This is documentation for the next version of Grafana documentation. For the latest stable release, go to the latest version.

Documentation Grafana documentation Administration Plugin management Plugin signatures

Plugin signatures

Plugin signature verification, also known as signing, is a security measure to make sure plugins haven’t been tampered with. Upon loading, Grafana checks to see if a plugin is signed or unsigned when inspecting and verifying its digital signature.

Learn more at plugin policies.

How does verifiction work?

At startup, Grafana verifies the signatures of every plugin in the plugin directory.

To see the result of this verification for each plugin, navigate to Configuration -> Plugins. A signature can have any of the following signature status:

What happens if a plugin is not signed?

If a plugin is unsigned, then Grafana neither loads nor starts it. Grafana also writes an error message to the server log:

Bash Copy

WARN[05-26|12:00:00] Some plugin scanning errors were found   errors="plugin '<plugin id>' is unsigned, plugin '<plugin id>' has an invalid signature"

Plugin signature levels

All plugins are signed under a signature level. The signature level determines how the plugin can be distributed.

Allow unsigned plugins

We strongly recommend that you don’t run unsigned plugins in your Grafana instance. However, if you’re aware of the risks and you still want to load an unsigned plugin, refer to Configuration.

If you’ve allowed loading of an unsigned plugin, then Grafana writes a warning message to the server log:

Bash Copy

WARN[06-01|16:45:59] Running an unsigned plugin   pluginID=<plugin id>

Sign a plugin you’ve developed

If you are a plugin developer and want to know how to sign your plugin, refer to Sign a plugin.