Remove cockpit.pam as this was upstreamed

This commit makes check_cockpit_users only check for systemd dynamic
user support in nsswitch. We do not need to check for compat based on
what Thorsten Kukuk has said. Checking for arguments before systemd
maybe be problematic as for example usrfiles maybe present on some
hermetic-usr systems.

0001-cockpit-overview-support-SUSE_SUPPORT_PRODUCT-keys.patch

@@ -0,0 +1,69 @@
+From ec3a1efce07770b7641e07d41a73732967c65175 Mon Sep 17 00:00:00 2001
+From: Luna D Dragon <luna.dragon@suse.com>
+Date: Tue, 8 Jul 2025 14:58:03 +0530
+Subject: [PATCH 1/3] cockpit overview: support SUSE_SUPPORT_PRODUCT keys
+
+SLE Micro 6.2(and Framework one components) have custom os-release keys namely in SUSE_SUPPORT_PRODUCT and
+SUSE_SUPPORT_PRODUCT_VERSION instead of the standard os prettyname which
+results in systemd not being able to determine the os name correctly.
+This patch should be dropped when systemd is fixed
+---
+ pkg/systemd/overview.jsx | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/pkg/systemd/overview.jsx b/pkg/systemd/overview.jsx
+index 868469d68..186fcf59e 100644
+--- a/pkg/systemd/overview.jsx
++++ b/pkg/systemd/overview.jsx
+@@ -42,6 +42,7 @@ import { ShutdownModal } from 'cockpit-components-shutdown.jsx';
+ import { WithDialogs, DialogsContext } from "dialogs.jsx";
+ 
+ import "./overview.scss";
++import { read_os_release } from "os-release.js";
+ 
+ const _ = cockpit.gettext;
+ 
+@@ -98,6 +99,7 @@ class OverviewPage extends React.Component {
+         this.hostname_proxy.addEventListener("changed", data => {
+             this.setState({ hostnameData: data.detail });
+         });
++        read_os_release().then(os_release => this.setState({ os_release }));
+     }
+ 
+     render() {
+@@ -160,8 +162,12 @@ class OverviewPage extends React.Component {
+                             {this.hostname_text()}
+                         </h1>
+                         {this.state.hostnameData &&
+-                         this.state.hostnameData.OperatingSystemPrettyName &&
+-                         <div className="ct-overview-header-subheading" id="system_information_os_text">{cockpit.format(_("running $0"), this.state.hostnameData.OperatingSystemPrettyName)}</div>}
++                         this.state.hostnameData.OperatingSystemPrettyName && (
++                            <div className="ct-overview-header-subheading" id="system_information_os_text">
++                                {(this.state.os_release && this.state.os_release.SUSE_PRETTY_NAME)
++                                    ? cockpit.format(_("running $0"), this.state.os_release.SUSE_PRETTY_NAME)
++                                    : cockpit.format(_("running $0"), this.state.hostnameData.OperatingSystemPrettyName)}
++                            </div>)}
+                     </div>
+                     <div className='ct-overview-header-actions'>
+                         { show_superuser && <SuperuserIndicator proxy={this.superuser} /> }
+diff --git a/src/common/cockpitsystem.c b/src/common/cockpitsystem.c
+index 83e2965f7..73716fff7 100644
+--- a/src/common/cockpitsystem.c
++++ b/src/common/cockpitsystem.c
+@@ -107,6 +107,12 @@ cockpit_system_load_os_release (void)
+         }
+     }
+ 
++  gchar *value = g_hash_table_lookup (result, "SUSE_PRETTY_NAME");
++  if (!value || strlen(value) == 0) {
++    value = g_hash_table_lookup (result, "PRETTY_NAME");
++    g_hash_table_replace (result, g_strdup ("SUSE_PRETTY_NAME"), g_strdup (value));
++  }
++
+  out:
+   g_clear_error (&error);
+   g_free (lines);
+
+-- 
+2.50.0
+

0001-selinux-allow-login-to-read-motd-file.patch

@@ -7,11 +7,11 @@ Date:   Fri Aug 6 15:11:23 2021 +0200
 Index: cockpit/selinux/cockpit.te
 ===================================================================
 diff --git a/selinux/cockpit.te b/selinux/cockpit.te
-index 50695ee..55b1226 100644
+index 931cbd775..4a439c8d5 100644
 --- a/selinux/cockpit.te
 +++ b/selinux/cockpit.te
-@@ -224,6 +224,14 @@ optional_policy(`
-     gnome_exec_keyringd(cockpit_session_t)
+@@ -232,6 +232,14 @@ optional_policy(`
+     allow cockpit_session_t pidfs_t:filesystem getattr;
  ')
  
 +# login may read motd file through pam

0002-cockpit-kdump-support-SLE-micro-6.2.patch

@@ -0,0 +1,37 @@
+From 14b86b6d60b009c4294f06589a561e688ba49223 Mon Sep 17 00:00:00 2001
+From: Luna D Dragon <luna.dragon@suse.com>
+Date: Tue, 8 Jul 2025 14:58:25 +0530
+Subject: [PATCH 2/3] cockpit-kdump support SLE micro 6.2
+
+SLE micro 6.2 no longer has MicroOS in the NAME. This updates it to
+check if the VARIANT_ID is transactional to use transactional-update
+over manually enabling kdump.
+---
+ pkg/kdump/kdump-view.jsx | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/pkg/kdump/kdump-view.jsx b/pkg/kdump/kdump-view.jsx
+index eee4d16b1..7d8439f2b 100644
+--- a/pkg/kdump/kdump-view.jsx
++++ b/pkg/kdump/kdump-view.jsx
+@@ -421,7 +421,7 @@ export class KdumpPage extends React.Component {
+ kdumpctl reset-crashkernel`;
+         }
+         let shell;
+-        if (this.state.os_release.NAME?.includes('MicroOS')) {
++        if (this.state.os_release.NAME?.includes('MicroOS') || this.state.os_release.VARIANT_ID?.includes("transactional")) {
+             enableCrashKernel = `
+ # A reboot will be required if crashkernel was not set before
+ transactional-update setup-kdump`;
+@@ -443,7 +443,7 @@ ${enableCrashKernel}
+ 
+         Dialogs.show(
+             <ModificationsExportDialog
+-              ansible={ this.state.os_release.NAME?.includes('MicroOS') ? null : exportAnsibleTask(this.props.kdumpStatus.config, this.state.os_release)}
++              ansible={ (this.state.os_release.NAME?.includes('MicroOS') || this.state.os_release.VARIANT_ID?.includes("transactional")) ? null : exportAnsibleTask(this.props.kdumpStatus.config, this.state.os_release)}
+               shell={shell}
+               onClose={Dialogs.close}
+             />);
+-- 
+2.50.0
+

0003-branding-use-SUSE_SUPPORT_PRODUCT-and-SUSE_SUPPORT_P.patch

@@ -0,0 +1,136 @@
+From cfc476e5127ee3f21b70124e77ded9627e9692b5 Mon Sep 17 00:00:00 2001
+From: Luna D Dragon <luna.dragon@suse.com>
+Date: Tue, 8 Jul 2025 15:09:09 +0530
+Subject: [PATCH 3/3] branding: use SUSE_SUPPORT_PRODUCT and
+ SUSE_SUPPORT_PRODUCT_VERSION
+
+---
+ Makefile.am                    |  1 +
+ src/branding/suse/Makefile.am  | 11 +++++
+ src/branding/suse/branding.css | 82 ++++++++++++++++++++++++++++++++++
+ 3 files changed, 94 insertions(+)
+ create mode 100644 src/branding/suse/Makefile.am
+ create mode 100644 src/branding/suse/branding.css
+
+diff --git a/Makefile.am b/Makefile.am
+index 83f1ee7a7..1198d191e 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -167,6 +167,7 @@ include src/branding/debian/Makefile.am
+ include src/branding/default/Makefile.am
+ include src/branding/fedora/Makefile.am
+ include src/branding/opensuse/Makefile.am
++include src/branding/suse/Makefile.am
+ include src/branding/rhel/Makefile.am
+ include src/branding/ubuntu/Makefile.am
+ include src/client/Makefile.am
+diff --git a/src/branding/suse/Makefile.am b/src/branding/suse/Makefile.am
+new file mode 100644
+index 000000000..4a1e7ab72
+--- /dev/null
++++ b/src/branding/suse/Makefile.am
+@@ -0,0 +1,11 @@
++slemicrobrandingdir = $(datadir)/cockpit/branding/suse
++
++dist_slemicrobranding_DATA = \
++    src/branding/suse/branding.css \
++	$(NULL)
++
++install-data-hook::
++	ln -sf /usr/share/wallpapers/SLEdefault/contents/images/1920x1200.png $(DESTDIR)$(slemicrobrandingdir)/default-1920x1200.png
++	ln -sf /usr/share/pixmaps/distribution-logos/square-hicolor.svg $(DESTDIR)$(slemicrobrandingdir)/square-hicolor.svg
++	ln -sf /usr/share/pixmaps/distribution-logos/favicon.ico $(DESTDIR)$(slemicrobrandingdir)/favicon.ico
++	ln -sf /usr/share/pixmaps/distribution-logos/apple-touch-icon.png $(DESTDIR)$(slemicrobrandingdir)/apple-touch-icon.png
+\ No newline at end of file
+diff --git a/src/branding/suse/branding.css b/src/branding/suse/branding.css
+new file mode 100644
+index 000000000..c1617abc2
+--- /dev/null
++++ b/src/branding/suse/branding.css
+@@ -0,0 +1,82 @@
++/* Extra overrides */
++:root {
++    --eos-bc-green-500: #30ba78;
++    --eos-bc-pine-500: #0c322c;
++    --eos-bc-gray-50: #F2F2F2;
++    --eos-bc-white: #ffffff;
++    --eos-bc-text: #333;
++}
++
++
++#brand:before {
++    content: "${SUSE_PRETTY_NAME}";
++}
++
++#option-group svg polygon {
++    fill: var(--eos-bc-text);
++}
++
++/* Nav & sidebar overwrites */
++.navbar-pf {
++    background: var(--eos-bc-pine-500);
++}
++
++.navbar-pf-vertical {
++    border-top: none;
++}
++
++
++/* Default overrides */
++
++.login-note {
++    display: none;
++    position: relative;
++}
++
++body.login-pf {
++    background-color: var(--eos-bc-pine-500);
++}
++
++/* Only use background image on desktops */
++@media(min-width: 1024px) {
++    body.login-pf {
++        background-image: url("default-1920x1200.png") !important;
++        background-repeat: no-repeat;
++        background-position: 100% 0 !important;
++        background-size: cover;
++    }
++}
++
++/* Hide badge on desktops (already included in background) */
++@media(max-width: 1023px) {
++    #badge {
++        width: 51px;
++        height: 45px;
++        background-image: url("square-hicolor.svg");
++        background-repeat: no-repeat;
++    }
++}
++
++#brand {
++    width: auto;
++    height: auto;
++    background-image: none;
++    background-repeat: no-repeat;
++    font-size: 2em;
++    white-space: nowrap;
++}
++
++/* Switch to small font faster to not clip long name */
++@media(max-width: 560px) {
++    #brand {
++        font-size: inherit;
++    }
++}
++
++#index-brand {
++    font-weight: bold;
++}
++
++#index-brand:before {
++    content: "${PRETTY_NAME}";
++}
+\ No newline at end of file
+-- 
+2.50.0
+

0009-packagekit-reboot-notification.patch

@@ -0,0 +1,116 @@
+diff --git a/pkg/packagekit/updates.jsx b/pkg/packagekit/updates.jsx
+index ce4b3c4cc6d1..b423ee4c09bd 100644
+--- a/pkg/packagekit/updates.jsx
++++ b/pkg/packagekit/updates.jsx
+@@ -21,6 +21,7 @@ import 'polyfills'; // once per application
+ import 'cockpit-dark-theme'; // once per page
+ 
+ import cockpit from "cockpit";
++import { fsinfo } from 'cockpit/fsinfo';
+ import React from "react";
+ import { createRoot } from 'react-dom/client';
+ 
+@@ -1079,12 +1080,19 @@ class OsUpdates extends React.Component {
+                     debug("tracer parsed restartPackages:", JSON.stringify(restartPackages));
+                     this.setState({ checkRestartAvailable: true, checkRestartRunning: false, restartPackages });
+                 })
+-                .catch((exception, data) => {
++                .catch(async (exception, data) => {
+                     // tracer not installed or supported (like on Arch)? then fall back to dnf needs-restarting
+                     if (exception.message?.includes("ModuleNotFoundError") ||
+                         exception.message?.includes("UnsupportedDistribution")) {
+-                        debug('tracer not installed:', JSON.stringify(exception), "trying dnf needs-restarting");
+-                        return this.checkDnfNeedsRestarting();
++                        try {
++                            // if there's a history for zypper, we can assume the system uses it
++                            await fsinfo("/var/log/zypp/history", [], { superuser: "require" });
++                            debug('tracer not installed:', JSON.stringify(exception), "trying zypper ps");
++                            return this.checkZypperNeedsRestarting();
++                        } catch {
++                            debug('tracer not installed:', JSON.stringify(exception), "trying dnf needs-restarting");
++                            return this.checkDnfNeedsRestarting();
++                        }
+                     }
+ 
+                     // log the error except for some common cases: polkit does not allow it
+@@ -1106,6 +1114,80 @@ class OsUpdates extends React.Component {
+                 });
+     }
+ 
++    checkZypperNeedsRestarting() {
++        const restartPackages = { reboot: [], daemons: [], manual: [] };
++        return cockpit.spawn(["zypper", "ps", "-ss", "--print", "%s"], { err: "message", superuser: "require" })
++                .then((serviceOut) => {
++                    debug("zypper ps -ss succeeded:", serviceOut);
++
++                    // set all the services to be manually restarted since it's
++                    // not always clear if it's safe to restart them via cockpit
++                    const data = serviceOut.trim();
++                    if (data.length !== 0) {
++                        serviceOut.trim()
++                                .split("\n")
++                                .forEach(line => restartPackages.manual.push(line));
++                    }
++
++                    // Check if any kernels are updated since system boot,
++                    // ignoring kernel-firmware updates as they can make things noisy
++                    //
++                    // /var/log/zypper.log can be quite big so it's better to
++                    // handle the processing on machine instead of fetching the data
++                    const kScript = `
++                          stat -c %z /proc/ | \\
++                          cut -d. -f 1 | \\
++                          xargs -i \\
++                          awk -F'|' -v boot="{}" \\
++                          '/install\\|kernel/{if (boot <= $1 && index($0, "firmware") == 0) {print $3"-"$4"."$5}}' \\
++                          /var/log/zypp/history
++                          `;
++
++                    cockpit.script(kScript, undefined, { err: "message", superuser: "require" })
++                            .then(kernels => {
++                                debug("zypper kernel scripts succeeded:", kernels);
++
++                                if (kernels.trim().length == 0) {
++                                    return;
++                                }
++
++                                kernels.trim()
++                                        .split("\n")
++                                        .forEach(line => { restartPackages.reboot.push(line.trim()) });
++                            })
++                            .catch(ex => {
++                                if (ex.problem !== "not-found" &&
++                                // polkit does not allow it
++                                ex.problem !== "access-denied" &&
++                                // or unprivileged session
++                                ex.problem !== "authentication-failed" &&
++                                // or the session goes away while checking
++                                ex.problem !== "terminated")
++                                    console.error("zypper kernel fetching failed:", ex.toString());
++                            })
++                            .then(() => {
++                                let checkRestartAvailable = false;
++                                if (restartPackages.reboot.length !== 0 || restartPackages.manual.length !== 0)
++                                    checkRestartAvailable = true;
++
++                                this.setState({ checkRestartAvailable, checkRestartRunning: false, restartPackages });
++                            });
++                }).catch((ex) => {
++                    // log the error except for some common cases: no zypper
++                    if (ex.problem !== "not-found" &&
++                    // polkit does not allow it
++                    ex.problem !== "access-denied" &&
++                    // or unprivileged session
++                    ex.problem !== "authentication-failed" &&
++                    // or the session goes away while checking
++                    ex.problem !== "terminated")
++                        console.error("zypper ps -ss failed:", ex);
++
++                    // act like it's not available (demand reboot after every update)
++                    this.setState({ checkRestartAvailable: false, checkRestartRunning: false, restartPackages });
++                });
++    }
++
+     checkDnfNeedsRestarting() {
+         const restartPackages = { reboot: [], daemons: [], manual: [] };
+ 

check_cockpit_users

@@ -23,7 +23,7 @@ if [ $? -eq 0 ]; then
 fi
 
 if [ -f /etc/nsswitch.conf ]; then
-    grep -Exq "passwd:.*?compat systemd" /etc/nsswitch.conf
+    grep -Eq "passwd:.*systemd" /etc/nsswitch.conf
     if [ $? -ne 0 ]; then
         echo "/etc/nsswitch.conf is out of date, please update it from /usr/etc/nsswitch.conf to use cockpit"
         failed=true

cockpit.changes

@@ -1,3 +1,70 @@
+-------------------------------------------------------------------
+Thu Aug 14 04:53:41 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
+
+- Update to 344
+  * Changes since 340
+    - 344
+      * Bug fixes and translation updates
+    - 343
+      * login: Improve error message for unsupported shells
+      * cockpit: Handle file access issues with files in machines.d
+      * Translation updates
+    - 342
+      * systemd: ensure update() is called at least once for tuned-dialog
+      * Translation updates
+    - 341
+      * services: show link to podman page for quadlets
+      * Bug fixes and translation updates
+- Remove kdump-nfs-fixes.patch as this was upstreamed
+- Fix not falling back to PRETTY_NAME in SUSE_PRETTY_NAME patches
+
+-------------------------------------------------------------------
+Wed Jul 30 03:21:48 UTC 2025 - Luna D Dragon <luna.dragon@suse.com>
+
+- drop duplicate %changelog macro
+
+-------------------------------------------------------------------
+Wed Jul 23 12:53:37 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
+
+- Add %postun for firewalld package to ensure the firewall state
+  remains as expected
+
+-------------------------------------------------------------------
+Mon Jul 21 11:39:56 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
+
+- Add cockpit-firewalld package for easily configuring the users
+  firewall jsc#PED-13228
+
+-------------------------------------------------------------------
+Tue Jul 15 07:00:10 UTC 2025 - Luna D Dragon <luna.dragon@suse.com>
+
+- add 0001-cockpit-overview-support-SUSE_SUPPORT_PRODUCT-keys.patch
+- add 0002-cockpit-kdump-support-SLE-micro-6.2.patch
+- add 0003-branding-use-SUSE_SUPPORT_PRODUCT-and-SUSE_SUPPORT_P.patch to fix bsc#1241003 
+
+-------------------------------------------------------------------
+Mon Jul 14 08:04:06 UTC 2025 - Luna D Dragon <luna.dragon@suse.com>
+
+- update check_cockpit_users to only check for systemd support in /etc/nsswitch.conf bsc#1246408
+
+-------------------------------------------------------------------
+Fri Jul 11 07:13:59 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
+
+- add a requirement on /usr/sbin/kdumptool for cockpit-kdump (bsc#1227402)
+
+-------------------------------------------------------------------
+Fri Jul 11 06:50:17 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
+
+- add libzypp-plugin-appdata dependency to cockpit-packagekit as
+  this will generate the swcatalog which it depends on for calculating
+  various cockpit packages
+
+-------------------------------------------------------------------
+Thu Jul 10 10:10:21 UTC 2025 - Miika Alikirri <miika.alikirri@suse.com>
+
+- Show reboot nofication after updates in packagekit
+  * Add 0009-packagekit-reboot-notification.patch
+
 -------------------------------------------------------------------
 Thu Jun 19 08:30:49 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
 

cockpit.pam

@@ -1,11 +0,0 @@
-#%PAM-1.0
-auth substack common-auth
-# List of users to deny access to Cockpit, by default root is included.
-auth    required pam_listfile.so item=user sense=deny file=/etc/cockpit/disallowed-users onerr=succeed
-account required pam_nologin.so
-account include common-account
-password include common-password
-session required pam_loginuid.so
-session optional pam_keyinit.so force revoke
-session include common-session
-auth [user_unknown=ignore success=ok] pam_oath.so usersfile=${HOME}/.pam_oath_usersfile no_usersfile_okay window=20 digits=6

cockpit.spec

@@ -38,6 +38,14 @@
 
 %define __lib lib
 
+%if 0%{?suse_version} > 1500
+%define pamconfdir %{_pam_vendordir}
+%define pamconfig tools/cockpit.suse.pam
+%else
+%define pamconfdir %{_sysconfdir}/pam.d
+%define pamconfig tools/cockpit.pam
+%endif
+
 %if %{defined _pamdir}
 %define pamdir %{_pamdir}
 %else
@@ -50,10 +58,9 @@ Summary:        Web Console for Linux servers
 License:        LGPL-2.1-or-later
 URL:            https://cockpit-project.org/
 
-Version:        340
+Version:        344
 Release:        0
 Source0:        cockpit-%{version}.tar.gz
-Source1:        cockpit.pam
 Source2:        cockpit-rpmlintrc
 Source3:        cockpit-suse-theme.tar
 Source4:        cockpit-no-pamoath.pam
@@ -68,7 +75,6 @@ Patch2:         suse_docs.patch
 Patch3:         suse-microos-branding.patch
 Patch4:         css-overrides.patch
 Patch5:         storage-btrfs.patch
-Patch6:         kdump-nfs-fixes.patch
 # SLE Micro specific patches
 Patch101:       hide-pcp.patch
 Patch102:       0002-selinux-temporary-remove-setroubleshoot-section.patch
@@ -81,6 +87,10 @@ Patch105:       fix-libexecdir.patch
 Patch106:       packagekit-single-install.patch
 Patch109:       0008-pybridge-endian-flag.patch
 Patch110:       add_preexec_cockpit.patch
+Patch111:       0001-cockpit-overview-support-SUSE_SUPPORT_PRODUCT-keys.patch
+Patch112:       0002-cockpit-kdump-support-SLE-micro-6.2.patch
+Patch113:       0003-branding-use-SUSE_SUPPORT_PRODUCT-and-SUSE_SUPPORT_P.patch
+Patch114:       0009-packagekit-reboot-notification.patch
 Patch201:       remove_rh_links.patch
 
 %define build_all 1
@@ -169,7 +179,6 @@ BuildRequires: xmlto
 
 %if 0%{?with_selinux}
 BuildRequires:  selinux-policy
-BuildRequires:  selinux-policy-%{selinuxtype}
 BuildRequires:  selinux-policy-devel
 %endif
 
@@ -188,6 +197,7 @@ Requires: cockpit-system
 # Optional components
 Recommends: (cockpit-storaged if udisks2)
 Recommends: (cockpit-packagekit if (dnf or zypper))
+Recommends: (cockpit-firewalld if firewalld)
 Suggests: python3-pcp
 
 %if 0%{?rhel} == 0
@@ -213,13 +223,19 @@ BuildRequires:  python3-pytest-timeout
 %setup -q -n cockpit-%{version} -a 3
 %patch -P 1 -p1
 %patch -P 2 -p1
+
+%if 0%{?is_opensuse} || 0%{?suse_version} < 1600
 %patch -P 3 -p1
+%else
+%patch -P  113 -p1
+%endif
+
 %patch -P 4 -p1
 %patch -P 5 -p1
-%patch -P 6 -p1
 
 %patch -P 106 -p1
 %patch -P 109 -p1
+%patch -P 114 -p1
 
 # SLE Micro specific patches
 %if 0%{?is_smo}
@@ -242,13 +258,15 @@ BuildRequires:  python3-pytest-timeout
 
 %if 0%{?suse_version} >= 1600
 %patch -P 110 -p1
+%if !0%{?is_opensuse}
+%patch -P  111 -p1
+%patch -P  112 -p1
+%endif
 %endif
 
 %patch -P 201 -p1
 
-%if 0%{?suse_version} > 1500
-cp %SOURCE1 tools/cockpit.pam
-%else
+%if 0%{?suse_version} < 1500
 cp %SOURCE4 tools/cockpit.pam
 %endif
 #
@@ -286,20 +304,19 @@ bzip2 -9 cockpit.pp
 make -j$(nproc) check
 
 %if 0%{?rhel} == 0 && 0%{?suse_version} == 0
-%tox
+export NO_QUNIT=1
+%pytest
 %endif
 
 %install
+%if 0%{?suse_version}
+export NO_BRP_STALE_LINK_ERROR="yes"
+%endif
 # In obs we get  write error: stdout
 %make_install | tee make_install.log
 make install-tests DESTDIR=%{buildroot}
-%if 0%{?suse_version} > 1500
-mkdir -p $RPM_BUILD_ROOT%{_pam_vendordir}
-install -p -m 644 tools/cockpit.pam $RPM_BUILD_ROOT%{_pam_vendordir}/cockpit
-%else
-mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/pam.d
-install -p -m 644 tools/cockpit.pam $RPM_BUILD_ROOT%{_sysconfdir}/pam.d/cockpit
-%endif
+mkdir -p $RPM_BUILD_ROOT%{pamconfdir}
+install -p -m 644 %{pamconfig} $RPM_BUILD_ROOT%{pamconfdir}/cockpit
 rm -f %{buildroot}/%{_libdir}/cockpit/*.so
 install -D -p -m 644 AUTHORS COPYING README.md %{buildroot}%{_docdir}/cockpit/
 
@@ -413,14 +430,6 @@ rm -f %{buildroot}/%{pamdir}/mock-pam-conv-mod.so
 sed -i "s|%{buildroot}||" *.list
 
 %if 0%{?suse_version}
-# remove brandings with stale symlinks. Means they don't match
-# the distro.
-pushd %{buildroot}/%{_datadir}/cockpit/branding
-ls --hide={default,kubernetes,opensuse,registry,suse} | xargs rm -rv
-popd
-# need this in SUSE as post build checks dislike stale symlinks
-install -m 644 -D /dev/null %{buildroot}/run/cockpit/issue
-
 test -e %{buildroot}/usr/share/cockpit/branding/opensuse/default-1920x1200.jpg  || install -m 644 -D /dev/null %{buildroot}/usr/share/cockpit/branding/opensuse/default-1920x1200.jpg
 test -e %{buildroot}/usr/share/cockpit/branding/suse/apple-touch-icon.png  || install -m 644 -D /dev/null %{buildroot}/usr/share/cockpit/branding/suse/apple-touch-icon.png
 test -e %{buildroot}/usr/share/cockpit/branding/suse/default-1920x1200.png || install -m 644 -D /dev/null %{buildroot}/usr/share/cockpit/branding/suse/default-1920x1200.png
@@ -607,13 +616,10 @@ authentication via sssd/FreeIPA.
 %doc %{_mandir}/man8/pam_ssh_add.8.gz
 %dir %{_sysconfdir}/cockpit
 %config(noreplace) %{_sysconfdir}/cockpit/ws-certs.d
-%if 0%{?suse_version} > 1500
-%{_pam_vendordir}/cockpit
-%else
-%config(noreplace) %{_sysconfdir}/pam.d/cockpit
-%endif
-# dir is not owned by pam in openSUSE
+# dir is not owned by pam in openSUSE needed for Leap15.6
+%dir %{pamconfdir}
 %dir %{_sysconfdir}/motd.d
+%config(noreplace) %{pamconfdir}/cockpit
 # created in %post, so that users can rm the files
 %ghost %{_sysconfdir}/issue.d/cockpit.issue
 %ghost %{_sysconfdir}/motd.d/cockpit
@@ -779,7 +785,11 @@ SELinux policy module for the cockpit-ws package.
 Summary: Cockpit user interface for kernel crash dumping
 Requires: cockpit-bridge >= %{required_base}
 Requires: cockpit-shell >= %{required_base}
-Requires: kexec-tools
+%if 0%{?suse_version}
+Requires: /usr/sbin/kdumptool
+%else
+Requires: /usr/bin/kdumpctl
+%endif
 BuildArch: noarch
 
 %description kdump
@@ -789,6 +799,7 @@ The Cockpit component for configuring kernel crash dumping.
 %license COPYING
 %{_datadir}/metainfo/org.cockpit_project.cockpit_kdump.metainfo.xml
 
+# sosreport is not supported on opensuse yet
 %if !0%{?suse_version}
 %package sosreport
 Summary: Cockpit user interface for diagnostic reports
@@ -827,7 +838,6 @@ The Cockpit component for managing networking.  This package uses NetworkManager
 %endif
 
 %if 0%{?rhel} == 0 && ( 0%{?suse_version} >= 1500 || 0%{?is_smo} )
-
 %package selinux
 Summary: Cockpit SELinux package
 Requires: cockpit-bridge >= %{required_base}
@@ -837,7 +847,7 @@ Requires:       policycoreutils-python-utils >= 3.1
 %if !0%{?suse_version}  || ( 0%{?is_smo} && 0%{?sle_version} >= 150500 ) || 0%{?suse_version} >= 1600
 Requires:       setroubleshoot-server >= 3.3.3
 %endif
-BuildArch:      noarch
+BuildArch: noarch
 
 %description selinux
 This package contains the Cockpit user interface integration with the
@@ -910,5 +920,31 @@ via PackageKit.
 %files -n cockpit-packagekit -f packagekit.list
 %license COPYING
 
+%package firewalld
+Summary: Allows Cockpit access through the firewall
+Requires: cockpit-bridge >= %{required_base}
+Requires: firewalld
+BuildArch: noarch
+
+%description firewalld
+This package allows Cockpit access through the firewall
+
+%files firewalld
+%license COPYING
+
+%postun firewalld
+if test -f %{_bindir}/firewall-cmd && firewall-cmd --state &>/dev/null; then
+    firewall-cmd --quiet --permanent --remove-service=cockpit && firewall-cmd --reload --quiet || true
+elif test -f %{_bindir}/firewall-offline-cmd; then
+    firewall-offline-cmd --quiet --remove-service=cockpit || true
+fi
+
+%posttrans firewalld
+if test -f %{_bindir}/firewall-cmd && firewall-cmd --state &>/dev/null; then
+    firewall-cmd --quiet --permanent --add-service=cockpit && firewall-cmd --reload --quiet || true
+elif test -f %{_bindir}/firewall-offline-cmd; then
+    firewall-offline-cmd --quiet --add-service=cockpit || true
+fi
+
 # The changelog is automatically generated and merged
 %changelog

css-overrides.patch

@@ -290,17 +290,17 @@ index f89f1fa47..5086ce1f6 100644
    <script src="../base1/po.js"></script>
    <script src="po.js"></script>
 diff --git a/pkg/systemd/services.html b/pkg/systemd/services.html
-index 74fa456d4..e9c7047ee 100644
+index a17e95e56..7eaa65efa 100644
 --- a/pkg/systemd/services.html
 +++ b/pkg/systemd/services.html
-@@ -5,6 +5,7 @@
-     <meta charset="utf-8" />
-     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-     <link href="services.css" type="text/css" rel="stylesheet" />
-+    <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet" />
-     <script src="../base1/cockpit.js"></script>
+@@ -9,6 +9,7 @@
      <script src="../base1/po.js"></script>
+     <script src="../manifests.js"></script>
      <script src="services.js"></script>
++    <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet" />
+     <script src="po.js"></script>
+ </head>
+ 
 diff --git a/pkg/systemd/terminal.html b/pkg/systemd/terminal.html
 index ce7216e4e..63547f9d3 100644
 --- a/pkg/systemd/terminal.html

kdump-nfs-fixes.patch

@@ -1,153 +0,0 @@
-From d1ffed4a006bc9f8aeb0e8f63e8d2a160720b4f6 Mon Sep 17 00:00:00 2001
-From: Alice Brooks <alice.brooks@suse.com>
-Date: Thu, 12 Jun 2025 08:48:16 +0100
-Subject: [PATCH] kdump: Remove nfs directory when using sysconfig
- configuration style
-
-This is because the sysconfig style only has the KDUMP_SAVEDIR field
-so we can't work with two path fields as it's impossible to extract
-them again
----
- pkg/kdump/kdump-client.js |  4 ++++
- pkg/kdump/kdump-view.jsx  | 24 +++++++++++++++---------
- pkg/kdump/kdump.js        |  6 ++++++
- 4 files changed, 26 insertions(+), 20 deletions(-)
-
-diff --git a/pkg/kdump/kdump-client.js b/pkg/kdump/kdump-client.js
-index d4c3d989a42d..35add2554a39 100644
---- a/pkg/kdump/kdump-client.js
-+++ b/pkg/kdump/kdump-client.js
-@@ -48,6 +48,7 @@ export class KdumpClient {
-             state: undefined,
-             config: undefined,
-             target: undefined,
-+            sysconfig: undefined,
-         };
-         cockpit.event_target(this);
- 
-@@ -62,6 +63,7 @@ export class KdumpClient {
- 
-         // watch the config file
-         this.configClient = new ConfigFile("/etc/kdump.conf", true);
-+        this.state.sysconfig = false;
-         this._watchConfigChanges();
- 
-         this.configClient.wait().then(() => {
-@@ -69,6 +71,8 @@ export class KdumpClient {
-             if (this.configClient.settings === null) {
-                 this.configClient.close();
-                 this.configClient = new ConfigFileSUSE("/etc/sysconfig/kdump", true);
-+                this.state.sysconfig = true;
-+                this.dispatchEvent("kdumpSysconfigChanged", true);
-                 this._watchConfigChanges();
-             }
-         });
-diff --git a/pkg/kdump/kdump-view.jsx b/pkg/kdump/kdump-view.jsx
-index c6cc1e0d6bc6..8b5d74707e39 100644
---- a/pkg/kdump/kdump-view.jsx
-+++ b/pkg/kdump/kdump-view.jsx
-@@ -115,12 +115,15 @@ const exportAnsibleTask = (settings, os_release) => {
-     return ansible;
- };
- 
--function getLocation(target) {
-+function getLocation(target, sysconfig) {
-     let path = target.path || DEFAULT_KDUMP_PATH;
- 
-     if (target.type === "ssh") {
-         path = `${target.server}:${path}`;
-     } else if (target.type == "nfs") {
-+        if (sysconfig) {
-+            path = '';
-+        }
-         path = path[0] !== '/' ? '/' + path : path;
-         path = `${target.server}:${target.export + path}`;
-     }
-@@ -128,7 +131,7 @@ function getLocation(target) {
-     return path;
- }
- 
--const KdumpSettingsModal = ({ settings, initialTarget, handleSave }) => {
-+const KdumpSettingsModal = ({ settings, initialTarget, handleSave, sysconfig }) => {
-     const Dialogs = useDialogs();
-     const compressionAllowed = settings.compression?.allowed;
-     const [isSaving, setIsSaving] = useState(false);
-@@ -276,13 +279,15 @@ const KdumpSettingsModal = ({ settings, initialTarget, handleSave }) => {
-                                     placeholder="/export/cores" value={exportPath}
-                                     onChange={(_event, value) => setExportPath(value)} isRequired />
-                         </FormGroup>
-+                        {sysconfig === false &&
-                         <FormGroup fieldId="kdump-settings-nfs-directory" label={_("Directory")} isRequired>
-                             <TextInput id="kdump-settings-nfs-directory" key="directory"
--                                    placeholder={DEFAULT_KDUMP_PATH} value={directory}
--                                    data-stored={directory}
--                                    onChange={(_event, value) => setDirectory(value)}
--                                    isRequired />
-+                                          placeholder={DEFAULT_KDUMP_PATH} value={directory}
-+                                          data-stored={directory}
-+                                          onChange={(_event, value) => setDirectory(value)}
-+                                          isRequired />
-                         </FormGroup>
-+                        }
-                     </>
-                 }
- 
-@@ -353,7 +358,7 @@ export class KdumpPage extends React.Component {
-         const target = this.props.kdumpStatus.target;
-         let verifyMessage;
-         if (!target.multipleTargets) {
--            const path = getLocation(target);
-+            const path = getLocation(target, this.props.sysconfig);
-             if (target.type === "local") {
-                 verifyMessage = fmt_to_fragments(
-                     ' ' + _("Results of the crash will be stored in $0 as $1, if kdump is properly configured."),
-@@ -403,7 +408,8 @@ export class KdumpPage extends React.Component {
-         const Dialogs = this.context;
-         Dialogs.show(<KdumpSettingsModal settings={this.props.kdumpStatus.config}
-                                          initialTarget={this.props.kdumpStatus.target}
--                                         handleSave={this.props.onSaveSettings} />);
-+                                         handleSave={this.props.onSaveSettings}
-+                                         sysconfig={this.props.sysconfig} />);
-     }
- 
-     handleAutomationClick() {
-@@ -459,7 +465,7 @@ ${enableCrashKernel}
-             if (target.multipleTargets) {
-                 kdumpLocation = _("invalid: multiple targets defined");
-             } else {
--                const locationPath = getLocation(target);
-+                const locationPath = getLocation(target, this.props.sysconfig);
-                 if (target.type == "local") {
-                     kdumpLocation = cockpit.format(_("Local, $0"), locationPath);
-                     targetCanChange = true;
-diff --git a/pkg/kdump/kdump.js b/pkg/kdump/kdump.js
-index 1a143defef15..b0f75e88c220 100644
---- a/pkg/kdump/kdump.js
-+++ b/pkg/kdump/kdump.js
-@@ -41,6 +41,7 @@ const initStore = function(rootElement) {
-     dataStore.domRootElement = rootElement;
- 
-     dataStore.kdumpClient = new kdumpClient.KdumpClient();
-+    dataStore.sysconfig = dataStore.kdumpClient.state.sysconfig;
- 
-     dataStore.saveSettings = settings =>
-         dataStore.kdumpClient.validateSettings(settings)
-@@ -74,6 +75,7 @@ const initStore = function(rootElement) {
-             reservedMemory: dataStore.kdumpMemory,
-             kdumpStatus: dataStore.kdumpStatus,
-             kdumpCmdlineEnabled: dataStore.crashkernel || false,
-+            sysconfig: dataStore.sysconfig,
-             onSaveSettings: dataStore.saveSettings,
-             onCrashKernel: dataStore.kdumpClient.crashKernel,
-             exportConfig: dataStore.exportConfig,
-@@ -117,6 +119,10 @@ const initStore = function(rootElement) {
-         dataStore.kdumpStatus = status;
-         render();
-     });
-+    dataStore.kdumpClient.addEventListener('kdumpSysconfigChanged', function(event, sysconfig) {
-+        dataStore.sysconfig = sysconfig;
-+        render();
-+    });
- 
-     // render once
-     render();

remove_rh_links.patch

@@ -66,10 +66,10 @@ index fa57de9..d4dd3be 100644
              <Button variant="plain" aria-label={_("Help")}>
                  <HelpIcon />
 diff --git a/pkg/systemd/overview-cards/tuned-dialog.jsx b/pkg/systemd/overview-cards/tuned-dialog.jsx
-index 38420ca..cd7e2a3 100644
+index 5f3c3ffc1..b36ad88e3 100644
 --- a/pkg/systemd/overview-cards/tuned-dialog.jsx
 +++ b/pkg/systemd/overview-cards/tuned-dialog.jsx
-@@ -278,36 +278,10 @@ const TunedDialog = ({
+@@ -278,40 +278,13 @@ const TunedDialog = ({
          };
      }, [tunedService]);
  
@@ -102,7 +102,12 @@ index 38420ca..cd7e2a3 100644
          <Modal position="top" variant="medium"
                 className="ct-m-stretch-body"
                 isOpen
--               help={help}
                 onClose={() => dialogResult.resolve()}
-                title={_("Change performance profile")}
-                footer={
+         >
+-            <ModalHeader title={_("Change performance profile")}
+-                help={help}
+-            />
++            <ModalHeader title={_("Change performance profile")} />
+             <ModalBody>
+                 {error && <ModalError dialogError={typeof error == 'string' ? error : error.message} />}
+                 {loading && <EmptyStatePanel loading />}