ARG GO_IMAGE=docker.io/library/golang:1.27.2-alpine3.24@sha256:85dc1069ac644ea3c527b177303a406eb3358192816cd7f9e5848eb658851673
ARG UPSTREAM=docker.io/grafana/grafana@sha256:b28bae15e219c998fb0e0424ed724930cc61b1f61fb404d47c862f9a23f9e572
FROM ${UPSTREAM} AS original
FROM ${GO_IMAGE} AS plugins
LABEL io.thepeoples.hardened.build-owner="hardened-batch3-slice6"
ENV GOWORK=off GOTOOLCHAIN=local CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GOMAXPROCS=4 GOMODCACHE=/go/pkg/mod GOCACHE=/go/cache
COPY plugins.tsv /inputs/plugins.tsv
COPY build-plugins.sh pin-tempo-v3.sh /inputs/
RUN sh /inputs/build-plugins.sh
FROM ${GO_IMAGE} AS build
LABEL io.thepeoples.hardened.build-owner="hardened-batch3-slice6"
ARG SOURCE_URL=https://codeload.github.com/grafana/grafana/tar.gz/6193dc03311b631b9727b560d24369e683dc396e
ARG SOURCE_SHA256=222f8cd14b5345d024ab460d592c63c1e7432cb20a89e2dbcc86d7bfd83df3ac
ARG SOURCE_COMMIT=6193dc03311b631b9727b560d24369e683dc396e
ARG VERSION=13.2.3
ARG BUILD_STAMP=1790672538
ARG GO_BUMPS="golang.org/x/net@v0.60.0 golang.org/x/crypto@v0.57.0 go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.45.0 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.45.0 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.45.0"
ENV GOWORK=off GOTOOLCHAIN=local CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GOMAXPROCS=4 GOMODCACHE=/go/pkg/mod GOCACHE=/go/cache
WORKDIR /src
RUN wget -q -O /tmp/upstream.tar.gz "${SOURCE_URL}" \
 && printf '%s  %s\n' "${SOURCE_SHA256}" /tmp/upstream.tar.gz | sha256sum -c - \
 && tar -xzf /tmp/upstream.tar.gz --strip-components=1 -C /src
COPY verification/ /inputs/verification/
COPY plugins.tsv /inputs/plugins.tsv
COPY --from=original /usr/share/grafana/data/plugins-bundled/ /usr/share/grafana/data/plugins-bundled/
COPY --from=plugins /out/plugins/ /usr/share/grafana/data/plugins-bundled/
RUN go run /inputs/verification/apply.go /inputs/verification/distributor.patch /src \
 && cp /inputs/verification/distributor.go /inputs/verification/distributor_test.go pkg/plugins/manager/signature/ \
 && go run /inputs/verification/generate.go /usr/share/grafana/data/plugins-bundled /usr/share/grafana/data/plugins-bundled /inputs/plugins.tsv pkg/plugins/manager/signature/distributor_generated.go \
 && gofmt -w pkg/plugins/manager/signature/distributor*.go pkg/plugins/models.go
RUN mkdir -p /out/bin /out/records /out/source \
 && cp go.mod /out/records/upstream.go.mod \
 && cp go.sum /out/records/upstream.go.sum \
 && if [ -n "${GO_BUMPS}" ]; then go get ${GO_BUMPS}; fi \
 && go mod download \
 && go mod verify \
 && go test -p 4 -tags oss -mod=readonly -run '^TestDistributor' -v github.com/grafana/grafana/pkg/plugins/manager/signature \
 && cp pkg/plugins/manager/signature/distributor_generated.go /out/records/ \
 && mkdir -p /tmp/distributor-verification/pkg/plugins/manager/signature \
 && cp -R /inputs/verification /tmp/distributor-verification/ \
 && cp pkg/plugins/manager/signature/distributor_generated.go /tmp/distributor-verification/pkg/plugins/manager/signature/ \
 && tar -czf /out/source/distributor-verification.tar.gz -C /tmp/distributor-verification verification pkg \
 && go build -p 4 -tags oss -mod=readonly -buildvcs=false -trimpath -ldflags "-s -w -X main.version=${VERSION} -X main.commit=${SOURCE_COMMIT} -X main.buildBranch=hardened -X main.buildstamp=${BUILD_STAMP}" -o /out/bin/grafana ./pkg/cmd/grafana \
 && go version -m /out/bin/grafana > /out/records/go-version-m.txt \
 && go list -m -json all > /out/records/modules.json \
 && printf '%s\n' "${SOURCE_COMMIT}" > /out/records/upstream-commit \
 && printf '%s\n' "${GO_BUMPS}" > /out/records/bumps \
 && cp go.mod go.sum LICENSE /out/records/ \
 && if [ -f NOTICE ]; then cp NOTICE /out/records/; fi \
 && go mod vendor \
 && tar -czf /out/source/vendor.tar.gz vendor \
 && find . -type f \( -name go.mod -o -name go.sum -o -name go.work -o -name go.work.sum \) ! -path './vendor/*' | LC_ALL=C sort > /out/records/module-manifests.list \
 && tar -czf /out/source/module-manifests.tar.gz -T /out/records/module-manifests.list \
 && cp /tmp/upstream.tar.gz /out/source/upstream.tar.gz \
 && cp -R /out/records /out/source/records \
 && cd /out/source && sha256sum upstream.tar.gz vendor.tar.gz module-manifests.tar.gz distributor-verification.tar.gz records/* > SHA256SUMS
FROM ${GO_IMAGE} AS runtime-dirs
LABEL io.thepeoples.hardened.build-owner="hardened-batch3-slice6"
RUN mkdir -p /runtime/tmp && chmod 1777 /runtime/tmp
FROM original AS assets
LABEL io.thepeoples.hardened.build-owner="hardened-batch3-slice6"
USER root
RUN mkdir -p /runtime \
 && cp -a /usr/share/grafana/data /runtime/data \
 && find /runtime/data/plugins-bundled -type f -name '*_linux_amd64' -delete
FROM scratch AS source
LABEL io.thepeoples.hardened.build-owner="hardened-batch3-slice6"
COPY --from=build /out/source/ /
COPY --from=plugins /out/source/plugins/ /plugins/
FROM scratch
ENV PATH="/usr/share/grafana/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" \
    GF_PATHS_CONFIG="/etc/grafana/grafana.ini" \
    GF_PATHS_DATA="/var/lib/grafana" \
    GF_PATHS_HOME="/usr/share/grafana" \
    GF_PATHS_LOGS="/var/log/grafana" \
    GF_PATHS_PLUGINS="/var/lib/grafana/plugins" \
    GF_PATHS_PROVISIONING="/etc/grafana/provisioning"
COPY --from=runtime-dirs /runtime/ /
COPY --from=original /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=original /etc/passwd /etc/group /etc/
COPY --from=original /usr/share/zoneinfo/ /usr/share/zoneinfo/
COPY --from=original /etc/grafana/ /etc/grafana/
COPY --from=original /usr/share/grafana/conf/ /usr/share/grafana/conf/
COPY --from=original /usr/share/grafana/public/ /usr/share/grafana/public/
COPY --from=original /usr/share/grafana/LICENSE /usr/share/grafana/LICENSE
COPY --from=original --chown=472:0 /var/lib/grafana/ /var/lib/grafana/
COPY --from=original --chown=472:0 /var/log/grafana/ /var/log/grafana/
COPY --from=assets --chown=472:0 /runtime/data/ /usr/share/grafana/data/
COPY --from=plugins --chmod=0755 /out/plugins/ /usr/share/grafana/data/plugins-bundled/
COPY --from=build --chmod=0755 /out/bin/grafana /usr/share/grafana/bin/grafana
COPY --from=build /out/records/ /usr/share/tp-hardened/grafana/
USER 472
WORKDIR /usr/share/grafana
EXPOSE 3000
ENTRYPOINT ["/usr/share/grafana/bin/grafana", "server", "--homepath=/usr/share/grafana", "--config=/etc/grafana/grafana.ini", "--packaging=docker"]
CMD ["cfg:default.log.mode=console"]
LABEL org.opencontainers.image.version="13.2.3" \
      org.opencontainers.image.source="https://github.com/grafana/grafana" \
      org.opencontainers.image.revision="6193dc03311b631b9727b560d24369e683dc396e" \
      org.opencontainers.image.licenses="AGPL-3.0-only" \
      io.thepeoples.hardened.upstream="docker.io/grafana/grafana:13.2.3@sha256:b28bae15e219c998fb0e0424ed724930cc61b1f61fb404d47c862f9a23f9e572" \
      io.thepeoples.hardened.ladder="b+minimize" \
      io.thepeoples.hardened.toolchain="go1.27.2" \
      io.thepeoples.hardened.source-status="export vendor and inventory runtime/UI/plugin sources before publication"