-prometheus-datasource for an example.
> Thanks for the pointer.
> 
> > The DESCR for that package also explains how to disable the plugin
> > preinstaller.
> Thanks for that, too.
> 
> > I'm not against patching the grafana package to do that by default 
> In my opinion it's completely out of the question /not/ to patch that 
> auto-downloading out of the default configuration.
> 
> > but it will break some turnkey functionality on Darwin and Linux
> Wait, what? We cripple the package for NetBSD users for some "turnkey 
> functionality" for Linux on S/390? I think people in favour of that
> "turnkey functionality" know where to find Linux, Node.js and whatnot.
> 
> After all, I had that "turnkey functionality" in 11.0.
> 
> When did Grafana Labs introduce this "feature"? I read all the marketing^W 
> "release notes" from 11.1 through 13.3 but didn't notice this fundamental 
> change.
> 
> > We should probably package more of the datasources in pkgsrc before
> > going that route.
> In my opinion, we should move www/grafana to www/grafana13 (with the 
> auto-loading patched out of the default config and a note that it's 
> useless without a datasource plugin), roll www/grafana back to a version 
> lacking this mis-feature and import all relevant (whatever that means) 
> datasources before thinking to move ro 13.x.
> 
> Unfortunately, I have no idea how import such a datasource plugin, namely 
> how to create the go-modules.mk file.
> Looking at www/grafana-prometheus-datasource, it seems to contain a lot 
> of code that could (with some s/prometheus/other-datasource/) be shared,
> so maybe better moved to www/grafana13/datasource.mk.
> 
> (I guess we should also patch out the "cloud migration" out of the default 
> config. Plus whatever similar features they introduced.)
> 
> I can't help, but the world has gone completely nuts.

I am not interested in re-importing the old version.
If you want to _maintain_ a secure fork of Grafana, please fork it on
Github and we can package it. If you just want to use the old version
then (as you are aware) you can copy it yourself to /usr/pkgsrc/local.
But this sounds like a lot of work when all you really need is just a
grafana-datasource-influxdb package and the option to disable the
preinstaller.

Yes the world has gone nuts but let me remind you this is how basically
every single Grafana installation in the world is currently operating.
Ranting about it on pkgsrc-users@ will not change upstream's ways.

-Tobias