diff --git a/.gitignore b/.gitignore
index a533fb5..c89ab6b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,3 +4,5 @@
 /grafana_webpack-6.1.6.tar.gz
 /grafana-6.2.2.tar.gz
 /grafana_webpack-6.2.2.tar.gz
+/grafana-6.3.5.tar.gz
+/grafana_webpack-6.3.5.tar.gz
diff --git a/001-login-oauth-use-oauth2-exchange.patch b/001-login-oauth-use-oauth2-exchange.patch
index d62067d..ff59d44 100644
--- a/001-login-oauth-use-oauth2-exchange.patch
+++ b/001-login-oauth-use-oauth2-exchange.patch
@@ -1,5 +1,5 @@
 diff --git a/pkg/api/login_oauth.go b/pkg/api/login_oauth.go
-index a3599bc7a..0c6579847 100644
+index a46c97238..76fc8480c 100644
 --- a/pkg/api/login_oauth.go
 +++ b/pkg/api/login_oauth.go
 @@ -125,7 +125,7 @@ func (hs *HTTPServer) OAuthLogin(ctx *m.ReqContext) {
diff --git a/002-remove-jaeger-tracing.patch b/002-remove-jaeger-tracing.patch
index 1f624cc..0d20b5e 100644
--- a/002-remove-jaeger-tracing.patch
+++ b/002-remove-jaeger-tracing.patch
@@ -1,34 +1,36 @@
 diff --git a/pkg/cmd/grafana-server/server.go b/pkg/cmd/grafana-server/server.go
-index 2ac326ed3..20943918c 100644
+index 85d6db43e..6de99b58b 100644
 --- a/pkg/cmd/grafana-server/server.go
 +++ b/pkg/cmd/grafana-server/server.go
-@@ -21,7 +21,6 @@ import (
+@@ -23,7 +23,6 @@ import (
  	_ "github.com/grafana/grafana/pkg/infra/metrics"
  	_ "github.com/grafana/grafana/pkg/infra/remotecache"
  	_ "github.com/grafana/grafana/pkg/infra/serverlock"
 -	_ "github.com/grafana/grafana/pkg/infra/tracing"
  	_ "github.com/grafana/grafana/pkg/infra/usagestats"
- 	"github.com/grafana/grafana/pkg/log"
  	"github.com/grafana/grafana/pkg/login"
+ 	"github.com/grafana/grafana/pkg/login/social"
 diff --git a/pkg/infra/tracing/tracing.go b/pkg/infra/tracing/tracing.go
 deleted file mode 100644
-index fd7258b7a..000000000
+index d1511a533..000000000
 --- a/pkg/infra/tracing/tracing.go
 +++ /dev/null
-@@ -1,129 +0,0 @@
+@@ -1,148 +0,0 @@
 -package tracing
 -
 -import (
 -	"context"
+-	"fmt"
 -	"io"
 -	"strings"
 -
--	"github.com/grafana/grafana/pkg/log"
+-	"github.com/grafana/grafana/pkg/infra/log"
 -	"github.com/grafana/grafana/pkg/registry"
 -	"github.com/grafana/grafana/pkg/setting"
 -
 -	opentracing "github.com/opentracing/opentracing-go"
 -	jaegercfg "github.com/uber/jaeger-client-go/config"
+-	"github.com/uber/jaeger-client-go/zipkin"
 -)
 -
 -func init() {
@@ -36,13 +38,15 @@ index fd7258b7a..000000000
 -}
 -
 -type TracingService struct {
--	enabled      bool
--	address      string
--	customTags   map[string]string
--	samplerType  string
--	samplerParam float64
--	log          log.Logger
--	closer       io.Closer
+-	enabled                  bool
+-	address                  string
+-	customTags               map[string]string
+-	samplerType              string
+-	samplerParam             float64
+-	log                      log.Logger
+-	closer                   io.Closer
+-	zipkinPropagation        bool
+-	disableSharedZipkinSpans bool
 -
 -	Cfg *setting.Cfg `inject:""`
 -}
@@ -72,6 +76,8 @@ index fd7258b7a..000000000
 -	ts.customTags = splitTagSettings(section.Key("always_included_tag").MustString(""))
 -	ts.samplerType = section.Key("sampler_type").MustString("")
 -	ts.samplerParam = section.Key("sampler_param").MustFloat64(1)
+-	ts.zipkinPropagation = section.Key("zipkin_propagation").MustBool(false)
+-	ts.disableSharedZipkinSpans = section.Key("disable_shared_zipkin_spans").MustBool(false)
 -}
 -
 -func (ts *TracingService) initGlobalTracer() error {
@@ -97,6 +103,18 @@ index fd7258b7a..000000000
 -		options = append(options, jaegercfg.Tag(tag, value))
 -	}
 -
+-	if ts.zipkinPropagation {
+-		zipkinPropagator := zipkin.NewZipkinB3HTTPHeaderPropagator()
+-		options = append(options,
+-			jaegercfg.Injector(opentracing.HTTPHeaders, zipkinPropagator),
+-			jaegercfg.Extractor(opentracing.HTTPHeaders, zipkinPropagator),
+-		)
+-
+-		if !ts.disableSharedZipkinSpans {
+-			options = append(options, jaegercfg.ZipkinSharedRPCSpan(true))
+-		}
+-	}
+-
 -	tracer, closer, err := cfg.NewTracer(options...)
 -	if err != nil {
 -		return err
@@ -142,8 +160,9 @@ index fd7258b7a..000000000
 -	jlw.logger.Error(msg)
 -}
 -
--func (jlw *jaegerLogWrapper) Infof(msg string, args ...interface{}) {
--	jlw.logger.Info(msg, args)
+-func (jlw *jaegerLogWrapper) Infof(format string, args ...interface{}) {
+-	msg := fmt.Sprintf(format, args...)
+-	jlw.logger.Info(msg)
 -}
 diff --git a/pkg/infra/tracing/tracing_test.go b/pkg/infra/tracing/tracing_test.go
 deleted file mode 100644
diff --git a/003-new-files.patch b/003-new-files.patch
index 0701856..cf0c325 100644
--- a/003-new-files.patch
+++ b/003-new-files.patch
@@ -1,9 +1,9 @@
 diff --git a/conf/distro-defaults.ini b/conf/distro-defaults.ini
 new file mode 100644
-index 000000000..eeb974369
+index 000000000..e7a0c5062
 --- /dev/null
 +++ b/conf/distro-defaults.ini
-@@ -0,0 +1,601 @@
+@@ -0,0 +1,683 @@
 +##################### Grafana Configuration Defaults for distros #####################
 +#
 +# Do not modify this file in grafana installs
@@ -53,6 +53,9 @@ index 000000000..eeb974369
 +# The full public facing url
 +root_url = %(protocol)s://%(domain)s:%(http_port)s/
 +
++# Serve Grafana from subpath specified in `root_url` setting. By default it is set to `false` for compatibility reasons.
++serve_from_sub_path = false
++
 +# Log web requests
 +router_logging = false
 +
@@ -119,7 +122,7 @@ index 000000000..eeb974369
 +
 +# cache connectionstring options
 +# database: will use Grafana primary database.
-+# redis: config like redis server e.g. `addr=127.0.0.1:6379,pool_size=100,db=grafana`
++# redis: config like redis server e.g. `addr=127.0.0.1:6379,pool_size=100,db=0`. Only addr is required.
 +# memcache: 127.0.0.1:11211
 +connstr =
 +
@@ -185,6 +188,31 @@ index 000000000..eeb974369
 +# set to true if you want to allow browsers to render Grafana in a <frame>, <iframe>, <embed> or <object>. default is false.
 +allow_embedding = false
 +
++# Set to true if you want to enable http strict transport security (HSTS) response header.
++# This is only sent when HTTPS is enabled in this configuration.
++# HSTS tells browsers that the site should only be accessed using HTTPS.
++# The default will change to true in the next minor release, 6.3.
++strict_transport_security = false
++
++# Sets how long a browser should cache HSTS. Only applied if strict_transport_security is enabled.
++strict_transport_security_max_age_seconds = 86400
++
++# Set to true if to enable HSTS preloading option. Only applied if strict_transport_security is enabled.
++strict_transport_security_preload = false
++
++# Set to true if to enable the HSTS includeSubDomains option. Only applied if strict_transport_security is enabled.
++strict_transport_security_subdomains = false
++
++# Set to true to enable the X-Content-Type-Options response header.
++# The X-Content-Type-Options response HTTP header is a marker used by the server to indicate that the MIME types advertised
++# in the Content-Type headers should not be changed and be followed. The default will change to true in the next minor release, 6.3.
++x_content_type_options = false
++
++# Set to true to enable the X-XSS-Protection header, which tells browsers to stop pages from loading
++# when they detect reflected cross-site scripting (XSS) attacks. The default will change to true in the next minor release, 6.3.
++x_xss_protection = false
++
++
 +#################################### Snapshots ###########################
 +[snapshots]
 +# snapshot sharing options
@@ -192,6 +220,10 @@ index 000000000..eeb974369
 +external_snapshot_url = https://snapshots-origin.raintank.io
 +external_snapshot_name = Publish to snapshot.raintank.io
 +
++# Set to true to enable this Grafana instance act as an external snapshot server and allow unauthenticated requests for
++# creating and deleting snapshots.
++public_mode = false
++
 +# remove expired snapshot
 +snapshot_remove_expired = true
 +
@@ -265,6 +297,9 @@ index 000000000..eeb974369
 +# This setting is ignored if multiple OAuth providers are configured.
 +oauth_auto_login = false
 +
++# limit of api_key seconds to live before expiration
++api_key_max_seconds_to_live = -1
++
 +#################################### Anonymous Auth ######################
 +[auth.anonymous]
 +# enable anonymous access
@@ -352,6 +387,47 @@ index 000000000..eeb974369
 +tls_client_ca =
 +send_client_credentials_via_post = false
 +
++#################################### SAML Auth ###########################
++[auth.saml] # Enterprise only
++# Defaults to false. If true, the feature is enabled
++enabled = false
++
++# Base64-encoded public X.509 certificate. Used to sign requests to the IdP
++certificate =
++
++# Path to the public X.509 certificate. Used to sign requests to the IdP
++certificate_path =
++
++# Base64-encoded private key. Used to decrypt assertions from the IdP
++private_key =
++
++# Path to the private key. Used to decrypt assertions from the IdP
++private_key_path =
++
++# Base64-encoded IdP SAML metadata XML. Used to verify and obtain binding locations from the IdP
++idp_metadata =
++
++# Path to the SAML metadata XML. Used to verify and obtain binding locations from the IdP
++idp_metadata_path =
++
++# URL to fetch SAML IdP metadata. Used to verify and obtain binding locations from the IdP
++idp_metadata_url =
++
++# Duration, since the IdP issued a response and the SP is allowed to process it. Defaults to 90 seconds
++max_issue_delay = 90s
++
++# Duration, for how long the SP's metadata should be valid. Defaults to 48 hours
++metadata_valid_duration = 48h
++
++# Friendly name or name of the attribute within the SAML assertion to use as the user's name
++assertion_attribute_name = displayName
++
++# Friendly name or name of the attribute within the SAML assertion to use as the user's login handle
++assertion_attribute_login = mail
++
++# Friendly name or name of the attribute within the SAML assertion to use as the user's email
++assertion_attribute_email = mail
++
 +#################################### Basic Auth ##########################
 +[auth.basic]
 +enabled = true
@@ -373,7 +449,8 @@ index 000000000..eeb974369
 +allow_sign_up = true
 +
 +# LDAP backround sync (Enterprise only)
-+sync_cron = @hourly
++# At 1 am every day
++sync_cron = "0 0 1 * * *"
 +active_sync_enabled = false
 +
 +#################################### SMTP / Emailing #####################
@@ -556,6 +633,11 @@ index 000000000..eeb974369
 +# and indicates the initial sampling rate before the actual one
 +# is received from the mothership
 +sampler_param = 1
++# Whether or not to use Zipkin span propagation (x-b3- HTTP headers).
++zipkin_propagation = false
++# Setting this to true disables shared RPC spans.
++# Not disabling is the most common setting when using Zipkin elsewhere in your infrastructure.
++disable_shared_zipkin_spans = false
 +
 +#################################### External Image Storage ##############
 +[external_image_storage]
@@ -839,10 +921,10 @@ index 000000000..f97c2a26b
 +
 diff --git a/packaging/rpm/spec/grafana.spec b/packaging/rpm/spec/grafana.spec
 new file mode 100644
-index 000000000..85f0dd6aa
+index 000000000..81d21aaf4
 --- /dev/null
 +++ b/packaging/rpm/spec/grafana.spec
-@@ -0,0 +1,715 @@
+@@ -0,0 +1,737 @@
 +%global grafana_arches %{lua: go_arches = {}
 +  for arch in rpm.expand("%{go_arches}"):gmatch("%S+") do
 +    go_arches[arch] = 1
@@ -861,7 +943,7 @@ index 000000000..85f0dd6aa
 +
 +
 +Name:             grafana
-+Version:          6.2.2
++Version:          6.3.4
 +Release:          1%{?dist}
 +Summary:          Metrics dashboard and graph editor
 +License:          ASL 2.0
@@ -880,6 +962,7 @@ index 000000000..85f0dd6aa
 +Patch1:           001-login-oauth-use-oauth2-exchange.patch
 +Patch2:           002-remove-jaeger-tracing.patch
 +Patch3:           003-new-files.patch
++Patch4:           004-fix-uaparser-32bit.patch
 +
 +# Intersection of go_arches and nodejs_arches
 +ExclusiveArch:    %{grafana_arches}
@@ -895,7 +978,7 @@ index 000000000..85f0dd6aa
 +%{?systemd_requires}
 +Requires(pre):    shadow-utils
 +
-+BuildRequires:    systemd, golang, go-srpm-macros
++BuildRequires:    git, systemd, golang, go-srpm-macros
 +
 +Recommends: grafana-cloudwatch = %{version}-%{release}
 +Recommends: grafana-elasticsearch = %{version}-%{release}
@@ -1042,6 +1125,7 @@ index 000000000..85f0dd6aa
 +BuildRequires: golang(golang.org/x/sync/errgroup)
 +BuildRequires: golang(gopkg.in/ldap.v3)
 +BuildRequires: golang(gopkg.in/mail.v2)
++BuildRequires: golang(github.com/jonboulle/clockwork)
 +%endif
 +
 +# Declare all nodejs modules bundled in the webpack - this is for security
@@ -1238,6 +1322,7 @@ index 000000000..85f0dd6aa
 +%patch1 -p1
 +%patch2 -p1
 +%patch3 -p1
++%patch4 -p1
 +
 +# Set up build subdirs and links
 +mkdir -p %{_builddir}/src/github.com/grafana
@@ -1253,7 +1338,11 @@ index 000000000..85f0dd6aa
 +# Another exception is xerrors, which is a transition package
 +# for the new Go 1.13 error values, see https://github.com/golang/xerrors
 +cp --parents -a vendor/github.com/grafana vendor/golang.org/x/xerrors \
-+    vendor/github.com/robfig/cron %{_builddir}
++    vendor/github.com/robfig vendor/github.com/crewjam/saml \
++    vendor/github.com/ua-parser/uap-go/uaparser  \
++    vendor/github.com/beevik/etree \
++    vendor/github.com/russellhaering/goxmldsig \
++    %{_builddir}
 +rm -r vendor # remove all vendor sources
 +mv %{_builddir}/vendor vendor # put back what we're keeping
 +%endif
@@ -1283,15 +1372,18 @@ index 000000000..85f0dd6aa
 +[ ! -d bin/arm64 ] && ln -sf linux-arm64 bin/aarch64
 +[ ! -d bin/aarch64 ] && ln -sf linux-aarch64 bin/aarch64
 +
-+# binaries
++# dirs, shared files, public html, webpack
 +install -d %{buildroot}%{_sbindir}
-+install -p -m 755 bin/%{_arch}/%{name}-server %{buildroot}%{_sbindir}
-+install -p -m 755 bin/%{_arch}/%{name}-cli %{buildroot}%{_sbindir}
-+
-+# other shared files, public html, webpack
-+install -d %{buildroot}%{_datadir}/%{name}
++install -d %{buildroot}%{_datadir}/%{name}/bin
 +cp -a conf public %{buildroot}%{_datadir}/%{name}
 +
++# wrappers
++install -p -m 755 packaging/wrappers/grafana-cli %{buildroot}%{_sbindir}/%{name}-cli
++
++# binaries
++install -p -m 755 bin/%{_arch}/%{name}-server %{buildroot}%{_sbindir}
++install -p -m 755 bin/%{_arch}/%{name}-cli %{buildroot}%{_datadir}/%{name}/bin
++
 +# man pages
 +install -d %{buildroot}%{_mandir}/man1
 +install -p -m 644 docs/man/man1/* %{buildroot}%{_mandir}/man1
@@ -1351,6 +1443,7 @@ index 000000000..85f0dd6aa
 +rm -f pkg/services/provisioning/dashboards/file_reader_linux_test.go
 +rm -f pkg/services/provisioning/dashboards/file_reader_test.go
 +rm -f pkg/services/sqlstore/alert_test.go
++rm -f pkg/services/sqlstore/apikey_test.go
 +go test ./pkg/...
 +
 +
@@ -1373,6 +1466,7 @@ index 000000000..85f0dd6aa
 +%attr(-, %{GRAFANA_USER}, %{GRAFANA_GROUP}) %dir %{_sharedstatedir}/%{name}/plugins
 +
 +# shared directory and all files therein, except some datasources
++%{_datadir}/%{name}/bin
 +%{_datadir}/%{name}/public
 +
 +# built-in datasources that are sub-packaged
@@ -1449,6 +1543,16 @@ index 000000000..85f0dd6aa
 +
 +
 +%changelog
++* Fri Aug 30 2019 Mark Goodwin <mgoodwin@redhat.com> 6.3.4-1
++- add patch for uaparser on 32bit systems
++- update to latest upstream community sources, see CHANGELOG
++
++* Wed Jul 31 2019 Mark Goodwin <mgoodwin@redhat.com> 6.2.5-1
++- update to latest upstream community sources, see CHANGELOG
++
++* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 6.2.2-2
++- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
++
 +* Fri Jun 07 2019 Mark Goodwin <mgoodwin@redhat.com> 6.2.2-1
 +- split out some datasource plugins to sub-packages
 +- update to latest upstream community sources, see CHANGELOG
diff --git a/004-xerrors.patch b/004-xerrors.patch
new file mode 100644
index 0000000..fc0612a
--- /dev/null
+++ b/004-xerrors.patch
@@ -0,0 +1,146 @@
+diff --git a/go.mod b/go.mod
+index 13f7c66bb..e0615affa 100644
+--- a/go.mod
++++ b/go.mod
+@@ -77,7 +77,6 @@ require (
+ 	golang.org/x/oauth2 v0.0.0-20190319182350-c85d3e98c914
+ 	golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6
+ 	golang.org/x/sys v0.0.0-20190415081028-16da32be82c5 // indirect
+-	golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373
+ 	gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
+ 	gopkg.in/asn1-ber.v1 v1.0.0-20181015200546-f715ec2f112d // indirect
+ 	gopkg.in/bufio.v1 v1.0.0-20140618132640-567b2bfa514e // indirect
+diff --git a/vendor/golang.org/x/xerrors/adaptor_go1_12.go b/vendor/golang.org/x/xerrors/adaptor.go
+similarity index 99%
+rename from vendor/golang.org/x/xerrors/adaptor_go1_12.go
+rename to vendor/golang.org/x/xerrors/adaptor.go
+index 6b9f2f0c7..4317f2483 100644
+--- a/vendor/golang.org/x/xerrors/adaptor_go1_12.go
++++ b/vendor/golang.org/x/xerrors/adaptor.go
+@@ -2,8 +2,6 @@
+ // Use of this source code is governed by a BSD-style
+ // license that can be found in the LICENSE file.
+ 
+-// +build !go1.13
+-
+ package xerrors
+ 
+ import (
+diff --git a/vendor/golang.org/x/xerrors/adaptor_go1_13.go b/vendor/golang.org/x/xerrors/adaptor_go1_13.go
+deleted file mode 100644
+index 57f519dc5..000000000
+--- a/vendor/golang.org/x/xerrors/adaptor_go1_13.go
++++ /dev/null
+@@ -1,55 +0,0 @@
+-// Copyright 2018 The Go Authors. All rights reserved.
+-// Use of this source code is governed by a BSD-style
+-// license that can be found in the LICENSE file.
+-
+-// +build go1.13
+-
+-package xerrors
+-
+-import (
+-	"errors"
+-	"fmt"
+-	"strconv"
+-)
+-
+-// A Frame contains part of a call stack.
+-type Frame = errors.Frame
+-
+-// Caller returns a Frame that describes a frame on the caller's stack.
+-// The argument skip is the number of frames to skip over.
+-// Caller(0) returns the frame for the caller of Caller.
+-var Caller func(skip int) Frame = errors.Caller
+-
+-// FormatError calls the FormatError method of f with an errors.Printer
+-// configured according to s and verb, and writes the result to s.
+-func FormatError(f Formatter, s fmt.State, verb rune) {
+-	// Assuming this function is only called from the Format method, and given
+-	// that FormatError takes precedence over Format, it cannot be called from
+-	// any package that supports errors.Formatter. It is therefore safe to
+-	// disregard that State may be a specific printer implementation and use one
+-	// of our choice instead.
+-
+-	width, okW := s.Width()
+-	prec, okP := s.Precision()
+-
+-	// Construct format string from State s.
+-	format := []byte{'%'}
+-	if s.Flag('-') {
+-		format = append(format, '-')
+-	}
+-	if s.Flag('+') {
+-		format = append(format, '+')
+-	}
+-	if s.Flag(' ') {
+-		format = append(format, ' ')
+-	}
+-	if okW {
+-		format = strconv.AppendInt(format, int64(width), 10)
+-	}
+-	if okP {
+-		format = append(format, '.')
+-		format = strconv.AppendInt(format, int64(prec), 10)
+-	}
+-	format = append(format, string(verb)...)
+-	fmt.Fprintf(s, string(format), f)
+-}
+diff --git a/vendor/golang.org/x/xerrors/format_go1_12.go b/vendor/golang.org/x/xerrors/format.go
+similarity index 98%
+rename from vendor/golang.org/x/xerrors/format_go1_12.go
+rename to vendor/golang.org/x/xerrors/format.go
+index ba856feab..1bc9c26b9 100644
+--- a/vendor/golang.org/x/xerrors/format_go1_12.go
++++ b/vendor/golang.org/x/xerrors/format.go
+@@ -2,8 +2,6 @@
+ // Use of this source code is governed by a BSD-style
+ // license that can be found in the LICENSE file.
+ 
+-// +build !go1.13
+-
+ package xerrors
+ 
+ // A Formatter formats error messages.
+diff --git a/vendor/golang.org/x/xerrors/format_go1_13.go b/vendor/golang.org/x/xerrors/format_go1_13.go
+deleted file mode 100644
+index 95c65968b..000000000
+--- a/vendor/golang.org/x/xerrors/format_go1_13.go
++++ /dev/null
+@@ -1,19 +0,0 @@
+-// Copyright 2018 The Go Authors. All rights reserved.
+-// Use of this source code is governed by a BSD-style
+-// license that can be found in the LICENSE file.
+-
+-// +build go1.13
+-
+-package xerrors
+-
+-import "errors"
+-
+-// A Formatter formats error messages.
+-type Formatter = errors.Formatter
+-
+-// A Printer formats error messages.
+-//
+-// The most common implementation of Printer is the one provided by package fmt
+-// during Printf (as of Go 1.13). Localization packages such as golang.org/x/text/message
+-// typically provide their own implementations.
+-type Printer = errors.Printer
+diff --git a/vendor/golang.org/x/xerrors/frame_go1_12.go b/vendor/golang.org/x/xerrors/frame.go
+similarity index 98%
+rename from vendor/golang.org/x/xerrors/frame_go1_12.go
+rename to vendor/golang.org/x/xerrors/frame.go
+index 6740f7fa6..0de628ec5 100644
+--- a/vendor/golang.org/x/xerrors/frame_go1_12.go
++++ b/vendor/golang.org/x/xerrors/frame.go
+@@ -2,8 +2,6 @@
+ // Use of this source code is governed by a BSD-style
+ // license that can be found in the LICENSE file.
+ 
+-// +build !go1.13
+-
+ package xerrors
+ 
+ import (
diff --git a/grafana.spec b/grafana.spec
index b12ce8f..0b2849d 100644
--- a/grafana.spec
+++ b/grafana.spec
@@ -8,16 +8,21 @@
   end
 end}
 
-# Unbundle grafana vendor sources and instead use BuildRequires
+# Unbundle Grafana vendor sources and instead use BuildRequires
 # only on platforms that have enough golang devel support.
 %if 0%{?rhel} == 0
 %global           unbundle_vendor_sources 1
 %endif
 
+%if 0%{?fedora} >= 31
+# Use vendor sources until both Fedora and Grafana properly support golang modules
+%global           unbundle_vendor_sources 0
+%endif
+
 
 Name:             grafana
-Version:          6.2.2
-Release:          2%{?dist}
+Version:          6.3.5
+Release:          1%{?dist}
 Summary:          Metrics dashboard and graph editor
 License:          ASL 2.0
 URL:              https://grafana.org
@@ -35,11 +40,13 @@ Source2:          make_grafana_webpack.sh
 Patch1:           001-login-oauth-use-oauth2-exchange.patch
 Patch2:           002-remove-jaeger-tracing.patch
 Patch3:           003-new-files.patch
+Patch4:           004-xerrors.patch
 
 # Intersection of go_arches and nodejs_arches
 ExclusiveArch:    %{grafana_arches}
 
 # omit golang debugsource, see BZ995136 and related
+%global           dwz_low_mem_die_limit 0
 %global           _debugsource_template %{nil}
 
 %global           GRAFANA_USER %{name}
@@ -50,7 +57,7 @@ ExclusiveArch:    %{grafana_arches}
 %{?systemd_requires}
 Requires(pre):    shadow-utils
 
-BuildRequires:    systemd, golang, go-srpm-macros
+BuildRequires:    git, systemd, golang, go-srpm-macros
 
 Recommends: grafana-cloudwatch = %{version}-%{release}
 Recommends: grafana-elasticsearch = %{version}-%{release}
@@ -193,10 +200,15 @@ BuildRequires: golang(github.com/go-redis/redis)
 BuildRequires: golang(gopkg.in/square/go-jose.v2)
 BuildRequires: golang(gopkg.in/square/go-jose.v2/cipher)
 BuildRequires: golang(gopkg.in/square/go-jose.v2/json)
+%if 0%{fedora} >= 31
+BuildRequires: golang(gopkg.in/yaml.v2)
+%else
 BuildRequires: golang(github.com/go-yaml/yaml)
+%endif
 BuildRequires: golang(golang.org/x/sync/errgroup)
 BuildRequires: golang(gopkg.in/ldap.v3)
 BuildRequires: golang(gopkg.in/mail.v2)
+BuildRequires: golang(github.com/jonboulle/clockwork)
 %endif
 
 # Declare all nodejs modules bundled in the webpack - this is for security
@@ -393,6 +405,7 @@ The Grafana stackdriver datasource.
 %patch1 -p1
 %patch2 -p1
 %patch3 -p1
+%patch4 -p1
 
 # Set up build subdirs and links
 mkdir -p %{_builddir}/src/github.com/grafana
@@ -405,25 +418,32 @@ rm -f public/sass/.sass-lint.yml public/test/.jshintrc
 %if 0%{?unbundle_vendor_sources}
 # Unbundle all grafana vendor sources, as per BuildRequires above.
 # An exception is grafana-plugin-model, which is part of grafana.
-# Another exception is xerrors, which is a transition package
-# for the new Go 1.13 error values, see https://github.com/golang/xerrors
-cp --parents -a vendor/github.com/grafana vendor/golang.org/x/xerrors \
-    vendor/github.com/robfig/cron %{_builddir}
+cp --parents -a vendor/github.com/grafana \
+    vendor/golang.org/x/xerrors \
+    vendor/github.com/robfig vendor/github.com/crewjam/saml \
+    vendor/github.com/ua-parser/uap-go/uaparser  \
+    vendor/github.com/beevik/etree \
+    vendor/github.com/russellhaering/goxmldsig \
+    %{_builddir}
 rm -r vendor # remove all vendor sources
 mv %{_builddir}/vendor vendor # put back what we're keeping
 %endif
 
 
 %build
-# Build the server-side binaries: grafana-server and grafana-cli
-%if 0%{?gobuild}
-# use modern go macros such as in recent Fedora
-export GOPATH=%{_builddir}:%{gopath}
-%gobuild -o grafana-cli ./pkg/cmd/grafana-cli
-%gobuild -o grafana-server ./pkg/cmd/grafana-server
-%else
+# Build the server-side binaries
 cd %{_builddir}/src/github.com/grafana/grafana
+%global archbindir bin/`go env GOOS`-`go env GOARCH`
+echo _builddir=%{_builddir} archbindir=%{archbindir}
+[ ! -d %{archbindir} ] && mkdir -p %{archbindir}
 export GOPATH=%{_builddir}:%{gopath}
+# export GO111MODULE=off
+%if 0%{?fedora} >= 31
+# native fedora golang build but without modules (no grafana support yet)
+go build -mod=vendor -o %{archbindir}/grafana-cli ./pkg/cmd/grafana-cli
+go build -mod=vendor -o %{archbindir}/grafana-server ./pkg/cmd/grafana-server
+%else
+# use the grafana build.go script.
 go run build.go build
 %endif
 
@@ -438,15 +458,18 @@ go run build.go build
 [ ! -d bin/arm64 ] && ln -sf linux-arm64 bin/aarch64
 [ ! -d bin/aarch64 ] && ln -sf linux-aarch64 bin/aarch64
 
-# binaries
+# dirs, shared files, public html, webpack
 install -d %{buildroot}%{_sbindir}
-install -p -m 755 bin/%{_arch}/%{name}-server %{buildroot}%{_sbindir}
-install -p -m 755 bin/%{_arch}/%{name}-cli %{buildroot}%{_sbindir}
-
-# other shared files, public html, webpack
-install -d %{buildroot}%{_datadir}/%{name}
+install -d %{buildroot}%{_datadir}/%{name}/bin
 cp -a conf public %{buildroot}%{_datadir}/%{name}
 
+# wrappers
+install -p -m 755 packaging/wrappers/grafana-cli %{buildroot}%{_sbindir}/%{name}-cli
+
+# binaries
+install -p -m 755 %{archbindir}/%{name}-server %{buildroot}%{_sbindir}
+install -p -m 755 %{archbindir}/%{name}-cli %{buildroot}%{_datadir}/%{name}/bin
+
 # man pages
 install -d %{buildroot}%{_mandir}/man1
 install -p -m 644 docs/man/man1/* %{buildroot}%{_mandir}/man1
@@ -506,6 +529,8 @@ export GOPATH=%{_builddir}:%{gopath}
 rm -f pkg/services/provisioning/dashboards/file_reader_linux_test.go
 rm -f pkg/services/provisioning/dashboards/file_reader_test.go
 rm -f pkg/services/sqlstore/alert_test.go
+rm -f pkg/services/sqlstore/apikey_test.go
+export GO111MODULE=off
 go test ./pkg/...
 
 
@@ -528,6 +553,7 @@ go test ./pkg/...
 %attr(-, %{GRAFANA_USER}, %{GRAFANA_GROUP}) %dir %{_sharedstatedir}/%{name}/plugins
 
 # shared directory and all files therein, except some datasources
+%{_datadir}/%{name}/bin
 %{_datadir}/%{name}/public
 
 # built-in datasources that are sub-packaged
@@ -604,6 +630,20 @@ go test ./pkg/...
 
 
 %changelog
+* Thu Sep 05 2019 Mark Goodwin <mgoodwin@redhat.com> 6.3.5-1
+- drop uaparser patch now it's upstream
+- add xerrors patch, see https://github.com/golang/go/issues/32246
+- use vendor sources on rawhide until modules are fully supported
+- update to latest upstream community sources, see CHANGELOG
+
+* Fri Aug 30 2019 Mark Goodwin <mgoodwin@redhat.com> 6.3.4-1
+- include fix for CVE-2019-15043
+- add patch for uaparser on 32bit systems
+- update to latest upstream community sources, see CHANGELOG
+
+* Wed Jul 31 2019 Mark Goodwin <mgoodwin@redhat.com> 6.2.5-1
+- update to latest upstream community sources, see CHANGELOG
+
 * Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 6.2.2-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
 
diff --git a/sources b/sources
index 7aa1917..6e15cea 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (grafana-6.2.2.tar.gz) = fffa2a04c5249e6159297280313b7d6cbec2f86fc59e48200405905848dda524bb522cf34a1cf2f55855104e93c72e69284875f0dbea447cc8f551948c03e8af
-SHA512 (grafana_webpack-6.2.2.tar.gz) = db09ff6cf5c1292bca01dfb5c0c1e615890c229c510785af11406bc945f135b19d14fcda6a483c6a438dde567f8d43d59298aec638c6780a788b60bb9b734d64
+SHA512 (grafana-6.3.5.tar.gz) = c0151583bbed121290b091d40aae655ca22901d80ab02eafb5fea96f80bdcb88d070c4d778284d7c4605a420fe8918c82a67a51325cc71d605e4212a6a1c9162
+SHA512 (grafana_webpack-6.3.5.tar.gz) = 3967ee64501886994d26c6d6c1f949db9732d1dafbe7dd105ff5de4dc26c4d87831fcc6195f086262e86aa9c10e4be7f012bee8d6c95eb52f835837d3ac6d126