Important: This documentation is about an older version. It's relevant only to the release noted, many of the features and functions have been updated or replaced. Please view the current version.
Plugin signatures
Plugin signature verification (signing) is a security measure to make sure plugins haven’t been tampered with. Upon loading, Grafana checks to see if a plugin is signed or unsigned when inspecting and verifying its digital signature.
At startup, Grafana verifies the signatures of every plugin in the plugin directory. If a plugin is unsigned, then Grafana does not load nor start it. To see the result of this verification for each plugin, navigate to Configuration -> Plugins.
Grafana also writes an error message to the server log:
WARN[05-26|12:00:00] Some plugin scanning errors were found errors="plugin '<plugin id>' is unsigned, plugin '<plugin id>' has an invalid signature"
If you are a plugin developer and want to know how to sign your plugin, refer to Sign a plugin.
Plugin signature levels
All plugins is signed under a signature level. The signature level determines how the plugin can be distributed.
Allow unsigned plugins
Note: Unsigned plugins are not supported in Grafana Cloud.
We strongly recommend that you don’t run unsigned plugins in your Grafana instance. If you’re aware of the risks and you still want to load an unsigned plugin, refer to Configuration.
If you’ve allowed loading of an unsigned plugin, then Grafana writes a warning message to the server log:
WARN[06-01|16:45:59] Running an unsigned plugin pluginID=<plugin id>
Note: If you’re developing a plugin, then you can enable development mode to allow all unsigned plugins.