@grafana/sign-plugin 3.3.1 → 3.3.3

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [3.3.3](https://github.com/grafana/plugin-tools/compare/@grafana/sign-plugin@3.3.2...@grafana/sign-plugin@3.3.3) (2026-07-14)
+
+
+### Bug Fixes
+
+* **sign-plugin:** prevent symlink escape check bypass and add test coverage ([#2721](https://github.com/grafana/plugin-tools/issues/2721)) ([4a28227](https://github.com/grafana/plugin-tools/commit/4a2822764abdca815ebe848a3f9678b2b86fa63c))
+
+## [3.3.2](https://github.com/grafana/plugin-tools/compare/@grafana/sign-plugin@3.3.1...@grafana/sign-plugin@3.3.2) (2026-07-09)
+
+
+### Bug Fixes
+
+* replace find-up dependency with native @libs/find-up helper ([#2722](https://github.com/grafana/plugin-tools/issues/2722)) ([d20ff77](https://github.com/grafana/plugin-tools/commit/d20ff7714de762a2d7ce96cf33a37d615e78e77c))
+
 ## [3.3.1](https://github.com/grafana/plugin-tools/compare/@grafana/sign-plugin@3.3.0...@grafana/sign-plugin@3.3.1) (2026-06-11)
 
 

package/dist/commands/sign.command.js

@@ -40,10 +40,11 @@ const sign = async (argv) => {
     if (createPluginVersion) {
       manifest.createPlugin = { version: createPluginVersion };
     }
-    const signedManifest = await signManifest(manifest);
+    const token = getSigningToken();
+    const signedManifest = await signManifest(manifest, token);
     saveManifest(pluginDistDir, signedManifest);
     output.success({
-      title: `Plugin signed successsfully.`,
+      title: `Plugin signed successfully.`,
       body: [`Signed manifest saved to ${pluginDistDir}.`]
     });
   } catch (err) {
@@ -56,5 +57,26 @@ const sign = async (argv) => {
     process.exit(1);
   }
 };
+function getSigningToken() {
+  const GRAFANA_API_KEY = process.env.GRAFANA_API_KEY;
+  const GRAFANA_ACCESS_POLICY_TOKEN = process.env.GRAFANA_ACCESS_POLICY_TOKEN;
+  const token = GRAFANA_ACCESS_POLICY_TOKEN ? GRAFANA_ACCESS_POLICY_TOKEN : GRAFANA_API_KEY;
+  if (!token) {
+    output.error({
+      title: "Missing GRAFANA_ACCESS_POLICY_TOKEN.",
+      body: ["You must create a GRAFANA_ACCESS_POLICY_TOKEN env variable to sign plugins."],
+      link: "https://grafana.com/developers/plugin-tools/publish-a-plugin/sign-a-plugin#generate-an-access-policy-token"
+    });
+    process.exit(1);
+  }
+  if (GRAFANA_API_KEY) {
+    output.warning({
+      title: "Usage of GRAFANA_API_KEY is deprecated.",
+      body: ["Please migrate to using a GRAFANA_ACCESS_POLICY_TOKEN instead."],
+      link: "https://grafana.com/developers/plugin-tools/publish-a-plugin/sign-a-plugin"
+    });
+  }
+  return token;
+}
 
 export { sign };

package/dist/libs/find-up/src/index.js

@@ -0,0 +1,22 @@
+import { statSync } from 'node:fs';
+import path from 'node:path';
+
+function findUpSync(name, options = {}) {
+  const names = Array.isArray(name) ? name : [name];
+  let currentDir = path.resolve(options.cwd ?? process.cwd());
+  let previousDir;
+  while (currentDir !== previousDir) {
+    for (const candidateName of names) {
+      const candidatePath = path.join(currentDir, candidateName);
+      const stat = statSync(candidatePath, { throwIfNoEntry: false });
+      if (stat?.isFile()) {
+        return candidatePath;
+      }
+    }
+    previousDir = currentDir;
+    currentDir = path.dirname(currentDir);
+  }
+  return void 0;
+}
+
+export { findUpSync };

package/dist/libs/version/src/index.js

@@ -1,4 +1,4 @@
-import { findUpSync } from 'find-up';
+import { findUpSync } from '../../find-up/src/index.js';
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 

package/dist/utils/manifest.js

@@ -3,8 +3,6 @@ import { readFileSync, writeFileSync } from 'node:fs';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { postData } from './request.js';
-import { output } from './utils.output.js';
-import { styleText } from 'node:util';
 
 const MANIFEST_FILE = "MANIFEST.txt";
 async function* walk(dir, baseDir) {
@@ -16,7 +14,9 @@ async function* walk(dir, baseDir) {
       yield path.relative(baseDir, entry);
     } else if (d.isSymbolicLink()) {
       const realPath = await fs.realpath(entry);
-      if (!realPath.startsWith(baseDir)) {
+      const relativeToBase = path.relative(baseDir, realPath);
+      const isOutsideBaseDir = relativeToBase === ".." || relativeToBase.startsWith(".." + path.sep) || path.isAbsolute(relativeToBase);
+      if (isOutsideBaseDir) {
         throw new Error(
           `symbolic link ${path.relative(baseDir, entry)} targets a file outside of the base directory: ${baseDir}`
         );
@@ -29,65 +29,42 @@ async function* walk(dir, baseDir) {
   }
 }
 async function buildManifest(dir) {
-  const pluginJson = JSON.parse(readFileSync(path.join(dir, "plugin.json"), { encoding: "utf8" }));
+  const baseDir = await fs.realpath(dir);
+  const pluginJson = JSON.parse(readFileSync(path.join(baseDir, "plugin.json"), { encoding: "utf8" }));
   const manifest = {
     plugin: pluginJson.id,
     version: pluginJson.info.version,
     files: {}
   };
-  for await (const filePath of await walk(dir, dir)) {
+  for await (const filePath of await walk(baseDir, baseDir)) {
     if (filePath === MANIFEST_FILE) {
       continue;
     }
     const sanitisedFilePath = filePath.split(path.sep).join(path.posix.sep);
-    manifest.files[sanitisedFilePath] = crypto.createHash("sha256").update(readFileSync(path.join(dir, filePath))).digest("hex");
+    manifest.files[sanitisedFilePath] = crypto.createHash("sha256").update(readFileSync(path.join(baseDir, filePath))).digest("hex");
   }
   return manifest;
 }
-async function signManifest(manifest) {
-  const GRAFANA_API_KEY = process.env.GRAFANA_API_KEY;
-  const GRAFANA_ACCESS_POLICY_TOKEN = process.env.GRAFANA_ACCESS_POLICY_TOKEN;
-  if (!GRAFANA_ACCESS_POLICY_TOKEN && !GRAFANA_API_KEY) {
-    output.error({
-      title: "Missing GRAFANA_ACCESS_POLICY_TOKEN.",
-      body: ["You must create a GRAFANA_ACCESS_POLICY_TOKEN env variable to sign plugins."],
-      link: "https://grafana.com/developers/plugin-tools/publish-a-plugin/sign-a-plugin#generate-an-access-policy-token"
-    });
-    process.exit(1);
-  }
-  if (GRAFANA_API_KEY) {
-    output.warning({
-      title: "Usage of GRAFANA_API_KEY is deprecated.",
-      body: ["Please migrate to using a GRAFANA_ACCESS_POLICY_TOKEN instead."],
-      link: "https://grafana.com/developers/plugin-tools/publish-a-plugin/sign-a-plugin"
-    });
-  }
+async function signManifest(manifest, token) {
   const GRAFANA_COM_URL = process.env.GRAFANA_COM_URL || "https://grafana.com/api";
   const url = GRAFANA_COM_URL + "/plugins/ci/sign";
-  const token = GRAFANA_ACCESS_POLICY_TOKEN ? GRAFANA_ACCESS_POLICY_TOKEN : GRAFANA_API_KEY;
+  const info = await postData(url, manifest, {
+    Authorization: "Bearer " + token
+  });
+  if (info.status !== 200) {
+    throw new Error(`Server responded with status code ${info.status} along with: ${formatServerError(info.data)}`);
+  }
+  return info.data;
+}
+function formatServerError(data) {
   try {
-    const info = await postData(url, manifest, {
-      Authorization: "Bearer " + token
-    });
-    if (info.status !== 200) {
-      const dataAsArray = Object.entries(JSON.parse(info.data)).map(([key, value]) => `${key}: ${value}`);
-      output.error({
-        title: "Error signing manifest.",
-        body: [
-          `Server responded with status code ${styleText(["yellow"], info.status.toString())} along with:`,
-          ...output.bulletList(dataAsArray)
-        ]
-      });
-      process.exit(1);
+    const parsed = JSON.parse(data);
+    if (parsed === null || typeof parsed !== "object") {
+      return String(parsed);
     }
-    return info.data;
+    return Object.entries(parsed).map(([key, value]) => `${key}: ${typeof value === "string" ? value : JSON.stringify(value)}`).join(", ");
   } catch (err) {
-    const body = err.response?.data?.message ? [err.response.data.message] : [err.message];
-    output.error({
-      title: "Error signing manifest.",
-      body
-    });
-    process.exit(1);
+    return data;
   }
 }
 function saveManifest(dir, signedManifest) {
@@ -95,11 +72,7 @@ function saveManifest(dir, signedManifest) {
     writeFileSync(path.join(dir, MANIFEST_FILE), signedManifest);
     return true;
   } catch (error) {
-    output.error({
-      title: "Error saving manifest",
-      body: [`Failed to write signed manifest to ${dir}.`]
-    });
-    process.exit(1);
+    throw new Error(`Failed to write signed manifest to ${dir}.`, { cause: error });
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@grafana/sign-plugin",
-  "version": "3.3.1",
+  "version": "3.3.3",
   "repository": {
     "type": "git",
     "directory": "packages/sign-plugin",
@@ -26,14 +26,16 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "find-up": "8.0.0",
     "minimist": "1.2.8",
     "proxy-agent": "8.0.1"
   },
   "devDependencies": {
+    "@libs/find-up": "^1.0.0",
     "@libs/output": "^1.0.3",
     "@libs/version": "^1.0.2",
-    "@types/minimist": "^1.2.5"
+    "@types/minimist": "^1.2.5",
+    "@types/tmp": "0.2.6",
+    "tmp": "0.2.7"
   },
   "engines": {
     "node": ">=20"

package/src/commands/sign.command.test.ts

@@ -0,0 +1,194 @@
+import minimist from 'minimist';
+import { existsSync, readFileSync, rmSync } from 'node:fs';
+import path from 'node:path';
+import { MockInstance, vi } from 'vitest';
+import { sign } from './sign.command.js';
+import { ManifestInfo } from '../utils/manifest.js';
+import { createPluginDistDir, createTempDir, writeFiles } from '../utils/tests/fixtures.js';
+
+const mocks = vi.hoisted(() => {
+  return {
+    postData: vi.fn(),
+  };
+});
+
+vi.mock('../utils/request.js', () => {
+  return { postData: mocks.postData };
+});
+
+const PROCESS_EXIT_MESSAGE = 'process.exit called';
+
+function argvFor(args: Record<string, unknown> = {}): minimist.ParsedArgs {
+  return { _: [], ...args } as minimist.ParsedArgs;
+}
+
+function getPostedManifest(): ManifestInfo {
+  return mocks.postData.mock.calls[0][1] as ManifestInfo;
+}
+
+describe('sign command', () => {
+  const tempDirs: string[] = [];
+  let stdoutSpy: MockInstance<typeof process.stdout.write>;
+  let exitSpy: MockInstance<typeof process.exit>;
+
+  function pluginDistDir(files: Record<string, string> = {}) {
+    const dir = createPluginDistDir(files);
+    tempDirs.push(dir);
+    return dir;
+  }
+
+  beforeEach(() => {
+    exitSpy = vi.spyOn(process, 'exit').mockImplementation(() => {
+      throw new Error(PROCESS_EXIT_MESSAGE);
+    });
+    stdoutSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+    vi.stubEnv('GRAFANA_ACCESS_POLICY_TOKEN', 'test-token');
+    vi.stubEnv('GRAFANA_API_KEY', undefined);
+    vi.stubEnv('GRAFANA_COM_URL', undefined);
+    mocks.postData.mockReset().mockResolvedValue({ status: 200, data: 'SIGNED-MANIFEST' });
+  });
+
+  afterEach(() => {
+    vi.unstubAllEnvs();
+    vi.restoreAllMocks();
+  });
+
+  afterAll(() => {
+    tempDirs.forEach((dir) => rmSync(dir, { recursive: true, force: true }));
+  });
+
+  it('should exit when the plugin dist directory does not exist', async () => {
+    await expect(sign(argvFor({ distDir: '/path/that/does/not/exist' }))).rejects.toThrow(PROCESS_EXIT_MESSAGE);
+
+    expect(exitSpy).toHaveBeenCalledWith(1);
+    expect(mocks.postData).not.toHaveBeenCalled();
+  });
+
+  it('should post the manifest to the Grafana API and save the signed response', async () => {
+    const dir = pluginDistDir({ 'module.js': 'export {};' });
+
+    await sign(argvFor({ distDir: dir }));
+
+    const [url, manifest, headers] = mocks.postData.mock.calls[0];
+    expect(url).toBe('https://grafana.com/api/plugins/ci/sign');
+    expect(headers).toEqual({ Authorization: 'Bearer test-token' });
+    expect(manifest).toMatchObject({
+      plugin: 'grafana-test-app',
+      version: '1.0.0',
+      signPlugin: { version: expect.any(String) },
+    });
+    expect(readFileSync(path.join(dir, 'MANIFEST.txt'), 'utf-8')).toBe('SIGNED-MANIFEST');
+  });
+
+  it('should respect the GRAFANA_COM_URL environment variable', async () => {
+    vi.stubEnv('GRAFANA_COM_URL', 'https://grafana-dev.com/api');
+    const dir = pluginDistDir();
+
+    await sign(argvFor({ distDir: dir }));
+
+    expect(mocks.postData.mock.calls[0][0]).toBe('https://grafana-dev.com/api/plugins/ci/sign');
+  });
+
+  it('should pass signatureType and rootUrls to the manifest', async () => {
+    const dir = pluginDistDir();
+
+    await sign(
+      argvFor({
+        distDir: dir,
+        signatureType: 'private',
+        rootUrls: 'https://example.com/grafana,https://grafana.example.com',
+      })
+    );
+
+    expect(getPostedManifest()).toMatchObject({
+      signatureType: 'private',
+      rootUrls: ['https://example.com/grafana', 'https://grafana.example.com'],
+    });
+  });
+
+  it('should exit without calling the API when a root URL is invalid', async () => {
+    const dir = pluginDistDir();
+
+    await expect(sign(argvFor({ distDir: dir, rootUrls: 'not-a-valid-url' }))).rejects.toThrow(PROCESS_EXIT_MESSAGE);
+
+    expect(exitSpy).toHaveBeenCalledWith(1);
+    expect(mocks.postData).not.toHaveBeenCalled();
+    expect(existsSync(path.join(dir, 'MANIFEST.txt'))).toBe(false);
+  });
+
+  it('should exit without calling the API when no token is configured', async () => {
+    vi.stubEnv('GRAFANA_ACCESS_POLICY_TOKEN', undefined);
+    const dir = pluginDistDir();
+
+    await expect(sign(argvFor({ distDir: dir }))).rejects.toThrow(PROCESS_EXIT_MESSAGE);
+
+    expect(exitSpy).toHaveBeenCalledWith(1);
+    expect(mocks.postData).not.toHaveBeenCalled();
+  });
+
+  it('should report an invalid root URL before a missing token', async () => {
+    vi.stubEnv('GRAFANA_ACCESS_POLICY_TOKEN', undefined);
+    const dir = pluginDistDir();
+
+    await expect(sign(argvFor({ distDir: dir, rootUrls: 'not-a-valid-url' }))).rejects.toThrow(PROCESS_EXIT_MESSAGE);
+
+    const stdout = stdoutSpy.mock.calls.map((call) => String(call[0])).join('');
+    expect(stdout).toContain('not-a-valid-url is not a valid URL');
+    expect(stdout).not.toContain('Missing GRAFANA_ACCESS_POLICY_TOKEN');
+  });
+
+  it('should prefer GRAFANA_ACCESS_POLICY_TOKEN over GRAFANA_API_KEY but still warn about deprecation', async () => {
+    vi.stubEnv('GRAFANA_API_KEY', 'legacy-api-key');
+    const dir = pluginDistDir();
+
+    await sign(argvFor({ distDir: dir }));
+
+    const stdout = stdoutSpy.mock.calls.map((call) => String(call[0])).join('');
+    expect(stdout).toContain('deprecated');
+    expect(mocks.postData.mock.calls[0][2]).toEqual({ Authorization: 'Bearer test-token' });
+  });
+
+  it('should warn about deprecation but proceed when only GRAFANA_API_KEY is set', async () => {
+    vi.stubEnv('GRAFANA_ACCESS_POLICY_TOKEN', undefined);
+    vi.stubEnv('GRAFANA_API_KEY', 'legacy-api-key');
+    const dir = pluginDistDir();
+
+    await sign(argvFor({ distDir: dir }));
+
+    const stdout = stdoutSpy.mock.calls.map((call) => String(call[0])).join('');
+    expect(stdout).toContain('deprecated');
+    expect(mocks.postData.mock.calls[0][2]).toEqual({ Authorization: 'Bearer legacy-api-key' });
+  });
+
+  it('should exit without saving the manifest when the API responds with an error', async () => {
+    mocks.postData.mockResolvedValue({ status: 400, data: JSON.stringify({ message: 'invalid plugin' }) });
+    const dir = pluginDistDir();
+
+    await expect(sign(argvFor({ distDir: dir }))).rejects.toThrow(PROCESS_EXIT_MESSAGE);
+
+    expect(exitSpy).toHaveBeenCalledWith(1);
+    expect(existsSync(path.join(dir, 'MANIFEST.txt'))).toBe(false);
+  });
+
+  it('should exit when the API request fails', async () => {
+    mocks.postData.mockRejectedValue(new Error('socket hang up'));
+    const dir = pluginDistDir();
+
+    await expect(sign(argvFor({ distDir: dir }))).rejects.toThrow(PROCESS_EXIT_MESSAGE);
+
+    expect(exitSpy).toHaveBeenCalledWith(1);
+    expect(existsSync(path.join(dir, 'MANIFEST.txt'))).toBe(false);
+  });
+
+  it('should add the create-plugin version from .config/.cprc.json to the manifest', async () => {
+    const cwdDir = createTempDir();
+    tempDirs.push(cwdDir);
+    writeFiles(cwdDir, { '.config/.cprc.json': JSON.stringify({ version: '5.0.0' }) });
+    vi.spyOn(process, 'cwd').mockReturnValue(cwdDir);
+    const dir = pluginDistDir();
+
+    await sign(argvFor({ distDir: dir }));
+
+    expect(getPostedManifest().createPlugin).toEqual({ version: '5.0.0' });
+  });
+});

package/src/commands/sign.command.ts

@@ -46,11 +46,12 @@ export const sign = async (argv: minimist.ParsedArgs) => {
       manifest.createPlugin = { version: createPluginVersion };
     }
 
-    const signedManifest = await signManifest(manifest);
+    const token = getSigningToken();
+    const signedManifest = await signManifest(manifest, token);
 
     saveManifest(pluginDistDir, signedManifest);
     output.success({
-      title: `Plugin signed successsfully.`,
+      title: `Plugin signed successfully.`,
       body: [`Signed manifest saved to ${pluginDistDir}.`],
     });
   } catch (err) {
@@ -63,3 +64,27 @@ export const sign = async (argv: minimist.ParsedArgs) => {
     process.exit(1);
   }
 };
+
+function getSigningToken(): string {
+  const GRAFANA_API_KEY = process.env.GRAFANA_API_KEY;
+  const GRAFANA_ACCESS_POLICY_TOKEN = process.env.GRAFANA_ACCESS_POLICY_TOKEN;
+  const token = GRAFANA_ACCESS_POLICY_TOKEN ? GRAFANA_ACCESS_POLICY_TOKEN : GRAFANA_API_KEY;
+
+  if (!token) {
+    output.error({
+      title: 'Missing GRAFANA_ACCESS_POLICY_TOKEN.',
+      body: ['You must create a GRAFANA_ACCESS_POLICY_TOKEN env variable to sign plugins.'],
+      link: 'https://grafana.com/developers/plugin-tools/publish-a-plugin/sign-a-plugin#generate-an-access-policy-token',
+    });
+    process.exit(1);
+  }
+  if (GRAFANA_API_KEY) {
+    output.warning({
+      title: 'Usage of GRAFANA_API_KEY is deprecated.',
+      body: ['Please migrate to using a GRAFANA_ACCESS_POLICY_TOKEN instead.'],
+      link: 'https://grafana.com/developers/plugin-tools/publish-a-plugin/sign-a-plugin',
+    });
+  }
+
+  return token;
+}

package/src/utils/getCreatePluginVersion.test.ts

@@ -0,0 +1,41 @@
+import { rmSync } from 'node:fs';
+import { vi } from 'vitest';
+import { getCreatePluginVersion } from './getCreatePluginVersion.js';
+import { createTempDir, writeFiles } from './tests/fixtures.js';
+
+describe('getCreatePluginVersion', () => {
+  const tempDirs: string[] = [];
+
+  function mockCwd(files: Record<string, string> = {}) {
+    const dir = createTempDir();
+    tempDirs.push(dir);
+    writeFiles(dir, files);
+    vi.spyOn(process, 'cwd').mockReturnValue(dir);
+  }
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  afterAll(() => {
+    tempDirs.forEach((dir) => rmSync(dir, { recursive: true, force: true }));
+  });
+
+  it('should return the version from .config/.cprc.json', () => {
+    mockCwd({ '.config/.cprc.json': JSON.stringify({ version: '5.0.0' }) });
+
+    expect(getCreatePluginVersion()).toBe('5.0.0');
+  });
+
+  it('should return null when .config/.cprc.json does not exist', () => {
+    mockCwd();
+
+    expect(getCreatePluginVersion()).toBeNull();
+  });
+
+  it('should return null when .config/.cprc.json is malformed', () => {
+    mockCwd({ '.config/.cprc.json': 'not-valid-json' });
+
+    expect(getCreatePluginVersion()).toBeNull();
+  });
+});

package/src/utils/manifest.test.ts

@@ -0,0 +1,209 @@
+import crypto from 'node:crypto';
+import { readFileSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+import { vi } from 'vitest';
+import { buildManifest, ManifestInfo, saveManifest, signManifest } from './manifest.js';
+import { createPluginDistDir, createTempDir, DEFAULT_PLUGIN_JSON, writeFiles } from './tests/fixtures.js';
+
+const mocks = vi.hoisted(() => {
+  return {
+    postData: vi.fn(),
+  };
+});
+
+vi.mock('./request.js', () => {
+  return { postData: mocks.postData };
+});
+
+function sha256(content: string) {
+  return crypto.createHash('sha256').update(content).digest('hex');
+}
+
+describe('buildManifest', () => {
+  const tempDirs: string[] = [];
+
+  function pluginDistDir(files: Record<string, string> = {}, pluginJson: object = DEFAULT_PLUGIN_JSON) {
+    const dir = createPluginDistDir(files, pluginJson);
+    tempDirs.push(dir);
+    return dir;
+  }
+
+  afterAll(() => {
+    tempDirs.forEach((dir) => rmSync(dir, { recursive: true, force: true }));
+  });
+
+  it('should build a manifest with the plugin id, version and a sha256 hash per file', async () => {
+    const dir = pluginDistDir({
+      'module.js': 'console.log("hello");',
+      'README.md': '# readme',
+    });
+
+    const manifest = await buildManifest(dir);
+
+    expect(manifest.plugin).toBe('grafana-test-app');
+    expect(manifest.version).toBe('1.0.0');
+    expect(manifest.files).toEqual({
+      'plugin.json': sha256(JSON.stringify(DEFAULT_PLUGIN_JSON)),
+      'module.js': sha256('console.log("hello");'),
+      'README.md': sha256('# readme'),
+    });
+  });
+
+  it('should include files in nested directories using posix paths', async () => {
+    const dir = pluginDistDir({
+      'img/logo.svg': '<svg></svg>',
+      'nested/deeply/file.txt': 'nested content',
+    });
+
+    const manifest = await buildManifest(dir);
+
+    expect(manifest.files['img/logo.svg']).toBe(sha256('<svg></svg>'));
+    expect(manifest.files['nested/deeply/file.txt']).toBe(sha256('nested content'));
+    expect(Object.keys(manifest.files).every((filePath) => !filePath.includes('\\'))).toBe(true);
+  });
+
+  it('should exclude an existing MANIFEST.txt from the manifest', async () => {
+    const dir = pluginDistDir({
+      'module.js': 'export {};',
+      'MANIFEST.txt': 'a previously signed manifest',
+    });
+
+    const manifest = await buildManifest(dir);
+
+    expect(manifest.files['MANIFEST.txt']).toBeUndefined();
+    expect(manifest.files['module.js']).toBeDefined();
+  });
+
+  it('should include symbolic links that resolve to files inside the plugin directory', async () => {
+    const dir = pluginDistDir({
+      'module.js': 'export {};',
+    });
+    symlinkSync(path.join(dir, 'module.js'), path.join(dir, 'module-link.js'));
+
+    const manifest = await buildManifest(dir);
+
+    expect(manifest.files['module.js']).toBe(sha256('export {};'));
+    expect(manifest.files['module-link.js']).toBe(sha256('export {};'));
+  });
+
+  it('should throw when a symbolic link targets a file outside the plugin directory', async () => {
+    const outsideDir = createTempDir();
+    tempDirs.push(outsideDir);
+    writeFiles(outsideDir, { 'secret.txt': 'secret' });
+
+    const dir = pluginDistDir();
+    symlinkSync(path.join(outsideDir, 'secret.txt'), path.join(dir, 'secret-link.txt'));
+
+    await expect(buildManifest(dir)).rejects.toThrow(/targets a file outside of the base directory/);
+  });
+
+  it('should throw when a symbolic link targets a sibling directory sharing the plugin directory prefix', async () => {
+    const containerDir = createTempDir();
+    tempDirs.push(containerDir);
+    const dir = path.join(containerDir, 'plugin');
+    const siblingDir = path.join(containerDir, 'plugin-evil');
+    writeFiles(dir, { 'plugin.json': JSON.stringify(DEFAULT_PLUGIN_JSON) });
+    writeFiles(siblingDir, { 'secret.txt': 'secret' });
+    symlinkSync(path.join(siblingDir, 'secret.txt'), path.join(dir, 'secret-link.txt'));
+
+    await expect(buildManifest(dir)).rejects.toThrow(/targets a file outside of the base directory/);
+  });
+
+  it('should throw when plugin.json is missing', async () => {
+    const dir = createTempDir();
+    tempDirs.push(dir);
+    writeFileSync(path.join(dir, 'module.js'), 'export {};');
+
+    await expect(buildManifest(dir)).rejects.toThrow();
+  });
+});
+
+describe('signManifest', () => {
+  const manifest: ManifestInfo = {
+    plugin: 'grafana-test-app',
+    version: '1.0.0',
+    files: { 'plugin.json': 'hash' },
+  };
+
+  beforeEach(() => {
+    vi.stubEnv('GRAFANA_COM_URL', undefined);
+    mocks.postData.mockReset();
+  });
+
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it('should return the signed manifest when the API responds with status 200', async () => {
+    mocks.postData.mockResolvedValue({ status: 200, data: 'SIGNED-MANIFEST' });
+
+    const signedManifest = await signManifest(manifest, 'test-token');
+
+    expect(signedManifest).toBe('SIGNED-MANIFEST');
+    expect(mocks.postData).toHaveBeenCalledWith('https://grafana.com/api/plugins/ci/sign', manifest, {
+      Authorization: 'Bearer test-token',
+    });
+  });
+
+  it('should throw with the status code and server details when the API responds with an error', async () => {
+    mocks.postData.mockResolvedValue({ status: 400, data: JSON.stringify({ message: 'invalid plugin' }) });
+
+    await expect(signManifest(manifest, 'test-token')).rejects.toThrow(
+      'Server responded with status code 400 along with: message: invalid plugin'
+    );
+  });
+
+  it('should throw with the raw response body when the error response is not JSON', async () => {
+    mocks.postData.mockResolvedValue({ status: 500, data: 'Internal Server Error' });
+
+    await expect(signManifest(manifest, 'test-token')).rejects.toThrow(
+      'Server responded with status code 500 along with: Internal Server Error'
+    );
+  });
+
+  it('should stringify nested JSON values instead of rendering [object Object]', async () => {
+    mocks.postData.mockResolvedValue({ status: 422, data: JSON.stringify({ errors: { rootUrls: 'invalid' } }) });
+
+    await expect(signManifest(manifest, 'test-token')).rejects.toThrow(
+      'Server responded with status code 422 along with: errors: {"rootUrls":"invalid"}'
+    );
+  });
+
+  it('should handle a JSON primitive error body without a dangling message', async () => {
+    mocks.postData.mockResolvedValue({ status: 400, data: JSON.stringify('invalid plugin') });
+
+    await expect(signManifest(manifest, 'test-token')).rejects.toThrow(
+      'Server responded with status code 400 along with: invalid plugin'
+    );
+  });
+
+  it('should propagate network errors', async () => {
+    mocks.postData.mockRejectedValue(new Error('socket hang up'));
+
+    await expect(signManifest(manifest, 'test-token')).rejects.toThrow('socket hang up');
+  });
+});
+
+describe('saveManifest', () => {
+  const tempDirs: string[] = [];
+
+  afterAll(() => {
+    tempDirs.forEach((dir) => rmSync(dir, { recursive: true, force: true }));
+  });
+
+  it('should write the signed manifest to MANIFEST.txt', () => {
+    const dir = createTempDir();
+    tempDirs.push(dir);
+
+    const result = saveManifest(dir, 'SIGNED-MANIFEST');
+
+    expect(result).toBe(true);
+    expect(readFileSync(path.join(dir, 'MANIFEST.txt'), 'utf-8')).toBe('SIGNED-MANIFEST');
+  });
+
+  it('should throw when the directory is not writable', () => {
+    expect(() => saveManifest('/path/that/does/not/exist', 'SIGNED-MANIFEST')).toThrow(
+      'Failed to write signed manifest to /path/that/does/not/exist.'
+    );
+  });
+});

package/src/utils/manifest.ts

@@ -3,8 +3,6 @@ import { readFileSync, writeFileSync } from 'node:fs';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { postData } from './request.js';
-import { output } from './utils.output.js';
-import { styleText } from 'node:util';
 
 const MANIFEST_FILE = 'MANIFEST.txt';
 
@@ -37,7 +35,11 @@ async function* walk(dir: string, baseDir: string): RecursiveWalk {
       yield path.relative(baseDir, entry);
     } else if (d.isSymbolicLink()) {
       const realPath = await fs.realpath(entry);
-      if (!realPath.startsWith(baseDir)) {
+      // A prefix check would treat sibling paths like <baseDir>-evil as inside the base directory.
+      const relativeToBase = path.relative(baseDir, realPath);
+      const isOutsideBaseDir =
+        relativeToBase === '..' || relativeToBase.startsWith('..' + path.sep) || path.isAbsolute(relativeToBase);
+      if (isOutsideBaseDir) {
         throw new Error(
           `symbolic link ${path.relative(baseDir, entry)} targets a file outside of the base directory: ${baseDir}`
         );
@@ -52,7 +54,11 @@ async function* walk(dir: string, baseDir: string): RecursiveWalk {
 }
 
 export async function buildManifest(dir: string): Promise<ManifestInfo> {
-  const pluginJson = JSON.parse(readFileSync(path.join(dir, 'plugin.json'), { encoding: 'utf8' }));
+  // Canonicalize the base directory once so the symlink-escape check in `walk`
+  // compares like-for-like. Without this, a dist path containing symlinks (e.g.
+  // macOS `/var` -> `/private/var`) makes internal symlinks look "outside".
+  const baseDir = await fs.realpath(dir);
+  const pluginJson = JSON.parse(readFileSync(path.join(baseDir, 'plugin.json'), { encoding: 'utf8' }));
 
   const manifest = {
     plugin: pluginJson.id,
@@ -60,7 +66,7 @@ export async function buildManifest(dir: string): Promise<ManifestInfo> {
     files: {},
   } as ManifestInfo;
 
-  for await (const filePath of await walk(dir, dir)) {
+  for await (const filePath of await walk(baseDir, baseDir)) {
     if (filePath === MANIFEST_FILE) {
       continue;
     }
@@ -72,61 +78,40 @@ export async function buildManifest(dir: string): Promise<ManifestInfo> {
 
     manifest.files[sanitisedFilePath] = crypto
       .createHash('sha256')
-      .update(readFileSync(path.join(dir, filePath)))
+      .update(readFileSync(path.join(baseDir, filePath)))
       .digest('hex');
   }
 
   return manifest;
 }
 
-export async function signManifest(manifest: ManifestInfo): Promise<string> {
-  const GRAFANA_API_KEY = process.env.GRAFANA_API_KEY;
-  const GRAFANA_ACCESS_POLICY_TOKEN = process.env.GRAFANA_ACCESS_POLICY_TOKEN;
-
-  if (!GRAFANA_ACCESS_POLICY_TOKEN && !GRAFANA_API_KEY) {
-    output.error({
-      title: 'Missing GRAFANA_ACCESS_POLICY_TOKEN.',
-      body: ['You must create a GRAFANA_ACCESS_POLICY_TOKEN env variable to sign plugins.'],
-      link: 'https://grafana.com/developers/plugin-tools/publish-a-plugin/sign-a-plugin#generate-an-access-policy-token',
-    });
-    process.exit(1);
-  }
-  if (GRAFANA_API_KEY) {
-    output.warning({
-      title: 'Usage of GRAFANA_API_KEY is deprecated.',
-      body: ['Please migrate to using a GRAFANA_ACCESS_POLICY_TOKEN instead.'],
-      link: 'https://grafana.com/developers/plugin-tools/publish-a-plugin/sign-a-plugin',
-    });
-  }
-
+export async function signManifest(manifest: ManifestInfo, token: string): Promise<string> {
   const GRAFANA_COM_URL = process.env.GRAFANA_COM_URL || 'https://grafana.com/api';
   const url = GRAFANA_COM_URL + '/plugins/ci/sign';
 
-  const token = GRAFANA_ACCESS_POLICY_TOKEN ? GRAFANA_ACCESS_POLICY_TOKEN : GRAFANA_API_KEY;
+  const info = await postData(url, manifest, {
+    Authorization: 'Bearer ' + token,
+  });
+
+  if (info.status !== 200) {
+    throw new Error(`Server responded with status code ${info.status} along with: ${formatServerError(info.data)}`);
+  }
+
+  return info.data;
+}
+
+function formatServerError(data: string): string {
   try {
-    const info = await postData(url, manifest, {
-      Authorization: 'Bearer ' + token,
-    });
-    if (info.status !== 200) {
-      const dataAsArray = Object.entries(JSON.parse(info.data)).map(([key, value]) => `${key}: ${value}`);
-      output.error({
-        title: 'Error signing manifest.',
-        body: [
-          `Server responded with status code ${styleText(['yellow'], info.status.toString())} along with:`,
-          ...output.bulletList(dataAsArray),
-        ],
-      });
-      process.exit(1);
+    const parsed = JSON.parse(data);
+    // A JSON primitive (string/number/boolean/null) has no entries to map over.
+    if (parsed === null || typeof parsed !== 'object') {
+      return String(parsed);
     }
-
-    return info.data;
-  } catch (err: any) {
-    const body = err.response?.data?.message ? [err.response.data.message] : [err.message];
-    output.error({
-      title: 'Error signing manifest.',
-      body,
-    });
-    process.exit(1);
+    return Object.entries(parsed)
+      .map(([key, value]) => `${key}: ${typeof value === 'string' ? value : JSON.stringify(value)}`)
+      .join(', ');
+  } catch (err) {
+    return data;
   }
 }
 
@@ -135,10 +120,6 @@ export function saveManifest(dir: string, signedManifest: string) {
     writeFileSync(path.join(dir, MANIFEST_FILE), signedManifest);
     return true;
   } catch (error) {
-    output.error({
-      title: 'Error saving manifest',
-      body: [`Failed to write signed manifest to ${dir}.`],
-    });
-    process.exit(1);
+    throw new Error(`Failed to write signed manifest to ${dir}.`, { cause: error });
   }
 }

package/src/utils/pluginValidation.test.ts

@@ -1,4 +1,4 @@
-import { getPluginJson, validatePluginJson } from './pluginValidation.js';
+import { assertRootUrlIsValid, getPluginJson, validatePluginJson } from './pluginValidation.js';
 
 describe('pluginValidation', () => {
   describe('plugin.json', () => {
@@ -11,5 +11,43 @@ describe('pluginValidation', () => {
     test('missing "id" field in the plugin.json file', () => {
       expect(() => validatePluginJson({})).toThrow('Plugin id is missing in plugin.json');
     });
+
+    test('missing "info" node in the plugin.json file', () => {
+      expect(() => validatePluginJson({ id: 'grafana-test-app' })).toThrow(
+        'Plugin info node is missing in plugin.json'
+      );
+    });
+
+    test('missing "info.version" field in the plugin.json file', () => {
+      expect(() => validatePluginJson({ id: 'grafana-test-app', info: {} })).toThrow(
+        'Plugin info.version is missing in plugin.json'
+      );
+    });
+
+    test('invalid plugin type', () => {
+      expect(() =>
+        validatePluginJson({ id: 'grafana-test-app', info: { version: '1.0.0' }, type: 'renderer' })
+      ).toThrow('Invalid plugin type in plugin.json: renderer');
+    });
+
+    test('plugin id not ending with the plugin type', () => {
+      expect(() =>
+        validatePluginJson({ id: 'grafana-test-datasource', info: { version: '1.0.0' }, type: 'app' })
+      ).toThrow('[plugin.json] id should end with: -app');
+    });
+
+    test.each(['app', 'datasource', 'panel'])('valid plugin.json with type %s', (type) => {
+      expect(() => validatePluginJson({ id: `grafana-test-${type}`, info: { version: '1.0.0' }, type })).not.toThrow();
+    });
+  });
+
+  describe('assertRootUrlIsValid', () => {
+    test('valid root URL', () => {
+      expect(() => assertRootUrlIsValid('https://example.com/grafana')).not.toThrow();
+    });
+
+    test('invalid root URL', () => {
+      expect(() => assertRootUrlIsValid('not-a-valid-url')).toThrow('not-a-valid-url is not a valid URL');
+    });
   });
 });

package/src/utils/tests/fixtures.ts

@@ -0,0 +1,34 @@
+import { mkdirSync, realpathSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+import { dirSync } from 'tmp';
+
+export const DEFAULT_PLUGIN_JSON = {
+  id: 'grafana-test-app',
+  type: 'app',
+  info: {
+    version: '1.0.0',
+  },
+};
+
+// realpathSync prevents false symlink-escape errors on macOS where the temp dir
+// lives under /var/... which resolves to /private/var/...
+export function createTempDir(): string {
+  return realpathSync(dirSync({ prefix: 'sign-plugin-test-', unsafeCleanup: true }).name);
+}
+
+export function writeFiles(dir: string, files: Record<string, string>): void {
+  for (const [relativePath, content] of Object.entries(files)) {
+    const filePath = path.join(dir, relativePath);
+    mkdirSync(path.dirname(filePath), { recursive: true });
+    writeFileSync(filePath, content);
+  }
+}
+
+export function createPluginDistDir(files: Record<string, string> = {}, pluginJson: object = DEFAULT_PLUGIN_JSON) {
+  const dir = createTempDir();
+  writeFiles(dir, {
+    'plugin.json': JSON.stringify(pluginJson),
+    ...files,
+  });
+  return dir;
+}