From ee9649b2a85e806d541ef8a439c292b3a2ff857b Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Thu, 4 Nov 2021 09:27:48 +0100
Subject: [PATCH 1/2] buildGo117{Package,Module}: enable

Required to bump Grafana to 8.2.3 in order to fix CVE-2021-41174.
Building it works fine on both `x86_64-linux` and `aarch64-linux`, so
the only blocker are incompatible hashes.

As long as `buildGoModule` doesn't default to Go 1.17 without a
coordinated update, this should be OK.
---
 pkgs/top-level/all-packages.nix | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0ed423b6e573..9289a02f4b09 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -20237,10 +20237,10 @@ with pkgs;
   # across different go versions and/or platforms:
   # https://github.com/NixOS/nixpkgs/issues/144667
   #
-  # do not uncomment this without approval from the go CODEOWNERS
-  #buildGo117Package = callPackage ../development/go-packages/generic {
-  #  go = buildPackages.go_1_17;
-  #};
+  # That's why `buildGoPackage != buildGo117Package`.
+  buildGo117Package = callPackage ../development/go-packages/generic {
+    go = buildPackages.go_1_17;
+  };
 
   buildGoPackage = buildGo116Package;
 
@@ -20254,10 +20254,10 @@ with pkgs;
   # across different go versions and/or platforms:
   # https://github.com/NixOS/nixpkgs/issues/144667
   #
-  # do not uncomment this without approval from the go CODEOWNERS
-  #buildGo117Module = callPackage ../development/go-modules/generic {
-  #  go = buildPackages.go_1_17;
-  #};
+  # That's why `buildGoModule != buildGo117Module`.
+  buildGo117Module = callPackage ../development/go-modules/generic {
+    go = buildPackages.go_1_17;
+  };
 
   buildGoModule = buildGo116Module;
 

From 7733d9cae98ab91f36d35005d8aef52873d23b5b Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Thu, 4 Nov 2021 09:34:43 +0100
Subject: [PATCH 2/2] grafana: 8.1.6 -> 8.2.3, fix CVE-2021-41174

ChangeLogs:
* https://github.com/grafana/grafana/releases/tag/v8.1.7
* https://github.com/grafana/grafana/releases/tag/v8.2.0
* https://github.com/grafana/grafana/releases/tag/v8.2.1
* https://github.com/grafana/grafana/releases/tag/v8.2.2
* https://github.com/grafana/grafana/releases/tag/v8.2.3

Apart from a few new features, most notably is CVE-2021-41174[1]. Darwin
is temporarily marked as unsupported because Go 1.17 doesn't support the
Apple SDK versions used in `nixpkgs`.

[1] https://nvd.nist.gov/vuln/detail/CVE-2021-41174
---
 pkgs/servers/monitoring/grafana/default.nix | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index 848bcaca4340..1ebac5327339 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -1,8 +1,8 @@
-{ lib, buildGoModule, fetchurl, fetchFromGitHub, nixosTests, tzdata }:
+{ lib, buildGo117Module, fetchurl, fetchFromGitHub, nixosTests, tzdata, wire }:
 
-buildGoModule rec {
+buildGo117Module rec {
   pname = "grafana";
-  version = "8.1.6";
+  version = "8.2.3";
 
   excludedPackages = "\\(alert_webhook_listener\\|clean-swagger\\|release_publisher\\|slow_proxy\\|slow_proxy_mac\\|macaron\\)";
 
@@ -10,17 +10,23 @@ buildGoModule rec {
     rev = "v${version}";
     owner = "grafana";
     repo = "grafana";
-    sha256 = "sha256-PUVRFa3b+O2lY6q3vO+rLUcC+fx80iB78tt60f6Vugk=";
+    sha256 = "sha256-GC4pHwthsXu/+dXb1cBk5bC0O6NnyiChC+UWleq7JzA=";
   };
 
   srcStatic = fetchurl {
     url = "https://dl.grafana.com/oss/release/grafana-${version}.linux-amd64.tar.gz";
-    sha256 = "sha256-So9xzet9kPkjcDwNts3iXlCd+u2uiXTo0LVcLc8toyk=";
+    sha256 = "sha256-LOswYw0P3dy6arrmUbnzBU0ie2YcPtk6xqtp9CowG2s=";
   };
 
-  vendorSha256 = "sha256-dn4sliRp58oZALZ8Iu7kE83ntkcMIU84Xr5WoeXlhCI=";
+  vendorSha256 = "sha256-yZbdUiuRNFRaXduOYps5ygiaUgvNXw+Ah4wZrfYcJlY=";
+
+  nativeBuildInputs = [ wire ];
 
   preBuild = ''
+    # Generate DI code that's required to compile the package.
+    # From https://github.com/grafana/grafana/blob/v8.2.3/Makefile#L33-L35
+    wire gen -tags oss ./pkg/server
+
     # The testcase makes an API call against grafana.com:
     #
     # --- Expected