@grafana/sign-plugin 0.0.1-canary.127.7d9f230.0

package/CONTRIBUTING.md

@@ -0,0 +1,56 @@
+# Contributing to Grafana / Sign Plugin
+
+We are always grateful to receive contributions!<br />
+The following guidelines help you on how to start with the codebase and how to submit your work.
+
+## Installation
+
+### Prerequisites
+
+You need to have `npm` or `yarn` installed.
+
+### Installing
+
+```bash
+git clone git@github.com:grafana/plugin-tools.git
+cd plugin-tools
+yarn install
+```
+
+## Overview
+
+### Technologies
+
+- [**`minimist`**](https://github.com/minimistjs/minimist) - used for parsing argument options
+
+### Folder structure
+
+_Work in progress._
+
+## Development
+
+There are a collection of [commands](#commmands) to assist with developing `sign-plugin`. Please read the main [contributing guide](../../CONTRIBUTING.md) before contributing any code changes to the project.
+
+### Commmands
+
+Below are the main commands used for developing `sign-plugin`. They can be run by either `yarn workspace @grafana/sign-plugin run <name_of_command>` or navigating to `packages/sign-plugin` and running the command directly as detailed below.
+
+```shell
+yarn build # used to build @grafana/sign-plugin
+```
+
+```shell
+yarn dev # watches for changes to files and rebuilds @grafana/sign-plugin automatically
+```
+
+### Conventions
+
+_Work in progress._
+
+### Developing the templates
+
+_Work in progress._
+
+### Submitting a Pull Request
+
+_Work in progress._

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,60 @@
+# Grafana / Sign Plugin
+
+Sign Grafana plugins with ease.
+
+**ToC**
+
+- [Grafana / Sign Plugin](#grafana--sign-plugin)
+  - [Signing a plugin](#signing-a-plugin)
+    - [Sign a public plugin](#sign-a-public-plugin)
+    - [Sign a private plugin](#sign-a-private-plugin)
+      - [`npx`](#npx)
+      - [`yarn` (> 2.x)](#yarn--2x)
+  - [Contributing](#contributing)
+
+**`@grafana/sign-plugin`** works on macOS, Windows and Linux.<br />
+If something doesn’t work, please [file an issue](https://github.com/grafana/plugin-tools/issues/new).<br />
+If you have questions or need help, please ask in [GitHub Discussions](https://github.com/grafana/plugin-tools/discussions).
+
+## Signing a plugin
+
+Signing a plugin allows Grafana to verify the authenticity of the plugin with signature verification. This gives users a way to make sure plugins haven’t been tampered with. All Grafana Labs-authored plugins, including Enterprise plugins, are signed.
+
+All plugins require a signature since Grafana 7.0.
+
+Please refer to [Signing plugins documentation](https://grafana.com/docs/grafana/latest/developers/plugins/sign-a-plugin/) to understand how to sign a Grafana plugin. The following commands are mentioned here for development purposes.
+
+### Sign a public plugin
+
+In your plugin directory, sign the plugin with your Grafana API key. Grafana sign-plugin creates a MANIFEST.txt file in the dist directory of your plugin.
+
+```bash
+export GRAFANA_API_KEY=<YOUR_API_KEY>
+npx @grafana/sign-plugin
+```
+
+### Sign a private plugin
+
+In your plugin directory, run the following to create a MANIFEST.txt file in the dist directory of your plugin.
+
+```bash
+npx @grafana/sign-plugin --rootUrls https://example.com/grafana
+```
+
+Alterntives:
+
+#### [`npx`](https://github.com/npm/npx)
+
+```bash
+npx @grafana/sign-plugin
+```
+
+#### [`yarn`](https://yarnpkg.com/cli/dlx) (> 2.x)
+
+```bash
+yarn dlx @grafana/sign-plugin
+```
+
+## Contributing
+
+We are always grateful for contribution! See the [CONTRIBUTING.md](../CONTRIBUTING.md) for more information.

package/dist/bin/run.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+exports.__esModule = true;
+var minimist_1 = __importDefault(require("minimist"));
+var commands_1 = require("../commands");
+var args = process.argv.slice(2);
+var argv = (0, minimist_1["default"])(args);
+(0, commands_1.sign)(argv);

package/dist/commands/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+exports.__esModule = true;
+__exportStar(require("./sign.command"), exports);

package/dist/commands/sign.command.js

@@ -0,0 +1,90 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (_) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+exports.__esModule = true;
+exports.sign = void 0;
+var path_1 = __importDefault(require("path"));
+var fs_1 = require("fs");
+var pluginValidation_1 = require("../utils/pluginValidation");
+var manifest_1 = require("../utils/manifest");
+var getVersion_1 = require("../utils/getVersion");
+var sign = function (argv) { return __awaiter(void 0, void 0, void 0, function () {
+    var pluginDistDir, signatureType, rootUrls, manifest, signedManifest, err_1;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0:
+                pluginDistDir = path_1["default"].resolve('dist');
+                signatureType = argv.signatureType;
+                rootUrls = argv.rootUrls.split(',');
+                if (!(0, fs_1.existsSync)(pluginDistDir)) {
+                    throw new Error('Plugin `dist` directory is missing. Did you build the plugin before attempting to sign?');
+                }
+                _a.label = 1;
+            case 1:
+                _a.trys.push([1, 4, , 5]);
+                console.log('Building manifest...');
+                return [4, (0, manifest_1.buildManifest)(pluginDistDir)];
+            case 2:
+                manifest = _a.sent();
+                console.log('Signing manifest...');
+                if (signatureType) {
+                    manifest.signatureType = signatureType;
+                }
+                if (rootUrls && rootUrls.length > 0) {
+                    rootUrls.forEach(pluginValidation_1.assertRootUrlIsValid);
+                    manifest.rootUrls = rootUrls;
+                }
+                manifest.signPlugin = { version: (0, getVersion_1.getVersion)() };
+                return [4, (0, manifest_1.signManifest)(manifest)];
+            case 3:
+                signedManifest = _a.sent();
+                console.log('Saving signed manifest...');
+                (0, manifest_1.saveManifest)(pluginDistDir, signedManifest);
+                console.log('Signed successfully');
+                return [3, 5];
+            case 4:
+                err_1 = _a.sent();
+                console.warn(err_1);
+                return [3, 5];
+            case 5: return [2];
+        }
+    });
+}); };
+exports.sign = sign;

package/dist/utils/getVersion.js

@@ -0,0 +1,15 @@
+"use strict";
+exports.__esModule = true;
+exports.getVersion = void 0;
+var fs_1 = require("fs");
+var path_1 = require("path");
+var getVersion = function () {
+    var packageJsonPath = (0, path_1.resolve)(__dirname, '..', '..', 'package.json');
+    var pkg = (0, fs_1.readFileSync)(packageJsonPath, 'utf8');
+    var version = JSON.parse(pkg).version;
+    if (!version) {
+        throw "Could not find the version of sign-plugin";
+    }
+    return version;
+};
+exports.getVersion = getVersion;

package/dist/utils/manifest.js

@@ -0,0 +1,260 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (_) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __await = (this && this.__await) || function (v) { return this instanceof __await ? (this.v = v, this) : new __await(v); }
+var __asyncValues = (this && this.__asyncValues) || function (o) {
+    if (!Symbol.asyncIterator) throw new TypeError("Symbol.asyncIterator is not defined.");
+    var m = o[Symbol.asyncIterator], i;
+    return m ? m.call(o) : (o = typeof __values === "function" ? __values(o) : o[Symbol.iterator](), i = {}, verb("next"), verb("throw"), verb("return"), i[Symbol.asyncIterator] = function () { return this; }, i);
+    function verb(n) { i[n] = o[n] && function (v) { return new Promise(function (resolve, reject) { v = o[n](v), settle(resolve, reject, v.done, v.value); }); }; }
+    function settle(resolve, reject, d, v) { Promise.resolve(v).then(function(v) { resolve({ value: v, done: d }); }, reject); }
+};
+var __asyncDelegator = (this && this.__asyncDelegator) || function (o) {
+    var i, p;
+    return i = {}, verb("next"), verb("throw", function (e) { throw e; }), verb("return"), i[Symbol.iterator] = function () { return this; }, i;
+    function verb(n, f) { i[n] = o[n] ? function (v) { return (p = !p) ? { value: __await(o[n](v)), done: n === "return" } : f ? f(v) : v; } : f; }
+};
+var __asyncGenerator = (this && this.__asyncGenerator) || function (thisArg, _arguments, generator) {
+    if (!Symbol.asyncIterator) throw new TypeError("Symbol.asyncIterator is not defined.");
+    var g = generator.apply(thisArg, _arguments || []), i, q = [];
+    return i = {}, verb("next"), verb("throw"), verb("return"), i[Symbol.asyncIterator] = function () { return this; }, i;
+    function verb(n) { if (g[n]) i[n] = function (v) { return new Promise(function (a, b) { q.push([n, v, a, b]) > 1 || resume(n, v); }); }; }
+    function resume(n, v) { try { step(g[n](v)); } catch (e) { settle(q[0][3], e); } }
+    function step(r) { r.value instanceof __await ? Promise.resolve(r.value.v).then(fulfill, reject) : settle(q[0][2], r); }
+    function fulfill(value) { resume("next", value); }
+    function reject(value) { resume("throw", value); }
+    function settle(f, v) { if (f(v), q.shift(), q.length) resume(q[0][0], q[0][1]); }
+};
+var __values = (this && this.__values) || function(o) {
+    var s = typeof Symbol === "function" && Symbol.iterator, m = s && o[s], i = 0;
+    if (m) return m.call(o);
+    if (o && typeof o.length === "number") return {
+        next: function () {
+            if (o && i >= o.length) o = void 0;
+            return { value: o && o[i++], done: !o };
+        }
+    };
+    throw new TypeError(s ? "Object is not iterable." : "Symbol.iterator is not defined.");
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+exports.__esModule = true;
+exports.saveManifest = exports.signManifest = exports.buildManifest = void 0;
+var crypto_1 = __importDefault(require("crypto"));
+var promises_1 = __importDefault(require("fs/promises"));
+var fs_1 = require("fs");
+var path_1 = __importDefault(require("path"));
+var axios_1 = __importDefault(require("axios"));
+var MANIFEST_FILE = 'MANIFEST.txt';
+function walk(dir, baseDir) {
+    return __asyncGenerator(this, arguments, function walk_1() {
+        var _a, _b, d, entry, realPath, stats, e_1_1;
+        var e_1, _c;
+        return __generator(this, function (_d) {
+            switch (_d.label) {
+                case 0:
+                    _d.trys.push([0, 17, 18, 23]);
+                    return [4, __await(promises_1["default"].opendir(dir))];
+                case 1:
+                    _a = __asyncValues.apply(void 0, [_d.sent()]);
+                    _d.label = 2;
+                case 2: return [4, __await(_a.next())];
+                case 3:
+                    if (!(_b = _d.sent(), !_b.done)) return [3, 16];
+                    d = _b.value;
+                    entry = path_1["default"].join(dir, d.name);
+                    if (!d.isDirectory()) return [3, 7];
+                    return [4, __await(walk(entry, baseDir))];
+                case 4: return [5, __values(__asyncDelegator.apply(void 0, [__asyncValues.apply(void 0, [_d.sent()])]))];
+                case 5: return [4, __await.apply(void 0, [_d.sent()])];
+                case 6:
+                    _d.sent();
+                    return [3, 15];
+                case 7:
+                    if (!d.isFile()) return [3, 10];
+                    return [4, __await(path_1["default"].relative(baseDir, entry))];
+                case 8: return [4, _d.sent()];
+                case 9:
+                    _d.sent();
+                    return [3, 15];
+                case 10:
+                    if (!d.isSymbolicLink()) return [3, 15];
+                    return [4, __await(promises_1["default"].realpath(entry))];
+                case 11:
+                    realPath = _d.sent();
+                    if (!realPath.startsWith(baseDir)) {
+                        throw new Error("symbolic link ".concat(path_1["default"].relative(baseDir, entry), " targets a file outside of the base directory: ").concat(baseDir));
+                    }
+                    return [4, __await(promises_1["default"].stat(realPath))];
+                case 12:
+                    stats = _d.sent();
+                    if (!stats.isFile()) return [3, 15];
+                    return [4, __await(path_1["default"].relative(baseDir, entry))];
+                case 13: return [4, _d.sent()];
+                case 14:
+                    _d.sent();
+                    _d.label = 15;
+                case 15: return [3, 2];
+                case 16: return [3, 23];
+                case 17:
+                    e_1_1 = _d.sent();
+                    e_1 = { error: e_1_1 };
+                    return [3, 23];
+                case 18:
+                    _d.trys.push([18, , 21, 22]);
+                    if (!(_b && !_b.done && (_c = _a["return"]))) return [3, 20];
+                    return [4, __await(_c.call(_a))];
+                case 19:
+                    _d.sent();
+                    _d.label = 20;
+                case 20: return [3, 22];
+                case 21:
+                    if (e_1) throw e_1.error;
+                    return [7];
+                case 22: return [7];
+                case 23: return [2];
+            }
+        });
+    });
+}
+function buildManifest(dir) {
+    var e_2, _a;
+    return __awaiter(this, void 0, void 0, function () {
+        var pluginJson, manifest, _b, _c, filePath, sanitisedFilePath, e_2_1;
+        return __generator(this, function (_d) {
+            switch (_d.label) {
+                case 0:
+                    pluginJson = JSON.parse((0, fs_1.readFileSync)(path_1["default"].join(dir, 'plugin.json'), { encoding: 'utf8' }));
+                    manifest = {
+                        plugin: pluginJson.id,
+                        version: pluginJson.info.version,
+                        files: {}
+                    };
+                    _d.label = 1;
+                case 1:
+                    _d.trys.push([1, 7, 8, 13]);
+                    return [4, walk(dir, dir)];
+                case 2:
+                    _b = __asyncValues.apply(void 0, [_d.sent()]);
+                    _d.label = 3;
+                case 3: return [4, _b.next()];
+                case 4:
+                    if (!(_c = _d.sent(), !_c.done)) return [3, 6];
+                    filePath = _c.value;
+                    if (filePath === MANIFEST_FILE) {
+                        return [3, 5];
+                    }
+                    sanitisedFilePath = filePath.split(path_1["default"].sep).join(path_1["default"].posix.sep);
+                    manifest.files[sanitisedFilePath] = crypto_1["default"]
+                        .createHash('sha256')
+                        .update((0, fs_1.readFileSync)(path_1["default"].join(dir, filePath)))
+                        .digest('hex');
+                    _d.label = 5;
+                case 5: return [3, 3];
+                case 6: return [3, 13];
+                case 7:
+                    e_2_1 = _d.sent();
+                    e_2 = { error: e_2_1 };
+                    return [3, 13];
+                case 8:
+                    _d.trys.push([8, , 11, 12]);
+                    if (!(_c && !_c.done && (_a = _b["return"]))) return [3, 10];
+                    return [4, _a.call(_b)];
+                case 9:
+                    _d.sent();
+                    _d.label = 10;
+                case 10: return [3, 12];
+                case 11:
+                    if (e_2) throw e_2.error;
+                    return [7];
+                case 12: return [7];
+                case 13: return [2, manifest];
+            }
+        });
+    });
+}
+exports.buildManifest = buildManifest;
+function signManifest(manifest) {
+    var _a, _b;
+    return __awaiter(this, void 0, void 0, function () {
+        var GRAFANA_API_KEY, GRAFANA_COM_URL, url, info, err_1;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    GRAFANA_API_KEY = process.env.GRAFANA_API_KEY;
+                    if (!GRAFANA_API_KEY) {
+                        throw new Error('You must create a GRAFANA_API_KEY env variable to sign plugins. Please see: https://grafana.com/docs/grafana/latest/developers/plugins/sign-a-plugin/#generate-an-api-key for instructions.');
+                    }
+                    GRAFANA_COM_URL = process.env.GRAFANA_COM_URL || 'https://grafana.com/api';
+                    url = GRAFANA_COM_URL + '/plugins/ci/sign';
+                    _c.label = 1;
+                case 1:
+                    _c.trys.push([1, 3, , 4]);
+                    return [4, axios_1["default"].post(url, manifest, {
+                            headers: { Authorization: 'Bearer ' + GRAFANA_API_KEY }
+                        })];
+                case 2:
+                    info = _c.sent();
+                    if (info.status !== 200) {
+                        console.error('Error: ', info);
+                        throw new Error('Error signing manifest');
+                    }
+                    return [2, info.data];
+                case 3:
+                    err_1 = _c.sent();
+                    if ((_b = (_a = err_1.response) === null || _a === void 0 ? void 0 : _a.data) === null || _b === void 0 ? void 0 : _b.message) {
+                        throw new Error('Error signing manifest: ' + err_1.response.data.message);
+                    }
+                    throw new Error('Error signing manifest: ' + err_1.message);
+                case 4: return [2];
+            }
+        });
+    });
+}
+exports.signManifest = signManifest;
+function saveManifest(dir, signedManifest) {
+    try {
+        (0, fs_1.writeFileSync)(path_1["default"].join(dir, MANIFEST_FILE), signedManifest);
+        return true;
+    }
+    catch (error) {
+        console.error(error);
+        throw new Error('Error saving manifest');
+    }
+}
+exports.saveManifest = saveManifest;

package/dist/utils/pluginValidation.js

@@ -0,0 +1,44 @@
+"use strict";
+exports.__esModule = true;
+exports.assertRootUrlIsValid = exports.getPluginJson = exports.validatePluginJson = void 0;
+var validatePluginJson = function (pluginJson) {
+    if (!pluginJson.id) {
+        throw new Error('Plugin id is missing in plugin.json');
+    }
+    if (!pluginJson.info) {
+        throw new Error('Plugin info node is missing in plugin.json');
+    }
+    if (!pluginJson.info.version) {
+        throw new Error('Plugin info.version is missing in plugin.json');
+    }
+    var types = ['panel', 'datasource', 'app'];
+    var type = pluginJson.type;
+    if (!types.includes(type)) {
+        throw new Error('Invalid plugin type in plugin.json: ' + type);
+    }
+    if (!pluginJson.id.endsWith('-' + type)) {
+        throw new Error('[plugin.json] id should end with: -' + type);
+    }
+};
+exports.validatePluginJson = validatePluginJson;
+var getPluginJson = function (path) {
+    var pluginJson;
+    try {
+        pluginJson = require(path);
+    }
+    catch (e) {
+        throw new Error('Unable to find: ' + path);
+    }
+    (0, exports.validatePluginJson)(pluginJson);
+    return pluginJson;
+};
+exports.getPluginJson = getPluginJson;
+var assertRootUrlIsValid = function (rootUrl) {
+    try {
+        new URL(rootUrl);
+    }
+    catch (err) {
+        throw new Error("".concat(rootUrl, " is not a valid URL"));
+    }
+};
+exports.assertRootUrlIsValid = assertRootUrlIsValid;

package/dist/utils/pluginValidation.test.js

@@ -0,0 +1,15 @@
+"use strict";
+exports.__esModule = true;
+var pluginValidation_1 = require("./pluginValidation");
+describe('pluginValidation', function () {
+    describe('plugin.json', function () {
+        test('missing plugin.json file', function () {
+            expect(function () { return (0, pluginValidation_1.getPluginJson)("".concat(__dirname, "/mocks/missing-plugin.json")); }).toThrowError();
+        });
+    });
+    describe('validatePluginJson', function () {
+        test('missing "id" field in the plugin.json file', function () {
+            expect(function () { return (0, pluginValidation_1.validatePluginJson)({}); }).toThrow('Plugin id is missing in plugin.json');
+        });
+    });
+});

package/jest.config.js

@@ -0,0 +1,3 @@
+const sharedConfig = require('../../jest.config.base');
+
+module.exports = sharedConfig;

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@grafana/sign-plugin",
+  "version": "0.0.1-canary.127.7d9f230.0",
+  "main": "index.js",
+  "repository": {
+    "directory": "packages/sign-plugin",
+    "url": "https://github.com/grafana/plugin-tools"
+  },
+  "author": "Grafana",
+  "license": "Apache-2.0",
+  "bin": "./dist/bin/run.js",
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  },
+  "scripts": {
+    "clean": "rm -rf ./dist",
+    "build": "yarn clean && tsc && chmod +x ./dist/bin/run.js",
+    "dev": "nodemon --exec 'tsc'",
+    "lint": "eslint --cache --ext .js,.jsx,.ts,.tsx ./src",
+    "lint:fix": "yarn lint --fix",
+    "test": "jest",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "axios": "^1.1.3",
+    "minimist": "^1.2.2"
+  },
+  "devDependencies": {
+    "@types/minimist": "^1.2.2"
+  },
+  "nodemonConfig": {
+    "watch": [
+      "src/**/*"
+    ],
+    "ext": "*",
+    "events": {
+      "start": "cls || clear"
+    }
+  },
+  "engines": {
+    "node": ">=16"
+  },
+  "gitHead": "7d9f230a5b700fbbb315ece3a0d6e78ac23644d5"
+}

package/src/bin/run.ts

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+
+import minimist from 'minimist';
+import { sign } from '../commands';
+
+const args = process.argv.slice(2);
+const argv = minimist(args);
+
+sign(argv);

package/src/commands/index.ts

@@ -0,0 +1 @@
+export * from './sign.command';

package/src/commands/sign.command.ts

@@ -0,0 +1,40 @@
+import path from 'path';
+import minimist from 'minimist';
+import { existsSync } from 'fs';
+import { assertRootUrlIsValid } from '../utils/pluginValidation';
+import { buildManifest, signManifest, saveManifest } from '../utils/manifest';
+import { getVersion } from '../utils/getVersion';
+
+export const sign = async (argv: minimist.ParsedArgs) => {
+  const pluginDistDir = path.resolve('dist');
+  const signatureType: string = argv.signatureType;
+  const rootUrls: string[] = argv.rootUrls.split(',');
+
+  if (!existsSync(pluginDistDir)) {
+    throw new Error('Plugin `dist` directory is missing. Did you build the plugin before attempting to sign?');
+  }
+
+  try {
+    console.log('Building manifest...');
+    const manifest = await buildManifest(pluginDistDir);
+
+    console.log('Signing manifest...');
+    if (signatureType) {
+      manifest.signatureType = signatureType;
+    }
+    if (rootUrls && rootUrls.length > 0) {
+      rootUrls.forEach(assertRootUrlIsValid);
+      manifest.rootUrls = rootUrls;
+    }
+
+    manifest.signPlugin = { version: getVersion() };
+    const signedManifest = await signManifest(manifest);
+
+    console.log('Saving signed manifest...');
+    saveManifest(pluginDistDir, signedManifest);
+
+    console.log('Signed successfully');
+  } catch (err) {
+    console.warn(err);
+  }
+};

package/src/utils/getVersion.ts

@@ -0,0 +1,12 @@
+import { readFileSync } from 'fs';
+import { resolve } from 'path';
+
+export const getVersion = () => {
+  const packageJsonPath = resolve(__dirname, '..', '..', 'package.json');
+  const pkg = readFileSync(packageJsonPath, 'utf8');
+  const { version } = JSON.parse(pkg);
+  if (!version) {
+    throw `Could not find the version of sign-plugin`;
+  }
+  return version;
+};

package/src/utils/manifest.ts

@@ -0,0 +1,115 @@
+import crypto from 'crypto';
+import fs from 'fs/promises';
+import { readFileSync, writeFileSync } from 'fs';
+import path from 'path';
+import axios from 'axios';
+
+const MANIFEST_FILE = 'MANIFEST.txt';
+
+export interface ManifestInfo {
+  // time: number;  << filled in by the server
+  // keyId: string; << filled in by the server
+  // signedByOrg: string; << filled in by the server
+  // signedByOrgName: string; << filled in by the server
+  signatureType?: string; // filled in by the server if not specified
+  rootUrls?: string[]; // for private signatures
+  plugin: string;
+  version: string;
+  files: Record<string, string>;
+  signPlugin?: {
+    version: string;
+  };
+}
+
+type RecursiveWalk = AsyncGenerator<string, void | RecursiveWalk>;
+
+async function* walk(dir: string, baseDir: string): RecursiveWalk {
+  for await (const d of await fs.opendir(dir)) {
+    const entry = path.join(dir, d.name);
+    if (d.isDirectory()) {
+      yield* await walk(entry, baseDir);
+    } else if (d.isFile()) {
+      yield path.relative(baseDir, entry);
+    } else if (d.isSymbolicLink()) {
+      const realPath = await fs.realpath(entry);
+      if (!realPath.startsWith(baseDir)) {
+        throw new Error(
+          `symbolic link ${path.relative(baseDir, entry)} targets a file outside of the base directory: ${baseDir}`
+        );
+      }
+      // if resolved symlink target is a file include it in the manifest
+      const stats = await fs.stat(realPath);
+      if (stats.isFile()) {
+        yield path.relative(baseDir, entry);
+      }
+    }
+  }
+}
+
+export async function buildManifest(dir: string): Promise<ManifestInfo> {
+  const pluginJson = JSON.parse(readFileSync(path.join(dir, 'plugin.json'), { encoding: 'utf8' }));
+
+  const manifest = {
+    plugin: pluginJson.id,
+    version: pluginJson.info.version,
+    files: {},
+  } as ManifestInfo;
+
+  for await (const filePath of await walk(dir, dir)) {
+    if (filePath === MANIFEST_FILE) {
+      continue;
+    }
+
+    // Signing plugins on Windows can create invalid paths with `\\` in the manifest
+    // causing `Modified signature` errors in Grafana. Regardless of OS make sure
+    // we have a posix compatible path.
+    const sanitisedFilePath = filePath.split(path.sep).join(path.posix.sep);
+
+    manifest.files[sanitisedFilePath] = crypto
+      .createHash('sha256')
+      .update(readFileSync(path.join(dir, filePath)))
+      .digest('hex');
+  }
+
+  return manifest;
+}
+
+export async function signManifest(manifest: ManifestInfo): Promise<string> {
+  const GRAFANA_API_KEY = process.env.GRAFANA_API_KEY;
+  if (!GRAFANA_API_KEY) {
+    throw new Error(
+      'You must create a GRAFANA_API_KEY env variable to sign plugins. Please see: https://grafana.com/docs/grafana/latest/developers/plugins/sign-a-plugin/#generate-an-api-key for instructions.'
+    );
+  }
+
+  const GRAFANA_COM_URL = process.env.GRAFANA_COM_URL || 'https://grafana.com/api';
+  const url = GRAFANA_COM_URL + '/plugins/ci/sign';
+
+  try {
+    const info = await axios.post(url, manifest, {
+      headers: { Authorization: 'Bearer ' + GRAFANA_API_KEY },
+    });
+    if (info.status !== 200) {
+      console.error('Error: ', info);
+      throw new Error('Error signing manifest');
+    }
+
+    return info.data;
+  } catch (err: any) {
+    if (err.response?.data?.message) {
+      throw new Error('Error signing manifest: ' + err.response.data.message);
+    }
+
+    throw new Error('Error signing manifest: ' + err.message);
+  }
+}
+
+export function saveManifest(dir: string, signedManifest: string) {
+  try {
+    writeFileSync(path.join(dir, MANIFEST_FILE), signedManifest);
+    return true;
+  } catch (error) {
+    console.error(error);
+    throw new Error('Error saving manifest');
+  }
+}

package/src/utils/pluginValidation.test.ts

@@ -0,0 +1,15 @@
+import { getPluginJson, validatePluginJson } from './pluginValidation';
+
+describe('pluginValidation', () => {
+  describe('plugin.json', () => {
+    test('missing plugin.json file', () => {
+      expect(() => getPluginJson(`${__dirname}/mocks/missing-plugin.json`)).toThrowError();
+    });
+  });
+
+  describe('validatePluginJson', () => {
+    test('missing "id" field in the plugin.json file', () => {
+      expect(() => validatePluginJson({})).toThrow('Plugin id is missing in plugin.json');
+    });
+  });
+});

package/src/utils/pluginValidation.ts

@@ -0,0 +1,44 @@
+export const validatePluginJson = (pluginJson: any) => {
+  if (!pluginJson.id) {
+    throw new Error('Plugin id is missing in plugin.json');
+  }
+
+  if (!pluginJson.info) {
+    throw new Error('Plugin info node is missing in plugin.json');
+  }
+
+  if (!pluginJson.info.version) {
+    throw new Error('Plugin info.version is missing in plugin.json');
+  }
+
+  const types = ['panel', 'datasource', 'app'];
+  const type = pluginJson.type;
+  if (!types.includes(type)) {
+    throw new Error('Invalid plugin type in plugin.json: ' + type);
+  }
+
+  if (!pluginJson.id.endsWith('-' + type)) {
+    throw new Error('[plugin.json] id should end with: -' + type);
+  }
+};
+
+export const getPluginJson = (path: string) => {
+  let pluginJson;
+  try {
+    pluginJson = require(path);
+  } catch (e) {
+    throw new Error('Unable to find: ' + path);
+  }
+
+  validatePluginJson(pluginJson);
+
+  return pluginJson;
+};
+
+export const assertRootUrlIsValid = (rootUrl: string) => {
+  try {
+    new URL(rootUrl);
+  } catch (err) {
+    throw new Error(`${rootUrl} is not a valid URL`);
+  }
+};

package/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "compilerOptions": {
+    "outDir": "./dist"
+  },
+  "exclude": ["node_modules"],
+  "extends": "../../tsconfig.base.json",
+  "include": ["src"]
+}