Problem with plugin verification on Windows

[zerok]

While doing some smoketesting I ran into some issues with Grafana 9.5.0-pre around verifying a newly installed plugin:

After installing the image render plugin it is displayed as "disabled" in the plugin panel with following notice:

Grafana Labs checks each plugin to verify that it has a valid digital signature. While doing this, we discovered that the content of this plugin does not match its signature. We can not guarantee the trustworthy of this plugin and have therefore disabled it. We recommend you to reinstall the plugin to make sure you are running a verified version of this plugin.

And that's in the logfile:

logger=plugin.loader t=2023-04-11T07:29:49.5198562Z level=warn msg="The following files were not included in the signature" plugin=grafana-image-renderer files="[chrome-win\locales\en-US.pak chrome-win\chrome_wer.dll chrome-win\locales\hi.pak chrome-win\locales\vi.pak chrome-win\locales\ta.pak chrome-win\locales\el.pak chrome-win\locales\zh-TW.pak chrome-win\locales\cs.pak chrome-win\locales\ar-XB.pak chrome-win\chrome_pwa_launcher.exe chrome-win\resources.pak chrome-win\libEGL.dll chrome-win\locales\ur.pak chrome-win\locales\es-419.pak chrome-win\locales\de.pak chrome-win\locales\ko.pak chrome-win\locales\tr.pak chrome-win\locales\en-GB.pak chrome-win\locales\th.pak chrome-win\locales\ro.pak chrome-win\locales\lt.pak chrome-win\v8_context_snapshot.bin chrome-win\locales\en-XA.pak chrome-win\locales\ru.pak chrome-win\chrome_100_percent.pak chrome-win\vk_swiftshader.dll chrome-win\nacl_irt_x86_64.nexe chrome-win\vk_swiftshader_icd.json chrome-win\locales\et.pak chrome-win\locales\ca.pak chrome-win\locales\fa.pak chrome-win\locales\af.pak chrome-win\icudtl.dat chrome-win\locales\hr.pak chrome-win\locales\hu.pak chrome-win\locales\pl.pak chrome-win\locales\kn.pak chrome-win\locales\ms.pak chrome-win\MEIPreload\manifest.json chrome-win\chrome.dll chrome-win\locales\sr.pak chrome-win\locales\sv.pak chrome-win\elevation_service.exe chrome-win\locales\mr.pak chrome-win\locales\pt-BR.pak chrome-win\locales\fi.pak chrome-win\locales\it.pak chrome-win\106.0.5249.0.manifest chrome-win\chrome_proxy.exe chrome-win\locales\bg.pak chrome-win\mojo_core.dll chrome-win\locales\pt-PT.pak chrome-win\locales\ml.pak chrome-win\eventlog_provider.dll chrome-win\MEIPreload\preloaded_data.pb chrome-win\locales\nl.pak chrome-win\locales\uk.pak chrome-win\chrome_elf.dll chrome-win\locales\lv.pak chrome-win\locales\nb.pak chrome-win\locales\es.pak chrome-win\locales\sw.pak chrome-win\locales\sl.pak chrome-win\locales\sk.pak chrome-win\vulkan-1.dll chrome-win\chrome.exe chrome-win\locales\bn.pak chrome-win\First Run chrome-win\locales\gu.pak chrome-win\libGLESv2.dll chrome-win\locales\id.pak chrome-win\locales\ja.pak chrome-win\locales\zh-CN.pak chrome-win\chrome_200_percent.pak chrome-win\locales\he.pak chrome-win\locales\fil.pak chrome-win\locales\am.pak chrome-win\D3DCompiler_47.dll chrome-win\locales\fr.pak chrome-win\locales\te.pak chrome-win\notification_helper.exe chrome-win\locales\ar.pak chrome-win\locales\da.pak img\icon.png chrome-win\interactive_ui_tests.exe]"
logger=plugin.loader t=2023-04-11T07:29:49.5198562Z level=warn msg="Skipping loading plugin due to problem with signature" pluginID=grafana-image-renderer status=modified

A similar error appears when I try to install the gnocchi plugin:

logger=plugin.loader t=2023-04-11T08:07:37.2010864Z level=warn msg="The following files were not included in the signature" plugin=gnocchixyz-gnocchi-datasource files="[docs\gnocchi_query_mode4.png snippets\gnocchioperations.js snippets\gnocchiquery.js specs\gnocchi-datasource-specs.js specs\mocks\backendsrv.js specs\mocks\backendsrv.js.map docs\gnocchi_templating.png docs\gnocchi-logo.png docs\gnocchi_query_mode1.png specs\gnocchi-datasource-specs.js.map docs\grafana-dynamic.png specs\mocks\templatesrv.js specs\mocks\templatesrv.js.map docs\grafana-metric-id.png partials\config.html partials\query.editor.html docs\gnocchi-logo.jpg docs\gnocchi_query_mode3.png partials\query.options.html docs\add_datasource_gnocchi.png docs\collectd-dashboard.png]"

On windows the update-check succeeds:

logger=grafana.update.checker t=2023-04-11T07:29:50.544893Z level=info msg="Update check succeeded" duration=40.7015ms

I could not reproduce this inside a plain Ubuntu container (with ca-certificates installed).

This error could not be reproduced with the 9.4.x or 9.3.x Windows builds.

[zerok]

Resolved by #66273