diff --git a/.gitignore b/.gitignore
index 1e36241..dfc25e9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,2 @@
-SOURCES/grafana-6.2.2.tar.gz
-SOURCES/grafana_webpack-6.2.2.tar.gz
+SOURCES/grafana-6.3.6.tar.gz
+SOURCES/grafana_webpack-6.3.6.tar.gz
diff --git a/.grafana.metadata b/.grafana.metadata
index 9548389..b0b0282 100644
--- a/.grafana.metadata
+++ b/.grafana.metadata
@@ -1,2 +1,2 @@
-5714b94192991450fe8b370851c1f9dc1427eb3b SOURCES/grafana-6.2.2.tar.gz
-c346463f7f726d4e3127e80c00a28904a3239c63 SOURCES/grafana_webpack-6.2.2.tar.gz
+59a2779eecc65a49339789ef27f5039e6cd1df00 SOURCES/grafana-6.3.6.tar.gz
+58a07073b24fddba1973a0788118648ea8363ed9 SOURCES/grafana_webpack-6.3.6.tar.gz
diff --git a/SOURCES/001-login-oauth-use-oauth2-exchange.patch b/SOURCES/001-login-oauth-use-oauth2-exchange.patch
index d62067d..ff59d44 100644
--- a/SOURCES/001-login-oauth-use-oauth2-exchange.patch
+++ b/SOURCES/001-login-oauth-use-oauth2-exchange.patch
@@ -1,5 +1,5 @@
 diff --git a/pkg/api/login_oauth.go b/pkg/api/login_oauth.go
-index a3599bc7a..0c6579847 100644
+index a46c97238..76fc8480c 100644
 --- a/pkg/api/login_oauth.go
 +++ b/pkg/api/login_oauth.go
 @@ -125,7 +125,7 @@ func (hs *HTTPServer) OAuthLogin(ctx *m.ReqContext) {
diff --git a/SOURCES/002-remove-jaeger-tracing.patch b/SOURCES/002-remove-jaeger-tracing.patch
index 1f624cc..0d20b5e 100644
--- a/SOURCES/002-remove-jaeger-tracing.patch
+++ b/SOURCES/002-remove-jaeger-tracing.patch
@@ -1,34 +1,36 @@
 diff --git a/pkg/cmd/grafana-server/server.go b/pkg/cmd/grafana-server/server.go
-index 2ac326ed3..20943918c 100644
+index 85d6db43e..6de99b58b 100644
 --- a/pkg/cmd/grafana-server/server.go
 +++ b/pkg/cmd/grafana-server/server.go
-@@ -21,7 +21,6 @@ import (
+@@ -23,7 +23,6 @@ import (
  	_ "github.com/grafana/grafana/pkg/infra/metrics"
  	_ "github.com/grafana/grafana/pkg/infra/remotecache"
  	_ "github.com/grafana/grafana/pkg/infra/serverlock"
 -	_ "github.com/grafana/grafana/pkg/infra/tracing"
  	_ "github.com/grafana/grafana/pkg/infra/usagestats"
- 	"github.com/grafana/grafana/pkg/log"
  	"github.com/grafana/grafana/pkg/login"
+ 	"github.com/grafana/grafana/pkg/login/social"
 diff --git a/pkg/infra/tracing/tracing.go b/pkg/infra/tracing/tracing.go
 deleted file mode 100644
-index fd7258b7a..000000000
+index d1511a533..000000000
 --- a/pkg/infra/tracing/tracing.go
 +++ /dev/null
-@@ -1,129 +0,0 @@
+@@ -1,148 +0,0 @@
 -package tracing
 -
 -import (
 -	"context"
+-	"fmt"
 -	"io"
 -	"strings"
 -
--	"github.com/grafana/grafana/pkg/log"
+-	"github.com/grafana/grafana/pkg/infra/log"
 -	"github.com/grafana/grafana/pkg/registry"
 -	"github.com/grafana/grafana/pkg/setting"
 -
 -	opentracing "github.com/opentracing/opentracing-go"
 -	jaegercfg "github.com/uber/jaeger-client-go/config"
+-	"github.com/uber/jaeger-client-go/zipkin"
 -)
 -
 -func init() {
@@ -36,13 +38,15 @@ index fd7258b7a..000000000
 -}
 -
 -type TracingService struct {
--	enabled      bool
--	address      string
--	customTags   map[string]string
--	samplerType  string
--	samplerParam float64
--	log          log.Logger
--	closer       io.Closer
+-	enabled                  bool
+-	address                  string
+-	customTags               map[string]string
+-	samplerType              string
+-	samplerParam             float64
+-	log                      log.Logger
+-	closer                   io.Closer
+-	zipkinPropagation        bool
+-	disableSharedZipkinSpans bool
 -
 -	Cfg *setting.Cfg `inject:""`
 -}
@@ -72,6 +76,8 @@ index fd7258b7a..000000000
 -	ts.customTags = splitTagSettings(section.Key("always_included_tag").MustString(""))
 -	ts.samplerType = section.Key("sampler_type").MustString("")
 -	ts.samplerParam = section.Key("sampler_param").MustFloat64(1)
+-	ts.zipkinPropagation = section.Key("zipkin_propagation").MustBool(false)
+-	ts.disableSharedZipkinSpans = section.Key("disable_shared_zipkin_spans").MustBool(false)
 -}
 -
 -func (ts *TracingService) initGlobalTracer() error {
@@ -97,6 +103,18 @@ index fd7258b7a..000000000
 -		options = append(options, jaegercfg.Tag(tag, value))
 -	}
 -
+-	if ts.zipkinPropagation {
+-		zipkinPropagator := zipkin.NewZipkinB3HTTPHeaderPropagator()
+-		options = append(options,
+-			jaegercfg.Injector(opentracing.HTTPHeaders, zipkinPropagator),
+-			jaegercfg.Extractor(opentracing.HTTPHeaders, zipkinPropagator),
+-		)
+-
+-		if !ts.disableSharedZipkinSpans {
+-			options = append(options, jaegercfg.ZipkinSharedRPCSpan(true))
+-		}
+-	}
+-
 -	tracer, closer, err := cfg.NewTracer(options...)
 -	if err != nil {
 -		return err
@@ -142,8 +160,9 @@ index fd7258b7a..000000000
 -	jlw.logger.Error(msg)
 -}
 -
--func (jlw *jaegerLogWrapper) Infof(msg string, args ...interface{}) {
--	jlw.logger.Info(msg, args)
+-func (jlw *jaegerLogWrapper) Infof(format string, args ...interface{}) {
+-	msg := fmt.Sprintf(format, args...)
+-	jlw.logger.Info(msg)
 -}
 diff --git a/pkg/infra/tracing/tracing_test.go b/pkg/infra/tracing/tracing_test.go
 deleted file mode 100644
diff --git a/SOURCES/003-new-files.patch b/SOURCES/003-new-files.patch
index 0701856..2cac75d 100644
--- a/SOURCES/003-new-files.patch
+++ b/SOURCES/003-new-files.patch
@@ -1,9 +1,9 @@
 diff --git a/conf/distro-defaults.ini b/conf/distro-defaults.ini
 new file mode 100644
-index 000000000..eeb974369
+index 0000000000..e337ba0b57
 --- /dev/null
 +++ b/conf/distro-defaults.ini
-@@ -0,0 +1,601 @@
+@@ -0,0 +1,685 @@
 +##################### Grafana Configuration Defaults for distros #####################
 +#
 +# Do not modify this file in grafana installs
@@ -53,6 +53,9 @@ index 000000000..eeb974369
 +# The full public facing url
 +root_url = %(protocol)s://%(domain)s:%(http_port)s/
 +
++# Serve Grafana from subpath specified in `root_url` setting. By default it is set to `false` for compatibility reasons.
++serve_from_sub_path = false
++
 +# Log web requests
 +router_logging = false
 +
@@ -119,7 +122,7 @@ index 000000000..eeb974369
 +
 +# cache connectionstring options
 +# database: will use Grafana primary database.
-+# redis: config like redis server e.g. `addr=127.0.0.1:6379,pool_size=100,db=grafana`
++# redis: config like redis server e.g. `addr=127.0.0.1:6379,pool_size=100,db=0`. Only addr is required.
 +# memcache: 127.0.0.1:11211
 +connstr =
 +
@@ -185,6 +188,31 @@ index 000000000..eeb974369
 +# set to true if you want to allow browsers to render Grafana in a <frame>, <iframe>, <embed> or <object>. default is false.
 +allow_embedding = false
 +
++# Set to true if you want to enable http strict transport security (HSTS) response header.
++# This is only sent when HTTPS is enabled in this configuration.
++# HSTS tells browsers that the site should only be accessed using HTTPS.
++# The default will change to true in the next minor release, 6.3.
++strict_transport_security = false
++
++# Sets how long a browser should cache HSTS. Only applied if strict_transport_security is enabled.
++strict_transport_security_max_age_seconds = 86400
++
++# Set to true if to enable HSTS preloading option. Only applied if strict_transport_security is enabled.
++strict_transport_security_preload = false
++
++# Set to true if to enable the HSTS includeSubDomains option. Only applied if strict_transport_security is enabled.
++strict_transport_security_subdomains = false
++
++# Set to true to enable the X-Content-Type-Options response header.
++# The X-Content-Type-Options response HTTP header is a marker used by the server to indicate that the MIME types advertised
++# in the Content-Type headers should not be changed and be followed. The default will change to true in the next minor release, 6.3.
++x_content_type_options = false
++
++# Set to true to enable the X-XSS-Protection header, which tells browsers to stop pages from loading
++# when they detect reflected cross-site scripting (XSS) attacks. The default will change to true in the next minor release, 6.3.
++x_xss_protection = false
++
++
 +#################################### Snapshots ###########################
 +[snapshots]
 +# snapshot sharing options
@@ -192,6 +220,10 @@ index 000000000..eeb974369
 +external_snapshot_url = https://snapshots-origin.raintank.io
 +external_snapshot_name = Publish to snapshot.raintank.io
 +
++# Set to true to enable this Grafana instance act as an external snapshot server and allow unauthenticated requests for
++# creating and deleting snapshots.
++public_mode = false
++
 +# remove expired snapshot
 +snapshot_remove_expired = true
 +
@@ -265,6 +297,9 @@ index 000000000..eeb974369
 +# This setting is ignored if multiple OAuth providers are configured.
 +oauth_auto_login = false
 +
++# limit of api_key seconds to live before expiration
++api_key_max_seconds_to_live = -1
++
 +#################################### Anonymous Auth ######################
 +[auth.anonymous]
 +# enable anonymous access
@@ -352,6 +387,47 @@ index 000000000..eeb974369
 +tls_client_ca =
 +send_client_credentials_via_post = false
 +
++#################################### SAML Auth ###########################
++[auth.saml] # Enterprise only
++# Defaults to false. If true, the feature is enabled
++enabled = false
++
++# Base64-encoded public X.509 certificate. Used to sign requests to the IdP
++certificate =
++
++# Path to the public X.509 certificate. Used to sign requests to the IdP
++certificate_path =
++
++# Base64-encoded private key. Used to decrypt assertions from the IdP
++private_key =
++
++# Path to the private key. Used to decrypt assertions from the IdP
++private_key_path =
++
++# Base64-encoded IdP SAML metadata XML. Used to verify and obtain binding locations from the IdP
++idp_metadata =
++
++# Path to the SAML metadata XML. Used to verify and obtain binding locations from the IdP
++idp_metadata_path =
++
++# URL to fetch SAML IdP metadata. Used to verify and obtain binding locations from the IdP
++idp_metadata_url =
++
++# Duration, since the IdP issued a response and the SP is allowed to process it. Defaults to 90 seconds
++max_issue_delay = 90s
++
++# Duration, for how long the SP's metadata should be valid. Defaults to 48 hours
++metadata_valid_duration = 48h
++
++# Friendly name or name of the attribute within the SAML assertion to use as the user's name
++assertion_attribute_name = displayName
++
++# Friendly name or name of the attribute within the SAML assertion to use as the user's login handle
++assertion_attribute_login = mail
++
++# Friendly name or name of the attribute within the SAML assertion to use as the user's email
++assertion_attribute_email = mail
++
 +#################################### Basic Auth ##########################
 +[auth.basic]
 +enabled = true
@@ -373,7 +449,8 @@ index 000000000..eeb974369
 +allow_sign_up = true
 +
 +# LDAP backround sync (Enterprise only)
-+sync_cron = @hourly
++# At 1 am every day
++sync_cron = "0 0 1 * * *"
 +active_sync_enabled = false
 +
 +#################################### SMTP / Emailing #####################
@@ -521,8 +598,10 @@ index 000000000..eeb974369
 +#################################### Internal Grafana Metrics ############
 +# Metrics available at HTTP API Url /metrics
 +[metrics]
-+enabled           = true
-+interval_seconds  = 10
++enabled              = true
++interval_seconds     = 10
++# Disable total stats (stat_totals_*) metrics to be generated
++disable_total_stats = false
 +
 +#If both are set, basic auth will be required for the metrics endpoint.
 +basic_auth_username =
@@ -556,6 +635,11 @@ index 000000000..eeb974369
 +# and indicates the initial sampling rate before the actual one
 +# is received from the mothership
 +sampler_param = 1
++# Whether or not to use Zipkin span propagation (x-b3- HTTP headers).
++zipkin_propagation = false
++# Setting this to true disables shared RPC spans.
++# Not disabling is the most common setting when using Zipkin elsewhere in your infrastructure.
++disable_shared_zipkin_spans = false
 +
 +#################################### External Image Storage ##############
 +[external_image_storage]
@@ -607,7 +691,7 @@ index 000000000..eeb974369
 +license_path =
 diff --git a/docs/man/man1/grafana-cli.1 b/docs/man/man1/grafana-cli.1
 new file mode 100644
-index 000000000..171748fcd
+index 0000000000..171748fcda
 --- /dev/null
 +++ b/docs/man/man1/grafana-cli.1
 @@ -0,0 +1,51 @@
@@ -664,7 +748,7 @@ index 000000000..171748fcd
 +.BR http://docs.grafana.org/ .
 diff --git a/docs/man/man1/grafana-server.1 b/docs/man/man1/grafana-server.1
 new file mode 100644
-index 000000000..30b7c1306
+index 0000000000..30b7c1306f
 --- /dev/null
 +++ b/docs/man/man1/grafana-server.1
 @@ -0,0 +1,156 @@
@@ -826,7 +910,7 @@ index 000000000..30b7c1306
 +.BR http://docs.grafana.org/ .
 diff --git a/packaging/rpm/spec/README b/packaging/rpm/spec/README
 new file mode 100644
-index 000000000..f97c2a26b
+index 0000000000..f97c2a26be
 --- /dev/null
 +++ b/packaging/rpm/spec/README
 @@ -0,0 +1,7 @@
@@ -839,10 +923,10 @@ index 000000000..f97c2a26b
 +
 diff --git a/packaging/rpm/spec/grafana.spec b/packaging/rpm/spec/grafana.spec
 new file mode 100644
-index 000000000..85f0dd6aa
+index 0000000000..fb9200cb62
 --- /dev/null
 +++ b/packaging/rpm/spec/grafana.spec
-@@ -0,0 +1,715 @@
+@@ -0,0 +1,766 @@
 +%global grafana_arches %{lua: go_arches = {}
 +  for arch in rpm.expand("%{go_arches}"):gmatch("%S+") do
 +    go_arches[arch] = 1
@@ -853,15 +937,20 @@ index 000000000..85f0dd6aa
 +  end
 +end}
 +
-+# Unbundle grafana vendor sources and instead use BuildRequires
++# Unbundle Grafana vendor sources and instead use BuildRequires
 +# only on platforms that have enough golang devel support.
 +%if 0%{?rhel} == 0
 +%global           unbundle_vendor_sources 1
 +%endif
 +
++%if 0%{?fedora} >= 30
++# Use vendor sources until both Fedora and Grafana properly support golang modules
++%global           unbundle_vendor_sources 0
++%endif
++
 +
 +Name:             grafana
-+Version:          6.2.2
++Version:          6.3.6
 +Release:          1%{?dist}
 +Summary:          Metrics dashboard and graph editor
 +License:          ASL 2.0
@@ -880,11 +969,14 @@ index 000000000..85f0dd6aa
 +Patch1:           001-login-oauth-use-oauth2-exchange.patch
 +Patch2:           002-remove-jaeger-tracing.patch
 +Patch3:           003-new-files.patch
++Patch4:           004-xerrors.patch
++Patch5:           005-mute-shellcheck-grafana-cli.patch
 +
 +# Intersection of go_arches and nodejs_arches
 +ExclusiveArch:    %{grafana_arches}
 +
 +# omit golang debugsource, see BZ995136 and related
++%global           dwz_low_mem_die_limit 0
 +%global           _debugsource_template %{nil}
 +
 +%global           GRAFANA_USER %{name}
@@ -895,7 +987,7 @@ index 000000000..85f0dd6aa
 +%{?systemd_requires}
 +Requires(pre):    shadow-utils
 +
-+BuildRequires:    systemd, golang, go-srpm-macros
++BuildRequires:    git, systemd, golang, go-srpm-macros
 +
 +Recommends: grafana-cloudwatch = %{version}-%{release}
 +Recommends: grafana-elasticsearch = %{version}-%{release}
@@ -909,6 +1001,7 @@ index 000000000..85f0dd6aa
 +Recommends: grafana-postgres = %{version}-%{release}
 +Recommends: grafana-prometheus = %{version}-%{release}
 +Recommends: grafana-stackdriver = %{version}-%{release}
++Recommends: grafana-pcp
 +
 +%if 0%{?unbundle_vendor_sources}
 +# golang build deps. These allow us to unbundle vendor golang source.
@@ -1038,10 +1131,15 @@ index 000000000..85f0dd6aa
 +BuildRequires: golang(gopkg.in/square/go-jose.v2)
 +BuildRequires: golang(gopkg.in/square/go-jose.v2/cipher)
 +BuildRequires: golang(gopkg.in/square/go-jose.v2/json)
++%if 0%{fedora} >= 31
++BuildRequires: golang(gopkg.in/yaml.v2)
++%else
 +BuildRequires: golang(github.com/go-yaml/yaml)
++%endif
 +BuildRequires: golang(golang.org/x/sync/errgroup)
 +BuildRequires: golang(gopkg.in/ldap.v3)
 +BuildRequires: golang(gopkg.in/mail.v2)
++BuildRequires: golang(github.com/jonboulle/clockwork)
 +%endif
 +
 +# Declare all nodejs modules bundled in the webpack - this is for security
@@ -1238,6 +1336,8 @@ index 000000000..85f0dd6aa
 +%patch1 -p1
 +%patch2 -p1
 +%patch3 -p1
++%patch4 -p1
++%patch5 -p1
 +
 +# Set up build subdirs and links
 +mkdir -p %{_builddir}/src/github.com/grafana
@@ -1250,25 +1350,32 @@ index 000000000..85f0dd6aa
 +%if 0%{?unbundle_vendor_sources}
 +# Unbundle all grafana vendor sources, as per BuildRequires above.
 +# An exception is grafana-plugin-model, which is part of grafana.
-+# Another exception is xerrors, which is a transition package
-+# for the new Go 1.13 error values, see https://github.com/golang/xerrors
-+cp --parents -a vendor/github.com/grafana vendor/golang.org/x/xerrors \
-+    vendor/github.com/robfig/cron %{_builddir}
++cp --parents -a vendor/github.com/grafana \
++    vendor/golang.org/x/xerrors \
++    vendor/github.com/robfig vendor/github.com/crewjam/saml \
++    vendor/github.com/ua-parser/uap-go/uaparser  \
++    vendor/github.com/beevik/etree \
++    vendor/github.com/russellhaering/goxmldsig \
++    %{_builddir}
 +rm -r vendor # remove all vendor sources
 +mv %{_builddir}/vendor vendor # put back what we're keeping
 +%endif
 +
 +
 +%build
-+# Build the server-side binaries: grafana-server and grafana-cli
-+%if 0%{?gobuild}
-+# use modern go macros such as in recent Fedora
-+export GOPATH=%{_builddir}:%{gopath}
-+%gobuild -o grafana-cli ./pkg/cmd/grafana-cli
-+%gobuild -o grafana-server ./pkg/cmd/grafana-server
-+%else
++# Build the server-side binaries
 +cd %{_builddir}/src/github.com/grafana/grafana
++%global archbindir bin/`go env GOOS`-`go env GOARCH`
++echo _builddir=%{_builddir} archbindir=%{archbindir}
++[ ! -d %{archbindir} ] && mkdir -p %{archbindir}
 +export GOPATH=%{_builddir}:%{gopath}
++# export GO111MODULE=off
++%if 0%{?fedora} >= 31
++# native fedora golang build but without modules (no grafana support yet)
++go build -mod=vendor -o %{archbindir}/grafana-cli ./pkg/cmd/grafana-cli
++go build -mod=vendor -o %{archbindir}/grafana-server ./pkg/cmd/grafana-server
++%else
++# use the grafana build.go script.
 +go run build.go build
 +%endif
 +
@@ -1283,15 +1390,18 @@ index 000000000..85f0dd6aa
 +[ ! -d bin/arm64 ] && ln -sf linux-arm64 bin/aarch64
 +[ ! -d bin/aarch64 ] && ln -sf linux-aarch64 bin/aarch64
 +
-+# binaries
++# dirs, shared files, public html, webpack
 +install -d %{buildroot}%{_sbindir}
-+install -p -m 755 bin/%{_arch}/%{name}-server %{buildroot}%{_sbindir}
-+install -p -m 755 bin/%{_arch}/%{name}-cli %{buildroot}%{_sbindir}
-+
-+# other shared files, public html, webpack
-+install -d %{buildroot}%{_datadir}/%{name}
++install -d %{buildroot}%{_datadir}/%{name}/bin
 +cp -a conf public %{buildroot}%{_datadir}/%{name}
 +
++# wrappers
++install -p -m 755 packaging/wrappers/grafana-cli %{buildroot}%{_sbindir}/%{name}-cli
++
++# binaries
++install -p -m 755 %{archbindir}/%{name}-server %{buildroot}%{_sbindir}
++install -p -m 755 %{archbindir}/%{name}-cli %{buildroot}%{_datadir}/%{name}/bin
++
 +# man pages
 +install -d %{buildroot}%{_mandir}/man1
 +install -p -m 644 docs/man/man1/* %{buildroot}%{_mandir}/man1
@@ -1351,6 +1461,8 @@ index 000000000..85f0dd6aa
 +rm -f pkg/services/provisioning/dashboards/file_reader_linux_test.go
 +rm -f pkg/services/provisioning/dashboards/file_reader_test.go
 +rm -f pkg/services/sqlstore/alert_test.go
++rm -f pkg/services/sqlstore/apikey_test.go
++export GO111MODULE=off
 +go test ./pkg/...
 +
 +
@@ -1373,6 +1485,7 @@ index 000000000..85f0dd6aa
 +%attr(-, %{GRAFANA_USER}, %{GRAFANA_GROUP}) %dir %{_sharedstatedir}/%{name}/plugins
 +
 +# shared directory and all files therein, except some datasources
++%{_datadir}/%{name}/bin
 +%{_datadir}/%{name}/public
 +
 +# built-in datasources that are sub-packaged
@@ -1449,6 +1562,28 @@ index 000000000..85f0dd6aa
 +
 +
 +%changelog
++* Wed Nov 20 2019 Mark Goodwin <mgoodwin@redhat.com> 6.3.6-1
++- add weak depenency on grafana-pcp
++- add patch to mute shellcheck SC1090 for grafana-cli
++- update to 6.3.6 upstream community sources, see CHANGELOG
++
++* Thu Sep 05 2019 Mark Goodwin <mgoodwin@redhat.com> 6.3.5-1
++- drop uaparser patch now it's upstream
++- add xerrors patch, see https://github.com/golang/go/issues/32246
++- use vendor sources on rawhide until modules are fully supported
++- update to latest upstream community sources, see CHANGELOG
++
++* Fri Aug 30 2019 Mark Goodwin <mgoodwin@redhat.com> 6.3.4-1
++- include fix for CVE-2019-15043
++- add patch for uaparser on 32bit systems
++- update to latest upstream community sources, see CHANGELOG
++
++* Wed Jul 31 2019 Mark Goodwin <mgoodwin@redhat.com> 6.2.5-1
++- update to latest upstream community sources, see CHANGELOG
++
++* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 6.2.2-2
++- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
++
 +* Fri Jun 07 2019 Mark Goodwin <mgoodwin@redhat.com> 6.2.2-1
 +- split out some datasource plugins to sub-packages
 +- update to latest upstream community sources, see CHANGELOG
@@ -1560,7 +1695,7 @@ index 000000000..85f0dd6aa
 +- native RPM spec build with current tagged v5.2.5 sources
 diff --git a/packaging/rpm/spec/make_grafana_webpack.sh b/packaging/rpm/spec/make_grafana_webpack.sh
 new file mode 100755
-index 000000000..47a8025ff
+index 0000000000..47a8025ff4
 --- /dev/null
 +++ b/packaging/rpm/spec/make_grafana_webpack.sh
 @@ -0,0 +1,61 @@
diff --git a/SOURCES/004-xerrors.patch b/SOURCES/004-xerrors.patch
new file mode 100644
index 0000000..fc0612a
--- /dev/null
+++ b/SOURCES/004-xerrors.patch
@@ -0,0 +1,146 @@
+diff --git a/go.mod b/go.mod
+index 13f7c66bb..e0615affa 100644
+--- a/go.mod
++++ b/go.mod
+@@ -77,7 +77,6 @@ require (
+ 	golang.org/x/oauth2 v0.0.0-20190319182350-c85d3e98c914
+ 	golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6
+ 	golang.org/x/sys v0.0.0-20190415081028-16da32be82c5 // indirect
+-	golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373
+ 	gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
+ 	gopkg.in/asn1-ber.v1 v1.0.0-20181015200546-f715ec2f112d // indirect
+ 	gopkg.in/bufio.v1 v1.0.0-20140618132640-567b2bfa514e // indirect
+diff --git a/vendor/golang.org/x/xerrors/adaptor_go1_12.go b/vendor/golang.org/x/xerrors/adaptor.go
+similarity index 99%
+rename from vendor/golang.org/x/xerrors/adaptor_go1_12.go
+rename to vendor/golang.org/x/xerrors/adaptor.go
+index 6b9f2f0c7..4317f2483 100644
+--- a/vendor/golang.org/x/xerrors/adaptor_go1_12.go
++++ b/vendor/golang.org/x/xerrors/adaptor.go
+@@ -2,8 +2,6 @@
+ // Use of this source code is governed by a BSD-style
+ // license that can be found in the LICENSE file.
+ 
+-// +build !go1.13
+-
+ package xerrors
+ 
+ import (
+diff --git a/vendor/golang.org/x/xerrors/adaptor_go1_13.go b/vendor/golang.org/x/xerrors/adaptor_go1_13.go
+deleted file mode 100644
+index 57f519dc5..000000000
+--- a/vendor/golang.org/x/xerrors/adaptor_go1_13.go
++++ /dev/null
+@@ -1,55 +0,0 @@
+-// Copyright 2018 The Go Authors. All rights reserved.
+-// Use of this source code is governed by a BSD-style
+-// license that can be found in the LICENSE file.
+-
+-// +build go1.13
+-
+-package xerrors
+-
+-import (
+-	"errors"
+-	"fmt"
+-	"strconv"
+-)
+-
+-// A Frame contains part of a call stack.
+-type Frame = errors.Frame
+-
+-// Caller returns a Frame that describes a frame on the caller's stack.
+-// The argument skip is the number of frames to skip over.
+-// Caller(0) returns the frame for the caller of Caller.
+-var Caller func(skip int) Frame = errors.Caller
+-
+-// FormatError calls the FormatError method of f with an errors.Printer
+-// configured according to s and verb, and writes the result to s.
+-func FormatError(f Formatter, s fmt.State, verb rune) {
+-	// Assuming this function is only called from the Format method, and given
+-	// that FormatError takes precedence over Format, it cannot be called from
+-	// any package that supports errors.Formatter. It is therefore safe to
+-	// disregard that State may be a specific printer implementation and use one
+-	// of our choice instead.
+-
+-	width, okW := s.Width()
+-	prec, okP := s.Precision()
+-
+-	// Construct format string from State s.
+-	format := []byte{'%'}
+-	if s.Flag('-') {
+-		format = append(format, '-')
+-	}
+-	if s.Flag('+') {
+-		format = append(format, '+')
+-	}
+-	if s.Flag(' ') {
+-		format = append(format, ' ')
+-	}
+-	if okW {
+-		format = strconv.AppendInt(format, int64(width), 10)
+-	}
+-	if okP {
+-		format = append(format, '.')
+-		format = strconv.AppendInt(format, int64(prec), 10)
+-	}
+-	format = append(format, string(verb)...)
+-	fmt.Fprintf(s, string(format), f)
+-}
+diff --git a/vendor/golang.org/x/xerrors/format_go1_12.go b/vendor/golang.org/x/xerrors/format.go
+similarity index 98%
+rename from vendor/golang.org/x/xerrors/format_go1_12.go
+rename to vendor/golang.org/x/xerrors/format.go
+index ba856feab..1bc9c26b9 100644
+--- a/vendor/golang.org/x/xerrors/format_go1_12.go
++++ b/vendor/golang.org/x/xerrors/format.go
+@@ -2,8 +2,6 @@
+ // Use of this source code is governed by a BSD-style
+ // license that can be found in the LICENSE file.
+ 
+-// +build !go1.13
+-
+ package xerrors
+ 
+ // A Formatter formats error messages.
+diff --git a/vendor/golang.org/x/xerrors/format_go1_13.go b/vendor/golang.org/x/xerrors/format_go1_13.go
+deleted file mode 100644
+index 95c65968b..000000000
+--- a/vendor/golang.org/x/xerrors/format_go1_13.go
++++ /dev/null
+@@ -1,19 +0,0 @@
+-// Copyright 2018 The Go Authors. All rights reserved.
+-// Use of this source code is governed by a BSD-style
+-// license that can be found in the LICENSE file.
+-
+-// +build go1.13
+-
+-package xerrors
+-
+-import "errors"
+-
+-// A Formatter formats error messages.
+-type Formatter = errors.Formatter
+-
+-// A Printer formats error messages.
+-//
+-// The most common implementation of Printer is the one provided by package fmt
+-// during Printf (as of Go 1.13). Localization packages such as golang.org/x/text/message
+-// typically provide their own implementations.
+-type Printer = errors.Printer
+diff --git a/vendor/golang.org/x/xerrors/frame_go1_12.go b/vendor/golang.org/x/xerrors/frame.go
+similarity index 98%
+rename from vendor/golang.org/x/xerrors/frame_go1_12.go
+rename to vendor/golang.org/x/xerrors/frame.go
+index 6740f7fa6..0de628ec5 100644
+--- a/vendor/golang.org/x/xerrors/frame_go1_12.go
++++ b/vendor/golang.org/x/xerrors/frame.go
+@@ -2,8 +2,6 @@
+ // Use of this source code is governed by a BSD-style
+ // license that can be found in the LICENSE file.
+ 
+-// +build !go1.13
+-
+ package xerrors
+ 
+ import (
diff --git a/SOURCES/005-mute-shellcheck-grafana-cli.patch b/SOURCES/005-mute-shellcheck-grafana-cli.patch
new file mode 100644
index 0000000..5a92c64
--- /dev/null
+++ b/SOURCES/005-mute-shellcheck-grafana-cli.patch
@@ -0,0 +1,12 @@
+diff --git a/packaging/wrappers/grafana-cli b/packaging/wrappers/grafana-cli
+index 9cad151c0d..4c963d90ac 100755
+--- a/packaging/wrappers/grafana-cli
++++ b/packaging/wrappers/grafana-cli
+@@ -24,6 +24,7 @@ if [ ! -x $EXECUTABLE ]; then
+ fi
+ 
+ # overwrite settings from default file
++#shellcheck disable=SC1090
+ if [ -f "$DEFAULT" ]; then
+   . "$DEFAULT"
+ fi
diff --git a/SPECS/grafana.spec b/SPECS/grafana.spec
index 799c7e9..fb9200c 100644
--- a/SPECS/grafana.spec
+++ b/SPECS/grafana.spec
@@ -8,16 +8,21 @@
   end
 end}
 
-# Unbundle grafana vendor sources and instead use BuildRequires
+# Unbundle Grafana vendor sources and instead use BuildRequires
 # only on platforms that have enough golang devel support.
 %if 0%{?rhel} == 0
 %global           unbundle_vendor_sources 1
 %endif
 
+%if 0%{?fedora} >= 30
+# Use vendor sources until both Fedora and Grafana properly support golang modules
+%global           unbundle_vendor_sources 0
+%endif
+
 
 Name:             grafana
-Version:          6.2.2
-Release:          2%{?dist}
+Version:          6.3.6
+Release:          1%{?dist}
 Summary:          Metrics dashboard and graph editor
 License:          ASL 2.0
 URL:              https://grafana.org
@@ -35,11 +40,14 @@ Source2:          make_grafana_webpack.sh
 Patch1:           001-login-oauth-use-oauth2-exchange.patch
 Patch2:           002-remove-jaeger-tracing.patch
 Patch3:           003-new-files.patch
+Patch4:           004-xerrors.patch
+Patch5:           005-mute-shellcheck-grafana-cli.patch
 
 # Intersection of go_arches and nodejs_arches
 ExclusiveArch:    %{grafana_arches}
 
 # omit golang debugsource, see BZ995136 and related
+%global           dwz_low_mem_die_limit 0
 %global           _debugsource_template %{nil}
 
 %global           GRAFANA_USER %{name}
@@ -50,7 +58,7 @@ ExclusiveArch:    %{grafana_arches}
 %{?systemd_requires}
 Requires(pre):    shadow-utils
 
-BuildRequires:    systemd, golang, go-srpm-macros
+BuildRequires:    git, systemd, golang, go-srpm-macros
 
 Recommends: grafana-cloudwatch = %{version}-%{release}
 Recommends: grafana-elasticsearch = %{version}-%{release}
@@ -64,6 +72,7 @@ Recommends: grafana-opentsdb = %{version}-%{release}
 Recommends: grafana-postgres = %{version}-%{release}
 Recommends: grafana-prometheus = %{version}-%{release}
 Recommends: grafana-stackdriver = %{version}-%{release}
+Recommends: grafana-pcp
 
 %if 0%{?unbundle_vendor_sources}
 # golang build deps. These allow us to unbundle vendor golang source.
@@ -193,10 +202,15 @@ BuildRequires: golang(github.com/go-redis/redis)
 BuildRequires: golang(gopkg.in/square/go-jose.v2)
 BuildRequires: golang(gopkg.in/square/go-jose.v2/cipher)
 BuildRequires: golang(gopkg.in/square/go-jose.v2/json)
+%if 0%{fedora} >= 31
+BuildRequires: golang(gopkg.in/yaml.v2)
+%else
 BuildRequires: golang(github.com/go-yaml/yaml)
+%endif
 BuildRequires: golang(golang.org/x/sync/errgroup)
 BuildRequires: golang(gopkg.in/ldap.v3)
 BuildRequires: golang(gopkg.in/mail.v2)
+BuildRequires: golang(github.com/jonboulle/clockwork)
 %endif
 
 # Declare all nodejs modules bundled in the webpack - this is for security
@@ -393,6 +407,8 @@ The Grafana stackdriver datasource.
 %patch1 -p1
 %patch2 -p1
 %patch3 -p1
+%patch4 -p1
+%patch5 -p1
 
 # Set up build subdirs and links
 mkdir -p %{_builddir}/src/github.com/grafana
@@ -405,25 +421,32 @@ rm -f public/sass/.sass-lint.yml public/test/.jshintrc
 %if 0%{?unbundle_vendor_sources}
 # Unbundle all grafana vendor sources, as per BuildRequires above.
 # An exception is grafana-plugin-model, which is part of grafana.
-# Another exception is xerrors, which is a transition package
-# for the new Go 1.13 error values, see https://github.com/golang/xerrors
-cp --parents -a vendor/github.com/grafana vendor/golang.org/x/xerrors \
-    vendor/github.com/robfig/cron %{_builddir}
+cp --parents -a vendor/github.com/grafana \
+    vendor/golang.org/x/xerrors \
+    vendor/github.com/robfig vendor/github.com/crewjam/saml \
+    vendor/github.com/ua-parser/uap-go/uaparser  \
+    vendor/github.com/beevik/etree \
+    vendor/github.com/russellhaering/goxmldsig \
+    %{_builddir}
 rm -r vendor # remove all vendor sources
 mv %{_builddir}/vendor vendor # put back what we're keeping
 %endif
 
 
 %build
-# Build the server-side binaries: grafana-server and grafana-cli
-%if 0%{?gobuild}
-# use modern go macros such as in recent Fedora
-export GOPATH=%{_builddir}:%{gopath}
-%gobuild -o grafana-cli ./pkg/cmd/grafana-cli
-%gobuild -o grafana-server ./pkg/cmd/grafana-server
-%else
+# Build the server-side binaries
 cd %{_builddir}/src/github.com/grafana/grafana
+%global archbindir bin/`go env GOOS`-`go env GOARCH`
+echo _builddir=%{_builddir} archbindir=%{archbindir}
+[ ! -d %{archbindir} ] && mkdir -p %{archbindir}
 export GOPATH=%{_builddir}:%{gopath}
+# export GO111MODULE=off
+%if 0%{?fedora} >= 31
+# native fedora golang build but without modules (no grafana support yet)
+go build -mod=vendor -o %{archbindir}/grafana-cli ./pkg/cmd/grafana-cli
+go build -mod=vendor -o %{archbindir}/grafana-server ./pkg/cmd/grafana-server
+%else
+# use the grafana build.go script.
 go run build.go build
 %endif
 
@@ -438,15 +461,18 @@ go run build.go build
 [ ! -d bin/arm64 ] && ln -sf linux-arm64 bin/aarch64
 [ ! -d bin/aarch64 ] && ln -sf linux-aarch64 bin/aarch64
 
-# binaries
+# dirs, shared files, public html, webpack
 install -d %{buildroot}%{_sbindir}
-install -p -m 755 bin/%{_arch}/%{name}-server %{buildroot}%{_sbindir}
-install -p -m 755 bin/%{_arch}/%{name}-cli %{buildroot}%{_sbindir}
-
-# other shared files, public html, webpack
-install -d %{buildroot}%{_datadir}/%{name}
+install -d %{buildroot}%{_datadir}/%{name}/bin
 cp -a conf public %{buildroot}%{_datadir}/%{name}
 
+# wrappers
+install -p -m 755 packaging/wrappers/grafana-cli %{buildroot}%{_sbindir}/%{name}-cli
+
+# binaries
+install -p -m 755 %{archbindir}/%{name}-server %{buildroot}%{_sbindir}
+install -p -m 755 %{archbindir}/%{name}-cli %{buildroot}%{_datadir}/%{name}/bin
+
 # man pages
 install -d %{buildroot}%{_mandir}/man1
 install -p -m 644 docs/man/man1/* %{buildroot}%{_mandir}/man1
@@ -506,6 +532,8 @@ export GOPATH=%{_builddir}:%{gopath}
 rm -f pkg/services/provisioning/dashboards/file_reader_linux_test.go
 rm -f pkg/services/provisioning/dashboards/file_reader_test.go
 rm -f pkg/services/sqlstore/alert_test.go
+rm -f pkg/services/sqlstore/apikey_test.go
+export GO111MODULE=off
 go test ./pkg/...
 
 
@@ -528,6 +556,7 @@ go test ./pkg/...
 %attr(-, %{GRAFANA_USER}, %{GRAFANA_GROUP}) %dir %{_sharedstatedir}/%{name}/plugins
 
 # shared directory and all files therein, except some datasources
+%{_datadir}/%{name}/bin
 %{_datadir}/%{name}/public
 
 # built-in datasources that are sub-packaged
@@ -604,8 +633,27 @@ go test ./pkg/...
 
 
 %changelog
-* Fri Jun 14 2019 Mark Goodwin <mgoodwin@redhat.com> 6.2.2-2
-- rebuild
+* Wed Nov 20 2019 Mark Goodwin <mgoodwin@redhat.com> 6.3.6-1
+- add weak depenency on grafana-pcp
+- add patch to mute shellcheck SC1090 for grafana-cli
+- update to 6.3.6 upstream community sources, see CHANGELOG
+
+* Thu Sep 05 2019 Mark Goodwin <mgoodwin@redhat.com> 6.3.5-1
+- drop uaparser patch now it's upstream
+- add xerrors patch, see https://github.com/golang/go/issues/32246
+- use vendor sources on rawhide until modules are fully supported
+- update to latest upstream community sources, see CHANGELOG
+
+* Fri Aug 30 2019 Mark Goodwin <mgoodwin@redhat.com> 6.3.4-1
+- include fix for CVE-2019-15043
+- add patch for uaparser on 32bit systems
+- update to latest upstream community sources, see CHANGELOG
+
+* Wed Jul 31 2019 Mark Goodwin <mgoodwin@redhat.com> 6.2.5-1
+- update to latest upstream community sources, see CHANGELOG
+
+* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 6.2.2-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
 
 * Fri Jun 07 2019 Mark Goodwin <mgoodwin@redhat.com> 6.2.2-1
 - split out some datasource plugins to sub-packages