Allow cockpit through the firewall on install

2025-07-10 11:21:42 +01:00
22 changed files with 2597 additions and 2738 deletions
--- a/0001-cockpit-overview-support-SUSE_SUPPORT_PRODUCT-keys.patch
+++ b/0001-cockpit-overview-support-SUSE_SUPPORT_PRODUCT-keys.patch
@@ -1,69 +0,0 @@
-From ec3a1efce07770b7641e07d41a73732967c65175 Mon Sep 17 00:00:00 2001
-From: Luna D Dragon <luna.dragon@suse.com>
-Date: Tue, 8 Jul 2025 14:58:03 +0530
-Subject: [PATCH 1/3] cockpit overview: support SUSE_SUPPORT_PRODUCT keys
-
-SLE Micro 6.2(and Framework one components) have custom os-release keys namely in SUSE_SUPPORT_PRODUCT and
-SUSE_SUPPORT_PRODUCT_VERSION instead of the standard os prettyname which
-results in systemd not being able to determine the os name correctly.
-This patch should be dropped when systemd is fixed
---
- pkg/systemd/overview.jsx | 10 ++++++++--
- 1 file changed, 8 insertions(+), 2 deletions(-)
-
-diff --git a/pkg/systemd/overview.jsx b/pkg/systemd/overview.jsx
-index 868469d68..186fcf59e 100644
--- a/pkg/systemd/overview.jsx
-+++ b/pkg/systemd/overview.jsx
-@@ -42,6 +42,7 @@ import { ShutdownModal } from 'cockpit-components-shutdown.jsx';
- import { WithDialogs, DialogsContext } from "dialogs.jsx";
- 
- import "./overview.scss";
-+import { read_os_release } from "os-release.js";
- 
- const _ = cockpit.gettext;
- 
-@@ -98,6 +99,7 @@ class OverviewPage extends React.Component {
-         this.hostname_proxy.addEventListener("changed", data => {
-             this.setState({ hostnameData: data.detail });
-         });
-+        read_os_release().then(os_release => this.setState({ os_release }));
-     }
- 
-     render() {
-@@ -160,8 +162,12 @@ class OverviewPage extends React.Component {
-                             {this.hostname_text()}
-                         </h1>
-                         {this.state.hostnameData &&
-                         this.state.hostnameData.OperatingSystemPrettyName &&
-                         <div className="ct-overview-header-subheading" id="system_information_os_text">{cockpit.format(_("running $0"), this.state.hostnameData.OperatingSystemPrettyName)}</div>}
-+                         this.state.hostnameData.OperatingSystemPrettyName && (
-+                            <div className="ct-overview-header-subheading" id="system_information_os_text">
-+                                {(this.state.os_release && this.state.os_release.SUSE_PRETTY_NAME)
-+                                    ? cockpit.format(_("running $0"), this.state.os_release.SUSE_PRETTY_NAME)
-+                                    : cockpit.format(_("running $0"), this.state.hostnameData.OperatingSystemPrettyName)}
-+                            </div>)}
-                     </div>
-                     <div className='ct-overview-header-actions'>
-                         { show_superuser && <SuperuserIndicator proxy={this.superuser} /> }
-diff --git a/src/common/cockpitsystem.c b/src/common/cockpitsystem.c
-index 83e2965f7..73716fff7 100644
--- a/src/ws/cockpitsystem.c
-+++ b/src/ws/cockpitsystem.c
-@@ -107,6 +107,12 @@ cockpit_system_load_os_release (void)
-         }
-     }
- 
-+  gchar *value = g_hash_table_lookup (result, "SUSE_PRETTY_NAME");
-+  if (!value || strlen(value) == 0) {
-+    value = g_hash_table_lookup (result, "PRETTY_NAME");
-+    g_hash_table_replace (result, g_strdup ("SUSE_PRETTY_NAME"), g_strdup (value));
-+  }
-+
-  out:
-   g_clear_error (&error);
-   g_free (lines);
-
-- 
-2.50.0
-
--- a/0001-selinux-allow-login-to-read-motd-file.patch
+++ b/0001-selinux-allow-login-to-read-motd-file.patch
@@ -7,11 +7,11 @@ Date:   Fri Aug 6 15:11:23 2021 +0200
 Index: cockpit/selinux/cockpit.te
 ===================================================================
 diff --git a/selinux/cockpit.te b/selinux/cockpit.te
-index 931cbd775..4a439c8d5 100644
+index 50695ee..55b1226 100644
 --- a/selinux/cockpit.te
 +++ b/selinux/cockpit.te
-@@ -232,6 +232,14 @@ optional_policy(`
-     allow cockpit_session_t pidfs_t:filesystem getattr;
+@@ -224,6 +224,14 @@ optional_policy(`
+     gnome_exec_keyringd(cockpit_session_t)
 ')
 
 +# login may read motd file through pam
--- a/0002-cockpit-kdump-support-SLE-micro-6.2.patch
+++ b/0002-cockpit-kdump-support-SLE-micro-6.2.patch
@@ -1,37 +0,0 @@
-From 14b86b6d60b009c4294f06589a561e688ba49223 Mon Sep 17 00:00:00 2001
-From: Luna D Dragon <luna.dragon@suse.com>
-Date: Tue, 8 Jul 2025 14:58:25 +0530
-Subject: [PATCH 2/3] cockpit-kdump support SLE micro 6.2
-
-SLE micro 6.2 no longer has MicroOS in the NAME. This updates it to
-check if the VARIANT_ID is transactional to use transactional-update
-over manually enabling kdump.
---
- pkg/kdump/kdump-view.jsx | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/pkg/kdump/kdump-view.jsx b/pkg/kdump/kdump-view.jsx
-index eee4d16b1..7d8439f2b 100644
--- a/pkg/kdump/kdump-view.jsx
-+++ b/pkg/kdump/kdump-view.jsx
-@@ -421,7 +421,7 @@ export class KdumpPage extends React.Component {
- kdumpctl reset-crashkernel`;
-         }
-         let shell;
-        if (this.state.os_release.NAME?.includes('MicroOS')) {
-+        if (this.state.os_release.NAME?.includes('MicroOS') || this.state.os_release.VARIANT_ID?.includes("transactional")) {
-             enableCrashKernel = `
- # A reboot will be required if crashkernel was not set before
- transactional-update setup-kdump`;
-@@ -443,7 +443,7 @@ ${enableCrashKernel}
- 
-         Dialogs.show(
-             <ModificationsExportDialog
-              ansible={ this.state.os_release.NAME?.includes('MicroOS') ? null : exportAnsibleTask(this.props.kdumpStatus.config, this.state.os_release)}
-+              ansible={ (this.state.os_release.NAME?.includes('MicroOS') || this.state.os_release.VARIANT_ID?.includes("transactional")) ? null : exportAnsibleTask(this.props.kdumpStatus.config, this.state.os_release)}
-               shell={shell}
-               onClose={Dialogs.close}
-             />);
-- 
-2.50.0
-
--- a/0003-branding-use-SUSE_SUPPORT_PRODUCT-and-SUSE_SUPPORT_P.patch
+++ b/0003-branding-use-SUSE_SUPPORT_PRODUCT-and-SUSE_SUPPORT_P.patch
@@ -1,136 +0,0 @@
-From cfc476e5127ee3f21b70124e77ded9627e9692b5 Mon Sep 17 00:00:00 2001
-From: Luna D Dragon <luna.dragon@suse.com>
-Date: Tue, 8 Jul 2025 15:09:09 +0530
-Subject: [PATCH 3/3] branding: use SUSE_SUPPORT_PRODUCT and
- SUSE_SUPPORT_PRODUCT_VERSION
-
---
- Makefile.am                    |  1 +
- src/branding/suse/Makefile.am  | 11 +++++
- src/branding/suse/branding.css | 82 ++++++++++++++++++++++++++++++++++
- 3 files changed, 94 insertions(+)
- create mode 100644 src/branding/suse/Makefile.am
- create mode 100644 src/branding/suse/branding.css
-
-diff --git a/Makefile.am b/Makefile.am
-index 83f1ee7a7..1198d191e 100644
--- a/Makefile.am
-+++ b/Makefile.am
-@@ -167,6 +167,7 @@ include src/branding/debian/Makefile.am
- include src/branding/default/Makefile.am
- include src/branding/fedora/Makefile.am
- include src/branding/opensuse/Makefile.am
-+include src/branding/suse/Makefile.am
- include src/branding/rhel/Makefile.am
- include src/branding/ubuntu/Makefile.am
- include src/client/Makefile.am
-diff --git a/src/branding/suse/Makefile.am b/src/branding/suse/Makefile.am
-new file mode 100644
-index 000000000..4a1e7ab72
--- /dev/null
-+++ b/src/branding/suse/Makefile.am
-@@ -0,0 +1,11 @@
-+slemicrobrandingdir = $(datadir)/cockpit/branding/suse
-+
-+dist_slemicrobranding_DATA = \
-+    src/branding/suse/branding.css \
-+	$(NULL)
-+
-+install-data-hook::
-+	ln -sf /usr/share/wallpapers/SLEdefault/contents/images/1920x1200.png $(DESTDIR)$(slemicrobrandingdir)/default-1920x1200.png
-+	ln -sf /usr/share/pixmaps/distribution-logos/square-hicolor.svg $(DESTDIR)$(slemicrobrandingdir)/square-hicolor.svg
-+	ln -sf /usr/share/pixmaps/distribution-logos/favicon.ico $(DESTDIR)$(slemicrobrandingdir)/favicon.ico
-+	ln -sf /usr/share/pixmaps/distribution-logos/apple-touch-icon.png $(DESTDIR)$(slemicrobrandingdir)/apple-touch-icon.png
-\ No newline at end of file
-diff --git a/src/branding/suse/branding.css b/src/branding/suse/branding.css
-new file mode 100644
-index 000000000..c1617abc2
--- /dev/null
-+++ b/src/branding/suse/branding.css
-@@ -0,0 +1,82 @@
-+/* Extra overrides */
-+:root {
-+    --eos-bc-green-500: #30ba78;
-+    --eos-bc-pine-500: #0c322c;
-+    --eos-bc-gray-50: #F2F2F2;
-+    --eos-bc-white: #ffffff;
-+    --eos-bc-text: #333;
-+}
-+
-+
-+#brand:before {
-+    content: "${SUSE_PRETTY_NAME}";
-+}
-+
-+#option-group svg polygon {
-+    fill: var(--eos-bc-text);
-+}
-+
-+/* Nav & sidebar overwrites */
-+.navbar-pf {
-+    background: var(--eos-bc-pine-500);
-+}
-+
-+.navbar-pf-vertical {
-+    border-top: none;
-+}
-+
-+
-+/* Default overrides */
-+
-+.login-note {
-+    display: none;
-+    position: relative;
-+}
-+
-+body.login-pf {
-+    background-color: var(--eos-bc-pine-500);
-+}
-+
-+/* Only use background image on desktops */
-+@media(min-width: 1024px) {
-+    body.login-pf {
-+        background-image: url("default-1920x1200.png") !important;
-+        background-repeat: no-repeat;
-+        background-position: 100% 0 !important;
-+        background-size: cover;
-+    }
-+}
-+
-+/* Hide badge on desktops (already included in background) */
-+@media(max-width: 1023px) {
-+    #badge {
-+        width: 51px;
-+        height: 45px;
-+        background-image: url("square-hicolor.svg");
-+        background-repeat: no-repeat;
-+    }
-+}
-+
-+#brand {
-+    width: auto;
-+    height: auto;
-+    background-image: none;
-+    background-repeat: no-repeat;
-+    font-size: 2em;
-+    white-space: nowrap;
-+}
-+
-+/* Switch to small font faster to not clip long name */
-+@media(max-width: 560px) {
-+    #brand {
-+        font-size: inherit;
-+    }
-+}
-+
-+#index-brand {
-+    font-weight: bold;
-+}
-+
-+#index-brand:before {
-+    content: "${PRETTY_NAME}";
-+}
-\ No newline at end of file
-- 
-2.50.0
-
--- a/0009-packagekit-reboot-notification.patch
+++ b/0009-packagekit-reboot-notification.patch
@@ -1,116 +0,0 @@
-diff --git a/pkg/packagekit/updates.jsx b/pkg/packagekit/updates.jsx
-index ce4b3c4cc6d1..b423ee4c09bd 100644
--- a/pkg/packagekit/updates.jsx
-+++ b/pkg/packagekit/updates.jsx
-@@ -21,6 +21,7 @@ import 'polyfills'; // once per application
- import 'cockpit-dark-theme'; // once per page
- 
- import cockpit from "cockpit";
-+import { fsinfo } from 'cockpit/fsinfo';
- import React from "react";
- import { createRoot } from 'react-dom/client';
- 
-@@ -1079,12 +1080,19 @@ class OsUpdates extends React.Component {
-                     debug("tracer parsed restartPackages:", JSON.stringify(restartPackages));
-                     this.setState({ checkRestartAvailable: true, checkRestartRunning: false, restartPackages });
-                 })
-                .catch((exception, data) => {
-+                .catch(async (exception, data) => {
-                     // tracer not installed or supported (like on Arch)? then fall back to dnf needs-restarting
-                     if (exception.message?.includes("ModuleNotFoundError") ||
-                         exception.message?.includes("UnsupportedDistribution")) {
-                        debug('tracer not installed:', JSON.stringify(exception), "trying dnf needs-restarting");
-                        return this.checkDnfNeedsRestarting();
-+                        try {
-+                            // if there's a history for zypper, we can assume the system uses it
-+                            await fsinfo("/var/log/zypp/history", [], { superuser: "require" });
-+                            debug('tracer not installed:', JSON.stringify(exception), "trying zypper ps");
-+                            return this.checkZypperNeedsRestarting();
-+                        } catch {
-+                            debug('tracer not installed:', JSON.stringify(exception), "trying dnf needs-restarting");
-+                            return this.checkDnfNeedsRestarting();
-+                        }
-                     }
- 
-                     // log the error except for some common cases: polkit does not allow it
-@@ -1106,6 +1114,80 @@ class OsUpdates extends React.Component {
-                 });
-     }
- 
-+    checkZypperNeedsRestarting() {
-+        const restartPackages = { reboot: [], daemons: [], manual: [] };
-+        return cockpit.spawn(["zypper", "ps", "-ss", "--print", "%s"], { err: "message", superuser: "require" })
-+                .then((serviceOut) => {
-+                    debug("zypper ps -ss succeeded:", serviceOut);
-+
-+                    // set all the services to be manually restarted since it's
-+                    // not always clear if it's safe to restart them via cockpit
-+                    const data = serviceOut.trim();
-+                    if (data.length !== 0) {
-+                        serviceOut.trim()
-+                                .split("\n")
-+                                .forEach(line => restartPackages.manual.push(line));
-+                    }
-+
-+                    // Check if any kernels are updated since system boot,
-+                    // ignoring kernel-firmware updates as they can make things noisy
-+                    //
-+                    // /var/log/zypper.log can be quite big so it's better to
-+                    // handle the processing on machine instead of fetching the data
-+                    const kScript = `
-+                          stat -c %z /proc/ | \\
-+                          cut -d. -f 1 | \\
-+                          xargs -i \\
-+                          awk -F'|' -v boot="{}" \\
-+                          '/install\\|kernel/{if (boot <= $1 && index($0, "firmware") == 0) {print $3"-"$4"."$5}}' \\
-+                          /var/log/zypp/history
-+                          `;
-+
-+                    cockpit.script(kScript, undefined, { err: "message", superuser: "require" })
-+                            .then(kernels => {
-+                                debug("zypper kernel scripts succeeded:", kernels);
-+
-+                                if (kernels.trim().length == 0) {
-+                                    return;
-+                                }
-+
-+                                kernels.trim()
-+                                        .split("\n")
-+                                        .forEach(line => { restartPackages.reboot.push(line.trim()) });
-+                            })
-+                            .catch(ex => {
-+                                if (ex.problem !== "not-found" &&
-+                                // polkit does not allow it
-+                                ex.problem !== "access-denied" &&
-+                                // or unprivileged session
-+                                ex.problem !== "authentication-failed" &&
-+                                // or the session goes away while checking
-+                                ex.problem !== "terminated")
-+                                    console.error("zypper kernel fetching failed:", ex.toString());
-+                            })
-+                            .then(() => {
-+                                let checkRestartAvailable = false;
-+                                if (restartPackages.reboot.length !== 0 || restartPackages.manual.length !== 0)
-+                                    checkRestartAvailable = true;
-+
-+                                this.setState({ checkRestartAvailable, checkRestartRunning: false, restartPackages });
-+                            });
-+                }).catch((ex) => {
-+                    // log the error except for some common cases: no zypper
-+                    if (ex.problem !== "not-found" &&
-+                    // polkit does not allow it
-+                    ex.problem !== "access-denied" &&
-+                    // or unprivileged session
-+                    ex.problem !== "authentication-failed" &&
-+                    // or the session goes away while checking
-+                    ex.problem !== "terminated")
-+                        console.error("zypper ps -ss failed:", ex);
-+
-+                    // act like it's not available (demand reboot after every update)
-+                    this.setState({ checkRestartAvailable: false, checkRestartRunning: false, restartPackages });
-+                });
-+    }
-+
-     checkDnfNeedsRestarting() {
-         const restartPackages = { reboot: [], daemons: [], manual: [] };
- 
--- a/2
+++ b/2
@@ -23,7 +23,7 @@ if [ $? -eq 0 ]; then
 fi

 if [ -f /etc/nsswitch.conf ]; then
-    grep -Eq "passwd:.*systemd" /etc/nsswitch.conf
+    grep -Exq "passwd:.*?compat systemd" /etc/nsswitch.conf
    if [ $? -ne 0 ]; then
        echo "/etc/nsswitch.conf is out of date, please update it from /usr/etc/nsswitch.conf to use cockpit"
        failed=true
--- a/cockpit-340.tar.gz
+++ b/cockpit-340.tar.gz
--- a/cockpit-356.tar.gz
+++ b/cockpit-356.tar.gz
--- a/cockpit-suse-theme.tar
+++ b/cockpit-suse-theme.tar
--- a/cockpit.changes
+++ b/cockpit.changes
@@ -1,164 +1,7 @@
 -------------------------------------------------------------------
-Wed Feb 11 16:52:06 UTC 2026 - Miika Alikirri <miika.alikirri@suse.com>
+Thu Jul 10 07:18:57 UTC 2025 - Alice Brooks <alice.brooks@suse.com>

- Fix esbuild for ppc64le bsc#1257698
-  * Include esbuild-ppc64.patch
-  * Update update_version.sh
- Update to 356
-  * changes since 354
-    - 356
-      * systemd: Allow editing timers created by Cockpit
-      * Convert license headers to SPDX format
-    - 355
-      * ws: Remove obsolete pam_cockpit_cert module
-      * shell: add StartTransientUnit as a sudo alternative
-
-------------------------------------------------------------------
-Wed Jan 28 14:40:23 UTC 2026 - Alice Brooks <alice.brooks@suse.com>
-
- Update dependencies for bsc#1257324/CVE-2025-13465
-
-------------------------------------------------------------------
-Fri Jan 16 15:03:36 UTC 2026 - Alice Brooks <alice.brooks@suse.com>
-
- Drop 0010-add-onExpand-prop-to-ListingTable.patch: Has been upstreamed
- Update to 354
-  * changes since 351
-    - 354
-      * Convert documentation to AsciiDoc
-      * Work around Firefox 146/147 bug (rhbz#2422331)
-      * Bug fixes
-    - 353
-      * Networking: Suggest prefix length and gateway address
-      * Bug fixes and translation updates
-    - 352
-      * Shown a warning if the last shutdown/reboot was unclean
-      * Bug fixes and translation updates
-
-------------------------------------------------------------------
-Wed Dec 10 12:05:51 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
-
- Add 0010-add-onExpand-prop-to-ListingTable.patch to backport a feature
-
-------------------------------------------------------------------
-Thu Nov 19 08:05:47 UTC 2025 - Zdenek Kubala <zkubala@suse.com>
-
- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
-  to /etc/selinux (bsc#1221342)
-
-------------------------------------------------------------------
-Thu Nov 13 04:36:07 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
-
- Update to 351
-  * Changes since 349
-    - 351
-      * Firewall ports can be deleted individually
-    - 350
-      * networking: fix renaming of bridges and other groups (RHEL-117883)
-      * bridge: fix OpenSSH_10.2p1 host key detection
-
-------------------------------------------------------------------
-Fri Oct 17 09:44:51 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
-
- Update to 349
-  * Changes since 346
-    - 349
-      * Package manifests: add any test
-      * Bug fixes and translation updates
-    - 348
-      * Bug fixes and translation updates
-    - 347
-      * Site-specific branding support
-
-------------------------------------------------------------------
-Tue Sep 23 09:11:48 UTC 2025 - Luna D Dragon <luna.dragon@suse.com>
-
- add requirement on python3-pcp if pcp is installed bsc#1239759  
-
-------------------------------------------------------------------
-Thu Sep 18 07:40:59 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
-
- Rewrite hide-pcp.patch to apply to SLFO based versions of micro
-
-------------------------------------------------------------------
-Mon Sep  8 11:25:24 UTC 2025 - Miika Alikirri <miika.alikirri@suse.com>
-
- Update to 346
-  * Changes since 344
-    - 346
-      * Support branding Cockpit pages
-      * Storage: Support for Stratis "V2" pools
-    - 345
-      * Translation and dependency updates
-      * Shorter IPv6 addresses
-      * IPv6 addresses for WireGuard
-
-------------------------------------------------------------------
-Thu Aug 14 04:53:41 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
-
- Update to 344
-  * Changes since 340
-    - 344
-      * Bug fixes and translation updates
-    - 343
-      * login: Improve error message for unsupported shells
-      * cockpit: Handle file access issues with files in machines.d
-      * Translation updates
-    - 342
-      * systemd: ensure update() is called at least once for tuned-dialog
-      * Translation updates
-    - 341
-      * services: show link to podman page for quadlets
-      * Bug fixes and translation updates
- Remove kdump-nfs-fixes.patch as this was upstreamed
- Fix not falling back to PRETTY_NAME in SUSE_PRETTY_NAME patches bsc#1248446
-
-------------------------------------------------------------------
-Wed Jul 30 03:21:48 UTC 2025 - Luna D Dragon <luna.dragon@suse.com>
-
- drop duplicate %changelog macro
-
-------------------------------------------------------------------
-Wed Jul 23 12:53:37 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
-
- Add %postun for firewalld package to ensure the firewall state
-  remains as expected
-
-------------------------------------------------------------------
-Mon Jul 21 11:39:56 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
-
- Add cockpit-firewalld package for easily configuring the users
-  firewall jsc#PED-13228
-
-------------------------------------------------------------------
-Tue Jul 15 07:00:10 UTC 2025 - Luna D Dragon <luna.dragon@suse.com>
-
- add 0001-cockpit-overview-support-SUSE_SUPPORT_PRODUCT-keys.patch
- add 0002-cockpit-kdump-support-SLE-micro-6.2.patch
- add 0003-branding-use-SUSE_SUPPORT_PRODUCT-and-SUSE_SUPPORT_P.patch to fix bsc#1241003 
-
-------------------------------------------------------------------
-Mon Jul 14 08:04:06 UTC 2025 - Luna D Dragon <luna.dragon@suse.com>
-
- update check_cockpit_users to only check for systemd support in /etc/nsswitch.conf bsc#1246408
-
-------------------------------------------------------------------
-Fri Jul 11 07:13:59 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
-
- add a requirement on /usr/sbin/kdumptool for cockpit-kdump (bsc#1227402)
-
-------------------------------------------------------------------
-Fri Jul 11 06:50:17 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
-
- add libzypp-plugin-appdata dependency to cockpit-packagekit as
-  this will generate the swcatalog which it depends on for calculating
-  various cockpit packages
-
-------------------------------------------------------------------
-Thu Jul 10 10:10:21 UTC 2025 - Miika Alikirri <miika.alikirri@suse.com>
-
- Show reboot nofication after updates in packagekit
-  * Add 0009-packagekit-reboot-notification.patch
+- Allow Cockpit through the filewall by default

 -------------------------------------------------------------------
 Thu Jun 19 08:30:49 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
--- a/cockpit.pam
+++ b/cockpit.pam
@@ -0,0 +1,11 @@
+#%PAM-1.0
+auth substack common-auth
+# List of users to deny access to Cockpit, by default root is included.
+auth    required pam_listfile.so item=user sense=deny file=/etc/cockpit/disallowed-users onerr=succeed
+account required pam_nologin.so
+account include common-account
+password include common-password
+session required pam_loginuid.so
+session optional pam_keyinit.so force revoke
+session include common-session
+auth [user_unknown=ignore success=ok] pam_oath.so usersfile=${HOME}/.pam_oath_usersfile no_usersfile_okay window=20 digits=6
--- a/cockpit.spec
+++ b/cockpit.spec
@@ -1,6 +1,18 @@
 #
 # Copyright (C) 2014-2020 Red Hat, Inc.
-# SPDX-License-Identifier: LGPL-2.1-or-later
+#
+# Cockpit is free software; you can redistribute it and/or modify it
+# under the terms of the GNU Lesser General Public License as published by
+# the Free Software Foundation; either version 2.1 of the License, or
+# (at your option) any later version.
+#
+# Cockpit is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with Cockpit; If not, see <https://www.gnu.org/licenses/>.
 #

 #
@@ -26,39 +38,22 @@

 %define __lib lib

-%if 0%{?suse_version} > 1500
-%define pamconfdir %{_pam_vendordir}
-%define pamconfig tools/cockpit.suse.pam
-%else
-%define pamconfdir %{_sysconfdir}/pam.d
-%define pamconfig tools/cockpit.pam
-%endif
-
 %if %{defined _pamdir}
 %define pamdir %{_pamdir}
 %else
 %define pamdir %{_libdir}/security
 %endif

-# distributions which ship nodejs-esbuild can rebuild the bundle during package build
-# allow override from command line (e.g. for development builds)
-%if 0%{?fedora} >= 42
-%{!?rebuild_bundle: %define rebuild_bundle 1}
-%endif
-
-# to avoid using asciidoc-py in RHEL and CentOS we use the prebuilt docs
-%if 0%{?rhel}
-%define bundle_docs 1
-%endif
-
 Name:           cockpit
 Summary:        Web Console for Linux servers
-License:        LGPL-2.1-or-later AND GPL-3.0-and-later AND MIT AND CC-BY-SA-3.0 AND BSD-3-Clause
+
+License:        LGPL-2.1-or-later
 URL:            https://cockpit-project.org/

-Version:        356
+Version:        340
 Release:        0
 Source0:        cockpit-%{version}.tar.gz
+Source1:        cockpit.pam
 Source2:        cockpit-rpmlintrc
 Source3:        cockpit-suse-theme.tar
 Source4:        cockpit-no-pamoath.pam
@@ -73,7 +68,7 @@ Patch2:         suse_docs.patch
 Patch3:         suse-microos-branding.patch
 Patch4:         css-overrides.patch
 Patch5:         storage-btrfs.patch
-Patch6:         esbuild-ppc64.patch
+Patch6:         kdump-nfs-fixes.patch
 # SLE Micro specific patches
 Patch101:       hide-pcp.patch
 Patch102:       0002-selinux-temporary-remove-setroubleshoot-section.patch
@@ -86,10 +81,6 @@ Patch105:       fix-libexecdir.patch
 Patch106:       packagekit-single-install.patch
 Patch109:       0008-pybridge-endian-flag.patch
 Patch110:       add_preexec_cockpit.patch
-Patch111:       0001-cockpit-overview-support-SUSE_SUPPORT_PRODUCT-keys.patch
-Patch112:       0002-cockpit-kdump-support-SLE-micro-6.2.patch
-Patch113:       0003-branding-use-SUSE_SUPPORT_PRODUCT-and-SUSE_SUPPORT_P.patch
-Patch114:       0009-packagekit-reboot-notification.patch
 Patch201:       remove_rh_links.patch

 %define build_all 1
@@ -156,7 +147,7 @@ BuildRequires: libxslt-devel
 BuildRequires: glib-networking
 BuildRequires: sed

-BuildRequires: glib2-devel >= 2.68.0
+BuildRequires: glib2-devel >= 2.50.0
 # this is for runtimedir in the tls proxy ace21c8879
 BuildRequires: pkgconfig(libsystemd) >= 235
 %if 0%{?suse_version}
@@ -168,26 +159,17 @@ BuildRequires: wallpaper-branding
 BuildRequires: pcp
 %else
 BuildRequires: openssh-clients
+BuildRequires: docbook-style-xsl
 %endif
 BuildRequires: krb5-server
 BuildRequires: gdb

-%if 0%{?rebuild_bundle}
-BuildRequires: nodejs
-BuildRequires: %{_bindir}/node
-BuildRequires: nodejs-esbuild
-%endif
-
-%if !%{defined bundle_docs}
-%if 0%{?suse_version}
-BuildRequires: rubygem(asciidoctor)
-%else
-BuildRequires: asciidoctor
-%endif
-%endif
+# For documentation
+BuildRequires: xmlto

 %if 0%{?with_selinux}
 BuildRequires:  selinux-policy
+BuildRequires:  selinux-policy-%{selinuxtype}
 BuildRequires:  selinux-policy-devel
 %endif

@@ -206,10 +188,7 @@ Requires: cockpit-system
 # Optional components
 Recommends: (cockpit-storaged if udisks2)
 Recommends: (cockpit-packagekit if (dnf or zypper))
-%if 0%{?suse_version} == 0
-Recommends: (dnf5daemon-server if dnf5)
-%endif
-Recommends: (cockpit-firewalld if firewalld)
+Suggests: python3-pcp

 %if 0%{?rhel} == 0
 Recommends: (cockpit-networkmanager if NetworkManager)
@@ -218,7 +197,7 @@ Recommends: (cockpit-ostree if rpm-ostree)
 Suggests: cockpit-selinux
 %endif
 %if 0%{?rhel} && 0%{?centos} == 0
-Recommends: subscription-manager-cockpit
+Requires: subscription-manager-cockpit
 %endif

 BuildRequires:  python3-devel
@@ -232,30 +211,20 @@ BuildRequires:  python3-pytest-timeout

 %prep
 %setup -q -n cockpit-%{version} -a 3
-%if 0%{?rebuild_bundle}
-%setup -q -D -T -a 1 -n cockpit-%{version}
-%endif
-
 %patch -P 1 -p1
 %patch -P 2 -p1
-
-%if 0%{?is_opensuse} || 0%{?suse_version} < 1600
 %patch -P 3 -p1
-%else
-%patch -P  113 -p1
-%endif
-
 %patch -P 4 -p1
 %patch -P 5 -p1
 %patch -P 6 -p1

-%patch -P 101 -p1
 %patch -P 106 -p1
 %patch -P 109 -p1
-%patch -P 114 -p1

 # SLE Micro specific patches
 %if 0%{?is_smo}
+%patch -P 101 -p1
+%patch -P 107 -p1
 # Patches for versions lower then SLE Micro 5.5
 %if 0%{?sle_version} < 150500
 %patch -P 102 -p1
@@ -273,32 +242,20 @@ BuildRequires:  python3-pytest-timeout

 %if 0%{?suse_version} >= 1600
 %patch -P 110 -p1
-%if !0%{?is_opensuse}
-%patch -P  111 -p1
-%patch -P  112 -p1
-%endif
 %endif

 %patch -P 201 -p1

-# If we're not using cockpit.suse.pam
-# Then we should always use source4's pam
+%if 0%{?suse_version} > 1500
+cp %SOURCE1 tools/cockpit.pam
+%else
 cp %SOURCE4 tools/cockpit.pam
-
+%endif
 #
 local-npm-registry %{_sourcedir} install --include=dev --ignore-scripts
-echo "{}" > package-lock.json
+touch package-lock.json

 %build
-%if 0%{?rebuild_bundle}
-rm -rf dist
-# HACK: node module packaging is currently broken in Fedora ≤ 43, should be in
-# common location, not major version specific one
-NODE_ENV=production NODE_PATH=/usr/lib/node_modules:$(echo /usr/lib/node_modules_*) ./build.js
-%else
-# Use pre-built bundle on distributions without nodejs-esbuild
-%endif
-
 find node_modules -name \*.node -print -delete
 touch node_modules/.stamp

@@ -317,9 +274,6 @@ autoreconf -fvi -I tools
 %if %{enable_multihost}
    --enable-multihost \
 %endif
-%if %{defined bundle_docs}
-    --disable-doc \
-%endif

 %if 0%{?with_selinux}
 make -f /usr/share/selinux/devel/Makefile cockpit.pp
@@ -332,35 +286,22 @@ bzip2 -9 cockpit.pp
 make -j$(nproc) check

 %if 0%{?rhel} == 0 && 0%{?suse_version} == 0
-export NO_QUNIT=1
-%pytest
+%tox
 %endif

 %install
-%if 0%{?suse_version}
-export NO_BRP_STALE_LINK_ERROR="yes"
-%endif
 # In obs we get  write error: stdout
 %make_install | tee make_install.log
 make install-tests DESTDIR=%{buildroot}
-mkdir -p $RPM_BUILD_ROOT%{pamconfdir}
-install -p -m 644 %{pamconfig} $RPM_BUILD_ROOT%{pamconfdir}/cockpit
-rm -f %{buildroot}/%{_libdir}/cockpit/*.so
-install -D -p -m 644 AUTHORS README.md %{buildroot}%{_docdir}/cockpit/
-
-# We install the upstream pre-built docs as we can't build them
-%if %{defined bundle_docs}
-%define docbundledir %{_builddir}/%{name}-%{version}/doc/output/html
-install -d %{buildroot}%{_docdir}/cockpit/guide
-cp -rp %{docbundledir}/* %{buildroot}%{_docdir}/cockpit/guide/
-# Install pre-built man pages
-%define manbundledir %{_builddir}/%{name}-%{version}/doc/output/man
-for section in 1 5 8; do
-  for manpage in %{manbundledir}/*.${section}; do
-    install -D -p -m 644 "$manpage" %{buildroot}%{_mandir}/man${section}/$(basename "$manpage")
-  done
-done
+%if 0%{?suse_version} > 1500
+mkdir -p $RPM_BUILD_ROOT%{_pam_vendordir}
+install -p -m 644 tools/cockpit.pam $RPM_BUILD_ROOT%{_pam_vendordir}/cockpit
+%else
+mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/pam.d
+install -p -m 644 tools/cockpit.pam $RPM_BUILD_ROOT%{_sysconfdir}/pam.d/cockpit
 %endif
+rm -f %{buildroot}/%{_libdir}/cockpit/*.so
+install -D -p -m 644 AUTHORS COPYING README.md %{buildroot}%{_docdir}/cockpit/

 # selinux
 %if 0%{?with_selinux}
@@ -472,6 +413,14 @@ rm -f %{buildroot}/%{pamdir}/mock-pam-conv-mod.so
 sed -i "s|%{buildroot}||" *.list

 %if 0%{?suse_version}
+# remove brandings with stale symlinks. Means they don't match
+# the distro.
+pushd %{buildroot}/%{_datadir}/cockpit/branding
+ls --hide={default,kubernetes,opensuse,registry,suse} | xargs rm -rv
+popd
+# need this in SUSE as post build checks dislike stale symlinks
+install -m 644 -D /dev/null %{buildroot}/run/cockpit/issue
+
 test -e %{buildroot}/usr/share/cockpit/branding/opensuse/default-1920x1200.jpg  || install -m 644 -D /dev/null %{buildroot}/usr/share/cockpit/branding/opensuse/default-1920x1200.jpg
 test -e %{buildroot}/usr/share/cockpit/branding/suse/apple-touch-icon.png  || install -m 644 -D /dev/null %{buildroot}/usr/share/cockpit/branding/suse/apple-touch-icon.png
 test -e %{buildroot}/usr/share/cockpit/branding/suse/default-1920x1200.png || install -m 644 -D /dev/null %{buildroot}/usr/share/cockpit/branding/suse/default-1920x1200.png
@@ -520,8 +469,9 @@ It offers network configuration, log inspection, diagnostic reports, SELinux
 troubleshooting, interactive command-line sessions, and more.

 %files
-%license LICENSES/LGPL-2.1.txt
+%license COPYING
 %{_docdir}/cockpit/AUTHORS
+%{_docdir}/cockpit/COPYING
 %{_docdir}/cockpit/README.md
 %{_datadir}/metainfo/org.cockpit_project.cockpit.appdata.xml
 %dir %{_datadir}/icons/hicolor/128x128/apps
@@ -540,7 +490,7 @@ The Cockpit bridge component installed server side and runs commands on the
 system on behalf of the web based user interface.

 %files bridge -f base.list
-%license LICENSES/GPL-3.0.txt
+%license COPYING
 %doc %{_mandir}/man1/cockpit-bridge.1.gz
 %{_bindir}/cockpit-bridge
 %{_libexecdir}/cockpit-askpass
@@ -556,8 +506,9 @@ deploy Cockpit on their machines as well as helps developers who want to
 embed or extend Cockpit.

 %files doc
-%license LICENSES/LGPL-2.1.txt
+%license COPYING
 %exclude %{_docdir}/cockpit/AUTHORS
+%exclude %{_docdir}/cockpit/COPYING
 %exclude %{_docdir}/cockpit/README.md
 %{_docdir}/cockpit

@@ -573,7 +524,6 @@ Requires: jeos-firstboot
 Requires: /usr/bin/pwscore
 Requires: /usr/bin/date
 Requires: (sudo or polkit)
-Requires: (python3-pcp if pcp)
 Provides: cockpit-shell = %{version}-%{release}
 Provides: cockpit-systemd = %{version}-%{release}
 Provides: cockpit-tuned = %{version}-%{release}
@@ -582,9 +532,11 @@ Provides: cockpit-users = %{version}-%{release}
 Requires: NetworkManager >= 1.6
 Requires: sos
 Requires: sudo
+Recommends: PackageKit
 Recommends: setroubleshoot-server >= 3.3.3
 Recommends: kexec-tools
 Suggests: NetworkManager-team
+Suggests: python3-pcp
 Provides: cockpit-kdump = %{version}-%{release}
 Provides: cockpit-networkmanager = %{version}-%{release}
 Provides: cockpit-selinux = %{version}-%{release}
@@ -601,13 +553,14 @@ Recommends: (reportd if abrt)
 This package contains the Cockpit shell and system configuration interfaces.

 %files system -f system.list
-%license LICENSES/LGPL-2.1.txt
+%license COPYING
 %dir %{_datadir}/cockpit/shell/images

 %package ws
 Summary: Cockpit Web Service
+Requires: glib-networking
 Requires: openssl
-Requires: glib2 >= 2.68.0
+Requires: glib2 >= 2.50.0
 %if 0%{?with_selinux}
 Requires: (%{name}-ws-selinux = %{version}-%{release} if selinux-policy-base)
 Requires: (selinux-policy >= %{_selinux_policy_version} if selinux-policy-%{selinuxtype})
@@ -646,7 +599,7 @@ If sssd-dbus is installed, you can enable client certificate/smart card
 authentication via sssd/FreeIPA.

 %files ws -f static.list
-%license LICENSES/LGPL-2.1.txt
+%license COPYING
 %doc %{_mandir}/man1/cockpit-desktop.1.gz
 %doc %{_mandir}/man5/cockpit.conf.5.gz
 %doc %{_mandir}/man8/cockpit-ws.8.gz
@@ -654,10 +607,13 @@ authentication via sssd/FreeIPA.
 %doc %{_mandir}/man8/pam_ssh_add.8.gz
 %dir %{_sysconfdir}/cockpit
 %config(noreplace) %{_sysconfdir}/cockpit/ws-certs.d
-# dir is not owned by pam in openSUSE needed for Leap15.6
-%dir %{pamconfdir}
+%if 0%{?suse_version} > 1500
+%{_pam_vendordir}/cockpit
+%else
+%config(noreplace) %{_sysconfdir}/pam.d/cockpit
+%endif
+# dir is not owned by pam in openSUSE
 %dir %{_sysconfdir}/motd.d
-%config(noreplace) %{pamconfdir}/cockpit
 # created in %post, so that users can rm the files
 %ghost %{_sysconfdir}/issue.d/cockpit.issue
 %ghost %{_sysconfdir}/motd.d/cockpit
@@ -683,6 +639,7 @@ authentication via sssd/FreeIPA.
 %{_unitdir}/system-cockpithttps.slice
 %{_prefix}/%{__lib}/tmpfiles.d/cockpit-ws.conf
 %{pamdir}/pam_ssh_add.so
+%{pamdir}/pam_cockpit_cert.so
 %{_libexecdir}/cockpit-ws
 %{_libexecdir}/cockpit-wsinstance-factory
 %{_libexecdir}/cockpit-tls
@@ -727,6 +684,11 @@ if [ "$1" = 1 ]; then
    printf "# List of users which are not allowed to login to Cockpit\n" > /etc/cockpit/disallowed-users
    printf "root\n" >> /etc/cockpit/disallowed-users
    chmod 644 /etc/cockpit/disallowed-users
+
+    # Allow cockpit through the firewall
+    %if 0%{?suse_version} >= 1600
+    test -f %{_bindir}/firewall-cmd && firewall-cmd --quiet --permanent --add-service=cockpit && firewall-cmd --reload --quiet || true
+    %endif
 fi

 if [ "$1" = 2 ]; then
@@ -748,8 +710,14 @@ fi
 %endif
 %tmpfiles_create cockpit-ws.conf
 %systemd_post cockpit.socket cockpit.service
-# firewalld only partially picks up changes to its services files without this
-test -f %{_bindir}/firewall-cmd && firewall-cmd --reload --quiet || true
+
+# check for deprecated PAM config
+if test -f %{_sysconfdir}/pam.d/cockpit &&  grep -q pam_cockpit_cert %{_sysconfdir}/pam.d/cockpit; then
+    echo '**** WARNING:'
+    echo '**** WARNING: pam_cockpit_cert is a no-op and will be removed in a'
+    echo '**** WARNING: future release; remove it from your /etc/pam.d/cockpit.'
+    echo '**** WARNING:'
+fi

 # remove obsolete system user on upgrade (replaced with DynamicUser in version 330)
 if getent passwd cockpit-wsinstance >/dev/null; then
@@ -789,11 +757,11 @@ Obsoletes: %{name}-selinux-policies < 338
 SELinux policy module for the cockpit-ws package.

 %files ws-selinux
-%license LICENSES/LGPL-2.1.txt
+%license COPYING
 %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
 %{_mandir}/man8/%{name}_session_selinux.8cockpit.*
 %{_mandir}/man8/%{name}_ws_selinux.8cockpit.*
-%ghost %{_selinux_store_path}/%{selinuxtype}/active/modules/200/%{name}
+%ghost %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name}

 %posttrans ws-selinux
 %selinux_relabel_pre -s %{selinuxtype}
@@ -814,21 +782,16 @@ SELinux policy module for the cockpit-ws package.
 Summary: Cockpit user interface for kernel crash dumping
 Requires: cockpit-bridge >= %{required_base}
 Requires: cockpit-shell >= %{required_base}
-%if 0%{?suse_version}
-Requires: /usr/sbin/kdumptool
-%else
-Requires: /usr/bin/kdumpctl
-%endif
+Requires: kexec-tools
 BuildArch: noarch

 %description kdump
 The Cockpit component for configuring kernel crash dumping.

 %files kdump -f kdump.list
-%license LICENSES/LGPL-2.1.txt
+%license COPYING
 %{_datadir}/metainfo/org.cockpit_project.cockpit_kdump.metainfo.xml

-# sosreport is not supported on opensuse yet
 %if !0%{?suse_version}
 %package sosreport
 Summary: Cockpit user interface for diagnostic reports
@@ -842,7 +805,7 @@ The Cockpit component for creating diagnostic reports with the
 sosreport tool.

 %files sosreport -f sosreport.list
-%license LICENSES/LGPL-2.1.txt
+%license COPYING
 %{_datadir}/metainfo/org.cockpit_project.cockpit_sosreport.metainfo.xml
 %{_datadir}/icons/hicolor/64x64/apps/cockpit-sosreport.png
 %endif
@@ -861,12 +824,13 @@ BuildArch: noarch
 The Cockpit component for managing networking.  This package uses NetworkManager.

 %files networkmanager -f networkmanager.list
-%license LICENSES/LGPL-2.1.txt
+%license COPYING
 %{_datadir}/metainfo/org.cockpit_project.cockpit_networkmanager.metainfo.xml

 %endif

 %if 0%{?rhel} == 0 && ( 0%{?suse_version} >= 1500 || 0%{?is_smo} )
+
 %package selinux
 Summary: Cockpit SELinux package
 Requires: cockpit-bridge >= %{required_base}
@@ -876,14 +840,14 @@ Requires:       policycoreutils-python-utils >= 3.1
 %if !0%{?suse_version}  || ( 0%{?is_smo} && 0%{?sle_version} >= 150500 ) || 0%{?suse_version} >= 1600
 Requires:       setroubleshoot-server >= 3.3.3
 %endif
-BuildArch: noarch
+BuildArch:      noarch

 %description selinux
 This package contains the Cockpit user interface integration with the
 utility setroubleshoot to diagnose and resolve SELinux issues.

 %files selinux -f selinux.list
-%license LICENSES/LGPL-2.1.txt
+%license COPYING
 %{_datadir}/metainfo/org.cockpit_project.cockpit_selinux.metainfo.xml

 %endif
@@ -902,7 +866,7 @@ Requires: python3-dbus-python
 Recommends: udisks2-lvm2 >= 2.9
 Recommends: udisks2-iscsi >= 2.9
 %if ! 0%{?rhel}
-Recommends: (udisks2-btrfs >= 2.9 if (btrfs-progs or btrfsprogs))
+Recommends: udisks2-btrfs >= 2.9
 %endif
 Recommends: device-mapper-multipath
 Recommends: clevis-luks
@@ -914,7 +878,7 @@ BuildArch: noarch
 The Cockpit component for managing storage.  This package uses udisks.

 %files -n cockpit-storaged -f storaged.list
-%license LICENSES/LGPL-2.1.txt
+%license COPYING
 %{_datadir}/metainfo/org.cockpit_project.cockpit_storaged.metainfo.xml

 %post storaged
@@ -937,7 +901,6 @@ Summary: Cockpit user interface for packages
 BuildArch: noarch
 Requires: cockpit-bridge >= %{required_base}
 Requires: PackageKit
-Requires: libzypp-plugin-appdata
 Recommends: python3-tracer
 # HACK: https://bugzilla.redhat.com/show_bug.cgi?id=1800468
 Requires: polkit
@@ -947,33 +910,7 @@ The Cockpit components for installing OS updates and Cockpit add-ons,
 via PackageKit.

 %files -n cockpit-packagekit -f packagekit.list
-%license LICENSES/LGPL-2.1.txt
-
-%package firewalld
-Summary: Allows Cockpit access through the firewall
-Requires: cockpit-bridge >= %{required_base}
-Requires: firewalld
-BuildArch: noarch
-
-%description firewalld
-This package allows Cockpit access through the firewall
-
-%files firewalld
-%license LICENSES/LGPL-2.1.txt
-
-%postun firewalld
-if test -f %{_bindir}/firewall-cmd && firewall-cmd --state &>/dev/null; then
-    firewall-cmd --quiet --permanent --remove-service=cockpit && firewall-cmd --reload --quiet || true
-elif test -f %{_bindir}/firewall-offline-cmd; then
-    firewall-offline-cmd --quiet --remove-service=cockpit || true
-fi
-
-%posttrans firewalld
-if test -f %{_bindir}/firewall-cmd && firewall-cmd --state &>/dev/null; then
-    firewall-cmd --quiet --permanent --add-service=cockpit && firewall-cmd --reload --quiet || true
-elif test -f %{_bindir}/firewall-offline-cmd; then
-    firewall-offline-cmd --quiet --add-service=cockpit || true
-fi
+%license COPYING

 # The changelog is automatically generated and merged
 %changelog
--- a/css-overrides.patch
+++ b/css-overrides.patch
@@ -44,39 +44,39 @@ now, it fulfills the requirements of [3].
 create mode 100644 pkg/static/css-overrides.css

 diff --git a/pkg/apps/index.html b/pkg/apps/index.html
-index f8f8daa83..543cc5492 100644
+index fd17d5131..9aac50800 100644
 --- a/pkg/apps/index.html
 +++ b/pkg/apps/index.html
-@@ -24,6 +24,7 @@ along with Cockpit; If not, see <https://www.gnu.org/licenses/>.
+@@ -23,6 +23,7 @@ along with Cockpit; If not, see <https://www.gnu.org/licenses/>.
+     <title translate="yes">Applications</title>
     <meta charset="utf-8" />
     <link href="apps.css" type="text/css" rel="stylesheet" />
-     <link href="../../static/branding.css" rel="stylesheet" />
 +    <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet">
     <script type="text/javascript" src="../base1/cockpit.js"></script>
     <script type="text/javascript" src="../base1/po.js"></script>
     <script type="text/javascript" src="po.js"></script>
 diff --git a/pkg/kdump/index.html b/pkg/kdump/index.html
-index 77cf9ff38..af46a3d98 100644
+index 8138f050f..619416dd4 100644
 --- a/pkg/kdump/index.html
 +++ b/pkg/kdump/index.html
-@@ -26,6 +26,7 @@ along with Cockpit; If not, see <https://www.gnu.org/licenses/>.
-
+@@ -25,6 +25,7 @@ along with Cockpit; If not, see <https://www.gnu.org/licenses/>.
+     <meta name="viewport" content="width=device-width, initial-scale=1" />
+ 
     <link rel="stylesheet" href="kdump.css" />
-     <link href="../../static/branding.css" rel="stylesheet" />
 +    <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet" />
-
+ 
     <script type="text/javascript" src="kdump.js"></script>
     <script type="text/javascript" src="../base1/po.js"></script>
 diff --git a/pkg/metrics/index.html b/pkg/metrics/index.html
-index cbf10aab8..c42081e34 100644
+index cbb82dccc..b17bd1a76 100644
 --- a/pkg/metrics/index.html
 +++ b/pkg/metrics/index.html
-@@ -24,6 +24,7 @@ along with this package; If not, see <https://www.gnu.org/licenses/>.
-
+@@ -23,6 +23,7 @@ along with this package; If not, see <https://www.gnu.org/licenses/>.
+     <meta name="viewport" content="width=device-width, initial-scale=1" />
+ 
     <link rel="stylesheet" href="index.css" />
-     <link href="../../static/branding.css" rel="stylesheet" />
 +    <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet" />
-
+ 
     <script type="text/javascript" src="../base1/cockpit.js"></script>
     <script type="text/javascript" src="../manifests.js"></script>
 diff --git a/pkg/networkmanager/firewall.html b/pkg/networkmanager/firewall.html
@@ -85,44 +85,44 @@ index e5ea58276..6bc5327f5 100644
 +++ b/pkg/networkmanager/firewall.html
@@ -23,6 +23,7 @@ along with Cockpit; If not, see <https://www.gnu.org/licenses/>.
     <meta charset="utf-8" />
-
+ 
     <link href="firewall.css" type="text/css" rel="stylesheet" />
 +    <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet" />
-
+ 
     <script src="../base1/cockpit.js"></script>
     <script src="../base1/po.js"></script>
 diff --git a/pkg/networkmanager/index.html b/pkg/networkmanager/index.html
-index e73b89502..0e2c6e09e 100644
+index fc9cb5aff..3aceef1b2 100644
 --- a/pkg/networkmanager/index.html
 +++ b/pkg/networkmanager/index.html
-@@ -25,6 +25,7 @@
+@@ -24,6 +24,7 @@
+   <meta charset="utf-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
   <link href="networkmanager.css" type="text/css" rel="stylesheet" />
-   <link href="../../static/branding.css" rel="stylesheet" />
 +  <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet" />
   <script src="../base1/cockpit.js"></script>
   <script src="../manifests.js"></script>
   <script src="../base1/po.js"></script>
 diff --git a/pkg/packagekit/index.html b/pkg/packagekit/index.html
-index e3ec580c9..a91cdebec 100644
+index c95dfd263..f4f3baab6 100644
 --- a/pkg/packagekit/index.html
 +++ b/pkg/packagekit/index.html
-@@ -25,6 +25,7 @@ along with Cockpit; If not, see <https://www.gnu.org/licenses/>.
-
+@@ -24,6 +24,7 @@ along with Cockpit; If not, see <https://www.gnu.org/licenses/>.
+   <meta charset="utf-8" />
+ 
   <link href="updates.css" rel="stylesheet" />
-   <link href="../../static/branding.css" rel="stylesheet" />
 +  <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet" />
-
+ 
   <script src="../base1/cockpit.js"></script>
   <script src="../base1/po.js"></script>
 diff --git a/pkg/playground/index.html b/pkg/playground/index.html
-index cb5eb670f..081972401 100644
+index 4f2bce82d..6f87bc642 100644
 --- a/pkg/playground/index.html
 +++ b/pkg/playground/index.html
-@@ -6,6 +6,7 @@
+@@ -5,6 +5,7 @@
+     <title>Cockpit Development Playground</title>
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <link href="index.css" type="text/css" rel="stylesheet" />
-     <link href="../../static/branding.css" rel="stylesheet" />
 +    <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet" />
     <script src="../base1/cockpit.js"></script>
     <script src="../manifests.js"></script>
@@ -199,18 +199,6 @@ index 97a74791f..a2519cfd2 100644
     <script src="../base1/cockpit.js"></script>
     <script src="test.js"></script>
 </head>
-diff --git a/pkg/selinux/index.html b/pkg/selinux/index.html
-index f967e7b25..bc64e6d8c 100644
--- a/pkg/selinux/index.html
-+++ b/pkg/selinux/index.html
-@@ -26,6 +26,7 @@ along with Cockpit; If not, see <https://www.gnu.org/licenses/>.
-
-     <link rel="stylesheet" href="selinux.css" />
-     <link href="../../static/branding.css" rel="stylesheet" />
-+    <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet" />
-
-     <script type="text/javascript" src="../base1/cockpit.js"></script>
-     <script type="text/javascript" src="../base1/po.js"></script>
 diff --git a/pkg/shell/index.html b/pkg/shell/index.html
 index 6dd5ad1ac..1c6f3512c 100644
 --- a/pkg/shell/index.html
@@ -235,6 +223,18 @@ index c9adf7ae2..97f088f7c 100644
 </head>
 <body class="pf-v6-m-tabular-nums">
     <div class="curtains-ct">
+diff --git a/pkg/sosreport/index.html b/pkg/sosreport/index.html
+index e673383ad..224b42463 100644
+--- a/pkg/sosreport/index.html
+++ b/pkg/sosreport/index.html
+@@ -22,6 +22,7 @@ along with Cockpit; If not, see <https://www.gnu.org/licenses/>.
+     <title translate="yes">Diagnostic reports</title>
+     <meta charset="utf-8" />
+     <link href="sosreport.css" rel="stylesheet" />
+    <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet" />
+     <script type="text/javascript" src="../base1/cockpit.js"></script>
+     <script type="text/javascript" src="../base1/po.js"></script>
+     <script type="text/javascript" src="po.js"></script>
 diff --git a/pkg/static/css-overrides.css b/pkg/static/css-overrides.css
 new file mode 100644
 index 000000000..7481f7ecf
@@ -253,42 +253,6 @@ index 000000000..7481f7ecf
 + *   - https://github.com/cockpit-project/cockpit/pull/17437
 + *   - https://github.com/cockpit-project/cockpit/issues/16359
 + */
-diff --git a/pkg/sosreport/index.html b/pkg/sosreport/index.html
-index a37f816ee..37528f38b 100644
--- a/pkg/sosreport/index.html
-+++ b/pkg/sosreport/index.html
-@@ -23,6 +23,7 @@ along with Cockpit; If not, see <https://www.gnu.org/licenses/>.
-     <meta charset="utf-8" />
-     <link href="sosreport.css" rel="stylesheet" />
-     <link href="../../static/branding.css" rel="stylesheet" />
-+    <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet" />
-     <script type="text/javascript" src="../base1/cockpit.js"></script>
-     <script type="text/javascript" src="../base1/po.js"></script>
-     <script type="text/javascript" src="po.js"></script>
-diff --git a/pkg/static/login.html b/pkg/static/login.html
-index 4a3ade726..7ce60a214 100644
--- a/pkg/static/login.html
-+++ b/pkg/static/login.html
-@@ -11,6 +11,7 @@
-   <script type="text/javascript" src="cockpit/static/login.js"></script>
-   <link href="cockpit/static/login.css" type="text/css" rel="stylesheet" />
-   <link href="cockpit/static/branding.css" type="text/css" rel="stylesheet" />
-+  <link href="cockpit/static/css-overrides.css" type="text/css" rel="stylesheet" />
- </head>
-
- <body class="login-pf">
-diff --git a/pkg/storaged/index.html b/pkg/storaged/index.html
-index 9453ee003..bb69595d5 100644
--- a/pkg/storaged/index.html
-+++ b/pkg/storaged/index.html
-@@ -25,6 +25,7 @@
-     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-     <link href="storaged.css" type="text/css" rel="stylesheet" />
-     <link href="../../static/branding.css" rel="stylesheet" />
-+    <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet" />
-     <script src="../base1/cockpit.js"></script>
-     <script src="../base1/po.js"></script>
-     <script src="../manifests.js"></script>
 diff --git a/pkg/systemd/hwinfo.html b/pkg/systemd/hwinfo.html
 index a3413faca..549b80298 100644
 --- a/pkg/systemd/hwinfo.html
@@ -302,14 +266,14 @@ index a3413faca..549b80298 100644
     <script src="../base1/po.js"></script>
     <script src="po.js"></script>
 diff --git a/pkg/systemd/index.html b/pkg/systemd/index.html
-index 146b59304..28d660b67 100644
+index 91a268a4a..ee125fe65 100644
 --- a/pkg/systemd/index.html
 +++ b/pkg/systemd/index.html
-@@ -7,6 +7,7 @@
+@@ -6,6 +6,7 @@
+   <meta name="description" content="" />
   <meta name="viewport" content="width=device-width, initial-scale=1" />
   <link rel="stylesheet" href="overview.css" />
-   <link href="../../static/branding.css" rel="stylesheet" />
-+  <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet" />
+  <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet"/>
   <script type="text/javascript" src="../base1/cockpit.js"></script>
   <script type="text/javascript" src="../base1/po.js"></script>
   <script type="text/javascript" src="overview.js"></script>
@@ -326,17 +290,17 @@ index f89f1fa47..5086ce1f6 100644
   <script src="../base1/po.js"></script>
   <script src="po.js"></script>
 diff --git a/pkg/systemd/services.html b/pkg/systemd/services.html
-index a17e95e56..7eaa65efa 100644
+index 74fa456d4..e9c7047ee 100644
 --- a/pkg/systemd/services.html
 +++ b/pkg/systemd/services.html
-@@ -9,6 +9,7 @@
-     <script src="../base1/po.js"></script>
-     <script src="../manifests.js"></script>
-     <script src="services.js"></script>
+@@ -5,6 +5,7 @@
+     <meta charset="utf-8" />
+     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+     <link href="services.css" type="text/css" rel="stylesheet" />
 +    <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet" />
-     <script src="po.js"></script>
- </head>
-
+     <script src="../base1/cockpit.js"></script>
+     <script src="../base1/po.js"></script>
+     <script src="services.js"></script>
 diff --git a/pkg/systemd/terminal.html b/pkg/systemd/terminal.html
 index ce7216e4e..63547f9d3 100644
 --- a/pkg/systemd/terminal.html
@@ -350,17 +314,53 @@ index ce7216e4e..63547f9d3 100644
     <script src="../base1/po.js"></script>
     <script src="po.js"></script>
 diff --git a/pkg/users/index.html b/pkg/users/index.html
-index 6c8c81be9..533a5975a 100644
+index d26cf4781..b0c6ebf87 100644
 --- a/pkg/users/index.html
 +++ b/pkg/users/index.html
-@@ -25,6 +25,7 @@
+@@ -24,6 +24,7 @@
+     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <link href="users.css" type="text/css" rel="stylesheet" />
-     <link href="../../static/branding.css" rel="stylesheet" />
 +    <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet" />
     <script src="../base1/cockpit.js"></script>
     <script src="../base1/po.js"></script>
     <script src="po.js"></script>
+diff --git a/pkg/storaged/index.html b/pkg/storaged/index.html
+index 6893e4909..b6677bb56 100644
+--- a/pkg/storaged/index.html
+++ b/pkg/storaged/index.html
+@@ -24,6 +24,7 @@
+     <meta charset="utf-8" />
+     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+     <link href="storaged.css" type="text/css" rel="stylesheet" />
+    <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet">
+     <script src="../base1/cockpit.js"></script>
+     <script src="../base1/po.js"></script>
+     <script src="../manifests.js"></script>
+diff --git a/pkg/static/login.html b/pkg/static/login.html
+index 6a8fa4f44..9019499a5 100644
+--- a/pkg/static/login.html
+++ b/pkg/static/login.html
+@@ -11,6 +11,7 @@
+   <script type="text/javascript" src="cockpit/static/login.js"></script>
+   <link href="cockpit/static/login.css" type="text/css" rel="stylesheet" />
+   <link href="cockpit/static/branding.css" type="text/css" rel="stylesheet" />
+  <link href="cockpit/static/css-overrides.css" type="text/css" rel="stylesheet" />
+ </head>
+
+ <body class="login-pf">
+diff --git a/pkg/selinux/index.html b/pkg/selinux/index.html
+index cc3825a25..e1c814c6d 100644
+--- a/pkg/selinux/index.html
+++ b/pkg/selinux/index.html
+@@ -25,6 +25,7 @@ along with Cockpit; If not, see <https://www.gnu.org/licenses/>.
+     <meta name="viewport" content="width=device-width, initial-scale=1" />
+ 
+     <link rel="stylesheet" href="selinux.css" />
+    <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet">
+ 
+     <script type="text/javascript" src="../base1/cockpit.js"></script>
+     <script type="text/javascript" src="../base1/po.js"></script>
 -- 
 2.49.0

--- a/esbuild-ppc64.patch
+++ b/esbuild-ppc64.patch
@@ -1,27 +0,0 @@
-From 22fe8bdedc8bb40cf2c9857fa73eb94985a1f664 Mon Sep 17 00:00:00 2001
-From: Miika Alikirri <miika.alikirri@suse.com>
-Date: Tue, 10 Feb 2026 19:46:47 +0200
-Subject: Don't use esbuild wasm on ppc64
-
-For some reason, wasm runtime is broken on node24 so we should
-use native runtime instead
---
- build.js | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/build.js b/build.js
-index 49fc9900a..5e57ebc62 100755
--- a/build.js
-+++ b/build.js
-@@ -10,7 +10,7 @@ import process from 'node:process';
- import { getFiles, getTestFiles, all_subdirs } from './files.js';
- 
- const production = process.env.NODE_ENV === 'production';
-const useWasm = os.arch() != 'x64';
-+const useWasm = false;
- 
- // ensure node_modules is present and up to date
- child_process.spawnSync('tools/node-modules', ['make_package_lock_json'], { stdio: 'inherit' });
-- 
-2.52.0
-
--- a/hide-pcp.patch
+++ b/hide-pcp.patch
@@ -1,75 +1,34 @@
-diff --git a/pkg/metrics/metrics.jsx b/pkg/metrics/metrics.jsx
-index 80f1087..fda6049 100644
-@@ -3,7 +3,7 @@
-  * SPDX-License-Identifier: LGPL-2.1-or-later
-  */
+Index: cockpit/pkg/metrics/metrics.jsx
+===================================================================
+--- cockpit.orig/pkg/metrics/metrics.jsx
+++ cockpit/pkg/metrics/metrics.jsx
+@@ -1565,6 +1565,7 @@ const PCPConfig = ({ buttonVariant, firewalldRequest, needsLogout, setNeedsLogou
 
-import React, { useState, createRef } from 'react';
-+import React, { useState, createRef, useEffect } from 'react';
- 
- import { Alert } from "@patternfly/react-core/dist/esm/components/Alert/index.js";
- import { Breadcrumb, BreadcrumbItem } from "@patternfly/react-core/dist/esm/components/Breadcrumb/index.js";
-@@ -1510,6 +1510,7 @@ const PCPConfigDialog = ({
- const PCPConfig = ({ buttonVariant, firewalldRequest }) => {
-     const Dialogs = useDialogs();
-     const [packageInstallStatus, setPackageInstallStatus] = useState(null);
-+    const [isMicroOs, setIsMicroOs] = useState(false);
- 
-     const s_pmlogger = useObject(() => service.proxy("pmlogger.service"), null, []);
-     const s_pmproxy = useObject(() => service.proxy("pmproxy.service"), null, []);
-@@ -1531,6 +1532,12 @@ const PCPConfig = ({ buttonVariant, firewalldRequest }) => {
-           "redis-server exists", s_redis_server.exists, "state", s_redis_server.state,
-           "valkey exists", s_valkey.exists, "state", s_valkey.state);
- 
-+    useEffect(() => {
-+        read_os_release().then((os_release) => {
-+            setIsMicroOs(os_release?.ID_LIKE.includes("sle-micro") || os_release?.ID_LIKE.includes("microos"))
-+        });
-+    }, []);
-+
-     if (!superuser.allowed)
-         return null;
- 
-@@ -1543,8 +1550,13 @@ const PCPConfig = ({ buttonVariant, firewalldRequest }) => {
-                                       packageInstallCallback={() => setPackageInstallStatus("done")} />);
-     }
- 
-+    function is_micro_os() {
-+        return ;
-+    }
-+
     return (
         <Button variant={buttonVariant} icon={<CogIcon />}
-+                className={isMicroOs ? "pf-u-display-none" : ""}
+                className="pf-u-display-none"
                 isDisabled={ invalidService(s_pmlogger) || invalidService(s_pmproxy) ||
                              invalidService(s_redis) || invalidService(s_redis_server) || invalidService(s_valkey) }
-                 onClick={show_dialog}
-@@ -1578,6 +1590,7 @@ class MetricsHistory extends React.Component {
-             isBeibootBridge: false,
-             isPythonPCPInstalled: null,
-             selectedVisibility: this.columns.reduce((a, v) => ({ ...a, [v[0]]: true }), {}),
-+            isMicroOs: false,
-             boots: [], // journalctl --list-boots as [{started: Date, ended: Date}]
-         };
- 
-@@ -1609,6 +1622,10 @@ class MetricsHistory extends React.Component {
- 
-     // load and render the last 24 hours (plus current one) initially; this needs numCpu initialized for correct scaling
-     initialLoadData() {
-+        read_os_release().then((os_release) => {
-+            this.setState({ isMicroOs: os_release?.ID_LIKE.includes("sle-micro") || os_release?.ID_LIKE.includes("microos") });
-+        });
-+
-         cockpit.spawn(["date", "+%s"])
-                 .then(out => {
-                     const now = parseInt(out.trim()) * 1000;
-@@ -1815,6 +1832,9 @@ class MetricsHistory extends React.Component {
-     }
- 
-     render() {
-+        if (this.state.isMicroOs)
-+            return <></>;
-+
+                 onClick={show_dialog}>
+Index: cockpit-309/pkg/metrics/metrics.jsx
+===================================================================
+--- cockpit-309.orig/pkg/metrics/metrics.jsx
+++ cockpit-309/pkg/metrics/metrics.jsx
+@@ -1824,7 +1825,8 @@ class MetricsHistory extends React.Component {
         // on a single machine, cockpit-pcp depends on pcp; but this may not be the case in the beiboot scenario,
         // so additionally check if pcp is available on the logged in target machine
-         if (this.state.isPythonPCPInstalled === false || this.pmlogger_service.exists === false)
+         if ((cockpit.manifests && !cockpit.manifests.pcp) || this.pmlogger_service.exists === false)
+-            return <EmptyStatePanel
+            return <EmptyStatePanel />
+/*            return <EmptyStatePanel
+                         icon={ExclamationCircleIcon}
+                         title={_("Package cockpit-pcp is missing for metrics history")}
+                         action={this.state.isBeibootBridge === true
+@@ -1834,6 +1834,7 @@ class MetricsHistory extends React.Component {
+                             ? <Text>{ _("Installation not supported without installed cockpit package") }</Text>
+                             : this.state.packagekitExists && <Button onClick={this.handleInstall}>{_("Install cockpit-pcp")}</Button>}
+             />;
+*/
+ 
+         if (!this.state.metricsAvailable) {
+             let action;
--- a/kdump-nfs-fixes.patch
+++ b/kdump-nfs-fixes.patch
@@ -0,0 +1,153 @@
+From d1ffed4a006bc9f8aeb0e8f63e8d2a160720b4f6 Mon Sep 17 00:00:00 2001
+From: Alice Brooks <alice.brooks@suse.com>
+Date: Thu, 12 Jun 2025 08:48:16 +0100
+Subject: [PATCH] kdump: Remove nfs directory when using sysconfig
+ configuration style
+
+This is because the sysconfig style only has the KDUMP_SAVEDIR field
+so we can't work with two path fields as it's impossible to extract
+them again
+---
+ pkg/kdump/kdump-client.js |  4 ++++
+ pkg/kdump/kdump-view.jsx  | 24 +++++++++++++++---------
+ pkg/kdump/kdump.js        |  6 ++++++
+ 4 files changed, 26 insertions(+), 20 deletions(-)
+
+diff --git a/pkg/kdump/kdump-client.js b/pkg/kdump/kdump-client.js
+index d4c3d989a42d..35add2554a39 100644
+--- a/pkg/kdump/kdump-client.js
+++ b/pkg/kdump/kdump-client.js
+@@ -48,6 +48,7 @@ export class KdumpClient {
+             state: undefined,
+             config: undefined,
+             target: undefined,
+            sysconfig: undefined,
+         };
+         cockpit.event_target(this);
+ 
+@@ -62,6 +63,7 @@ export class KdumpClient {
+ 
+         // watch the config file
+         this.configClient = new ConfigFile("/etc/kdump.conf", true);
+        this.state.sysconfig = false;
+         this._watchConfigChanges();
+ 
+         this.configClient.wait().then(() => {
+@@ -69,6 +71,8 @@ export class KdumpClient {
+             if (this.configClient.settings === null) {
+                 this.configClient.close();
+                 this.configClient = new ConfigFileSUSE("/etc/sysconfig/kdump", true);
+                this.state.sysconfig = true;
+                this.dispatchEvent("kdumpSysconfigChanged", true);
+                 this._watchConfigChanges();
+             }
+         });
+diff --git a/pkg/kdump/kdump-view.jsx b/pkg/kdump/kdump-view.jsx
+index c6cc1e0d6bc6..8b5d74707e39 100644
+--- a/pkg/kdump/kdump-view.jsx
+++ b/pkg/kdump/kdump-view.jsx
+@@ -115,12 +115,15 @@ const exportAnsibleTask = (settings, os_release) => {
+     return ansible;
+ };
+ 
+-function getLocation(target) {
+function getLocation(target, sysconfig) {
+     let path = target.path || DEFAULT_KDUMP_PATH;
+ 
+     if (target.type === "ssh") {
+         path = `${target.server}:${path}`;
+     } else if (target.type == "nfs") {
+        if (sysconfig) {
+            path = '';
+        }
+         path = path[0] !== '/' ? '/' + path : path;
+         path = `${target.server}:${target.export + path}`;
+     }
+@@ -128,7 +131,7 @@ function getLocation(target) {
+     return path;
+ }
+ 
+-const KdumpSettingsModal = ({ settings, initialTarget, handleSave }) => {
+const KdumpSettingsModal = ({ settings, initialTarget, handleSave, sysconfig }) => {
+     const Dialogs = useDialogs();
+     const compressionAllowed = settings.compression?.allowed;
+     const [isSaving, setIsSaving] = useState(false);
+@@ -276,13 +279,15 @@ const KdumpSettingsModal = ({ settings, initialTarget, handleSave }) => {
+                                     placeholder="/export/cores" value={exportPath}
+                                     onChange={(_event, value) => setExportPath(value)} isRequired />
+                         </FormGroup>
+                        {sysconfig === false &&
+                         <FormGroup fieldId="kdump-settings-nfs-directory" label={_("Directory")} isRequired>
+                             <TextInput id="kdump-settings-nfs-directory" key="directory"
+-                                    placeholder={DEFAULT_KDUMP_PATH} value={directory}
+-                                    data-stored={directory}
+-                                    onChange={(_event, value) => setDirectory(value)}
+-                                    isRequired />
+                                          placeholder={DEFAULT_KDUMP_PATH} value={directory}
+                                          data-stored={directory}
+                                          onChange={(_event, value) => setDirectory(value)}
+                                          isRequired />
+                         </FormGroup>
+                        }
+                     </>
+                 }
+ 
+@@ -353,7 +358,7 @@ export class KdumpPage extends React.Component {
+         const target = this.props.kdumpStatus.target;
+         let verifyMessage;
+         if (!target.multipleTargets) {
+-            const path = getLocation(target);
+            const path = getLocation(target, this.props.sysconfig);
+             if (target.type === "local") {
+                 verifyMessage = fmt_to_fragments(
+                     ' ' + _("Results of the crash will be stored in $0 as $1, if kdump is properly configured."),
+@@ -403,7 +408,8 @@ export class KdumpPage extends React.Component {
+         const Dialogs = this.context;
+         Dialogs.show(<KdumpSettingsModal settings={this.props.kdumpStatus.config}
+                                          initialTarget={this.props.kdumpStatus.target}
+-                                         handleSave={this.props.onSaveSettings} />);
+                                         handleSave={this.props.onSaveSettings}
+                                         sysconfig={this.props.sysconfig} />);
+     }
+ 
+     handleAutomationClick() {
+@@ -459,7 +465,7 @@ ${enableCrashKernel}
+             if (target.multipleTargets) {
+                 kdumpLocation = _("invalid: multiple targets defined");
+             } else {
+-                const locationPath = getLocation(target);
+                const locationPath = getLocation(target, this.props.sysconfig);
+                 if (target.type == "local") {
+                     kdumpLocation = cockpit.format(_("Local, $0"), locationPath);
+                     targetCanChange = true;
+diff --git a/pkg/kdump/kdump.js b/pkg/kdump/kdump.js
+index 1a143defef15..b0f75e88c220 100644
+--- a/pkg/kdump/kdump.js
+++ b/pkg/kdump/kdump.js
+@@ -41,6 +41,7 @@ const initStore = function(rootElement) {
+     dataStore.domRootElement = rootElement;
+ 
+     dataStore.kdumpClient = new kdumpClient.KdumpClient();
+    dataStore.sysconfig = dataStore.kdumpClient.state.sysconfig;
+ 
+     dataStore.saveSettings = settings =>
+         dataStore.kdumpClient.validateSettings(settings)
+@@ -74,6 +75,7 @@ const initStore = function(rootElement) {
+             reservedMemory: dataStore.kdumpMemory,
+             kdumpStatus: dataStore.kdumpStatus,
+             kdumpCmdlineEnabled: dataStore.crashkernel || false,
+            sysconfig: dataStore.sysconfig,
+             onSaveSettings: dataStore.saveSettings,
+             onCrashKernel: dataStore.kdumpClient.crashKernel,
+             exportConfig: dataStore.exportConfig,
+@@ -117,6 +119,10 @@ const initStore = function(rootElement) {
+         dataStore.kdumpStatus = status;
+         render();
+     });
+    dataStore.kdumpClient.addEventListener('kdumpSysconfigChanged', function(event, sysconfig) {
+        dataStore.sysconfig = sysconfig;
+        render();
+    });
+ 
+     // render once
+     render();
--- a/node_modules.obscpio
+++ b/node_modules.obscpio
--- a/node_modules.spec.inc
+++ b/node_modules.spec.inc
--- a/package-lock.json
+++ b/package-lock.json
--- a/packagekit-single-install.patch
+++ b/packagekit-single-install.patch
@@ -20,16 +20,18 @@ tens of seconds when there are thousands of packages.
 2 files changed, 220 insertions(+), 25 deletions(-)

 diff --git a/pkg/packagekit/updates.jsx b/pkg/packagekit/updates.jsx
-index 40fca0a..abc8c70 100644
-@@ -67,6 +67,7 @@ import { read_os_release } from "os-release.js";
+index 80a16dda7..4fe94432a 100644
+--- a/pkg/packagekit/updates.jsx
+++ b/pkg/packagekit/updates.jsx
+@@ -80,6 +80,7 @@ import { debug } from './utils';
 import callTracerScript from './callTracer.py';
 
 import "./updates.scss";
 +import { Checkbox } from '@patternfly/react-core';
- import { Truncate } from '@patternfly/react-core/dist/esm/components/Truncate/index.js';
- import { Severity } from '_internal/packagemanager-abstract';
- import { getPackageManager } from 'packagemanager';
-@@ -95,6 +96,7 @@ const UPDATES = {
+ 
+ const _ = cockpit.gettext;
+ 
+@@ -93,6 +94,7 @@ const UPDATES = {
     ALL: 0,
     SECURITY: 1,
     KPATCHES: 2,
@@ -37,7 +39,7 @@ index 40fca0a..abc8c70 100644
 };
 
 function init() {
-@@ -119,6 +121,195 @@ function init() {
+@@ -117,6 +119,196 @@ function init() {
     PK_STATUS_LOG_STRINGS[PK.Enum.STATUS_SIGCHECK] = _("Verified");
 }
 
@@ -230,10 +232,11 @@ index 40fca0a..abc8c70 100644
 +    return allIds.filter((id) => !!!state.selected[id]);
 +}
 +
- function deduplicate(list) {
-     return [...new Set(list)].sort();
- }
-@@ -381,6 +572,7 @@ function updateItem(remarkable, info, pkgNames, key) {
+
+ // parse CVEs from an arbitrary text (changelog) and return URL array
+ function parseCVEs(text) {
+     if (!text)
+@@ -401,6 +593,7 @@ function updateItem(remarkable, info, pkgNames, key) {
             { title: <TableText wrapModifier="truncate">{info.version}</TableText>, props: { className: "version" } },
             { title: <TableText wrapModifier="nowrap">{type}</TableText>, props: { className: "type" } },
             { title: descriptionFirstLine, props: { className: "changelog" } },
@@ -241,15 +244,15 @@ index 40fca0a..abc8c70 100644
         ],
         props: {
             key,
-@@ -430,6 +622,7 @@ const UpdatesList = ({ updates }) => {
+@@ -451,6 +644,7 @@ const UpdatesList = ({ updates }) => {
                     { title: _("Version"), props: { width: 15 } },
                     { title: _("Severity"), props: { width: 15 } },
                     { title: _("Details"), props: { width: 30 } },
 +                    { title: _("Select update") },
                 ]}
-                 rows={combined_updates.map(update => updateItem(remarkable, update, packageNames[update.id].sort((a, b) => a.name > b.name), update.id))} />
+                 rows={update_ids.map(id => updateItem(remarkable, updates[id], packageNames[id].sort((a, b) => a.name > b.name), id))} />
     );
-@@ -913,25 +1106,12 @@ class CardsPage extends React.Component {
+@@ -932,25 +1126,12 @@ class CardsPage extends React.Component {
                 id: "available-updates",
                 title: _("Available updates"),
                 actions: (<div className="pk-updates--header--actions">
@@ -278,7 +281,7 @@ index 40fca0a..abc8c70 100644
                 </div>),
                 containsList: true,
                 body: <UpdatesList updates={this.props.updates} />
-@@ -1315,13 +1495,19 @@ class OsUpdates extends React.Component {
+@@ -1397,13 +1578,19 @@ class OsUpdates extends React.Component {
                 });
     }
 
@@ -287,11 +290,11 @@ index 40fca0a..abc8c70 100644
 +     * @param {SelecetedState=} selected
 +     */
 +    applyUpdates(type, selected) {
-         let updates = [...this.state.updates];
+         let ids = Object.keys(this.state.updates);
         if (type === UPDATES.SECURITY)
-             updates = updates.filter(update => update.severity === Severity.CRITICAL);
+             ids = ids.filter(id => this.state.updates[id].severity === PK.Enum.INFO_SECURITY);
         if (type === UPDATES.KPATCHES) {
-             updates = updates.filter(update => isKpatchPackage(update.name));
+             ids = ids.filter(id => isKpatchPackage(this.state.updates[id].name));
         }
 +        if (type === UPDATES.SELECTED && selected) {
 +            ids = calculateSelected(ids, selected);
@@ -299,7 +302,7 @@ index 40fca0a..abc8c70 100644
 
         PK.transaction()
                 .then(transactionPath => {
-@@ -1347,6 +1533,8 @@ class OsUpdates extends React.Component {
+@@ -1429,6 +1616,8 @@ class OsUpdates extends React.Component {
         let applySecurity;
         let applyKpatches;
         let applyAll;
@@ -308,7 +311,7 @@ index 40fca0a..abc8c70 100644
 
         /* On unregistered RHEL systems we need some heuristics: If the "main" OS repos (which provide coreutils) require
          * a subscription, then point this out and don't show available updates, even if there are some auxiliary
-@@ -1399,12 +1587,8 @@ class OsUpdates extends React.Component {
+@@ -1483,12 +1672,8 @@ class OsUpdates extends React.Component {
             const num_kpatches = count_kpatch_updates(this.state.updates);
             const highest_severity = find_highest_severity(this.state.updates);
 
@@ -323,7 +326,7 @@ index 40fca0a..abc8c70 100644
 
             if (num_security_updates > 0 && num_updates > num_security_updates) {
                 applySecurity = (
-@@ -1445,6 +1629,8 @@ class OsUpdates extends React.Component {
+@@ -1529,6 +1714,8 @@ class OsUpdates extends React.Component {
                             <CardsPage handleRefresh={this.handleRefresh}
                                        applySecurity={applySecurity}
                                        applyAll={applyAll}
@@ -332,9 +335,9 @@ index 40fca0a..abc8c70 100644
                                        applyKpatches={applyKpatches}
                                        highestSeverity={highest_severity}
                                        onValueChanged={this.onValueChanged}
-@@ -1642,5 +1828,9 @@ document.addEventListener("DOMContentLoaded", async () => {
-     }
- 
+@@ -1717,5 +1904,9 @@ document.addEventListener("DOMContentLoaded", () => {
+     document.title = cockpit.gettext(document.title);
+     init();
     const root = createRoot(document.getElementById('app'));
 -    root.render(<OsUpdates />);
 +    root.render(
@@ -344,10 +347,10 @@ index 40fca0a..abc8c70 100644
 +    );
 });
 diff --git a/pkg/packagekit/updates.scss b/pkg/packagekit/updates.scss
-index 174d6fd..82979ff 100644
+index 05494fe85..6b2c80035 100644
 --- a/pkg/packagekit/updates.scss
 +++ b/pkg/packagekit/updates.scss
-@@ -71,7 +71,7 @@
+@@ -68,7 +68,7 @@
     }
 
     &, p {
@@ -356,7 +359,7 @@ index 174d6fd..82979ff 100644
       margin-block-end: 0;  // counter-act <Markdown>
       overflow: hidden;
       text-overflow: ellipsis;
-@@ -280,3 +280,7 @@ table.header-buttons {
+@@ -272,3 +272,7 @@ table.header-buttons {
 .ct-info-circle {
   color: var(--pf-t--global--icon--color--status--info--default);
 }
@@ -364,3 +367,7 @@ index 174d6fd..82979ff 100644
 +td.select-update {
 +  min-width: 8vw;
 +}
+\ No newline at end of file
+-- 
+2.49.0
+
--- a/remove_rh_links.patch
+++ b/remove_rh_links.patch
@@ -1,16 +1,7 @@
 diff --git a/pkg/networkmanager/bond.jsx b/pkg/networkmanager/bond.jsx
-index f56f02961..cae872b00 100644
+index b54b1db..062cd1d 100644
 --- a/pkg/networkmanager/bond.jsx
 +++ b/pkg/networkmanager/bond.jsx
-@@ -24,7 +24,7 @@ import { FormGroup } from "@patternfly/react-core/dist/esm/components/Form/index
- import { FormSelect, FormSelectOption } from "@patternfly/react-core/dist/esm/components/FormSelect/index.js";
- import { Popover } from "@patternfly/react-core/dist/esm/components/Popover/index.js";
- import { TextInput } from "@patternfly/react-core/dist/esm/components/TextInput/index.js";
-import { ExternalLinkSquareAltIcon, HelpIcon } from '@patternfly/react-icons';
-+import { HelpIcon } from '@patternfly/react-icons';
- 
- import { MacMenu, MemberInterfaceChoices, NetworkModal, Name, dialogSave } from './dialogs-common.jsx';
- import { ModelContext } from './model-context.jsx';
@@ -151,16 +151,6 @@ export const BondDialog = ({ connection, dev, settings }) => {
                                       {_("A network bond combines multiple network interfaces into one logical interface with higher throughput or redundancy.")}
                                   </div>
@@ -26,10 +17,10 @@ index f56f02961..cae872b00 100644
 -                                  </Button>
 -                              }
                           >
-                               <Button icon={<HelpIcon />} id="bond-help-popup-button" variant="plain" aria-label="Help" />
-                           </Popover>
+                               <Button id="bond-help-popup-button" variant="plain" aria-label="Help">
+                                   <HelpIcon />
 diff --git a/pkg/systemd/hwinfo.jsx b/pkg/systemd/hwinfo.jsx
-index d301f60a6..886bc6b0e 100644
+index d2d2d9b..af0bedc 100644
 --- a/pkg/systemd/hwinfo.jsx
 +++ b/pkg/systemd/hwinfo.jsx
@@ -205,11 +205,6 @@ const CPUSecurityMitigationsDialog = () => {
@@ -45,7 +36,7 @@ index d301f60a6..886bc6b0e 100644
                             </DataListCell>,
                         ]}
 diff --git a/pkg/systemd/overview-cards/cryptoPolicies.jsx b/pkg/systemd/overview-cards/cryptoPolicies.jsx
-index 6ee533993..aeb31ba16 100644
+index fa57de9..d4dd3be 100644
 --- a/pkg/systemd/overview-cards/cryptoPolicies.jsx
 +++ b/pkg/systemd/overview-cards/cryptoPolicies.jsx
@@ -143,7 +143,7 @@ const CryptoPolicyDialog = ({
@@ -72,13 +63,13 @@ index 6ee533993..aeb31ba16 100644
 -                </Button>
 -            }
         >
-             <Button icon={<HelpIcon />} variant="plain" aria-label={_("Help")} />
-         </Popover>
+             <Button variant="plain" aria-label={_("Help")}>
+                 <HelpIcon />
 diff --git a/pkg/systemd/overview-cards/tuned-dialog.jsx b/pkg/systemd/overview-cards/tuned-dialog.jsx
-index b67631b7d..b36ad88e3 100644
+index 38420ca..cd7e2a3 100644
 --- a/pkg/systemd/overview-cards/tuned-dialog.jsx
 +++ b/pkg/systemd/overview-cards/tuned-dialog.jsx
-@@ -278,38 +278,13 @@ const TunedDialog = ({
+@@ -278,36 +278,10 @@ const TunedDialog = ({
         };
     }, [tunedService]);
 
@@ -101,7 +92,9 @@ index b67631b7d..b36ad88e3 100644
 -                </Button>
 -            }
 -        >
-            <Button icon={<HelpIcon />} variant="plain" aria-label={_("Help")} />
+-            <Button variant="plain" aria-label={_("Help")}>
+-                <HelpIcon />
+-            </Button>
 -        </Popover>
 -    );
 -
@@ -109,12 +102,7 @@ index b67631b7d..b36ad88e3 100644
         <Modal position="top" variant="medium"
                className="ct-m-stretch-body"
                isOpen
+-               help={help}
                onClose={() => dialogResult.resolve()}
-         >
-            <ModalHeader title={_("Change performance profile")}
-                help={help}
-            />
-+            <ModalHeader title={_("Change performance profile")} />
-             <ModalBody>
-                 {error && <ModalError dialogError={typeof error == 'string' ? error : error.message} />}
-                 {loading && <EmptyStatePanel loading />}
+                title={_("Change performance profile")}
+                footer={
--- a/update_version.sh
+++ b/update_version.sh
@@ -4,19 +4,11 @@ set -e

 curVersion=$(grep Version: cockpit.spec | sed -e 's,^\(\s*Version:\s*\)\(.*\)\s*$,\2,')

-if [[ ! "$curVersion" =~ ^[0-9]+(.[0-9]+)?$ ]]; then
+if [[ ! "$curVersion" =~ ^[0-9]+$ ]]; then
  echo "Error: curVersion is not a valid integer"
  exit 1
 fi

-if [[ "$curVersion" =~ '.' ]]; then
-    curMajor=$(echo ${curVersion} | cut -d'.' -f1)
-    curMinor=$(echo ${curVersion} | cut -d'.' -f2)
-else
-    curMajor=$curVersion
-    curMinor='0'
-fi
-
 ###
 ### Fetch latest soruces
 ###
@@ -39,23 +31,10 @@ fi

 newVersion=$(git -C cockpit tag | grep '^[0-9.]\+$' | sort -rn | head -1)

-if [[ ! "$newVersion" =~ ^[0-9]+(.[0-9]+)?$ ]]; then
-  echo "Error: newVersion cannot be determined"
-  exit 1
-fi
+echo "Current version: $curVersion"
+echo "    New version: $newVersion"

-if [[ "$newVersion" =~ '.' ]]; then
-    newMajor=$(echo ${newVersion} | cut -d'.' -f1)
-    newMinor=$(echo ${newVersion} | cut -d'.' -f2)
-else
-    newMajor=$newVersion
-    newMinor='0'
-fi
-
-if [ "$curMajor" -gt "$newMajor" ]; then
-	echo "Nothing to do."
-	exit 0
-elif [[ "$curMajor" -eq "$newMajor"  && "$curMinor" -ge "$newMinor" ]]; then
+if [ "$curVersion" -ge "$newVersion" ]; then
 	echo "Nothing to do."
 	exit 0
 fi
@@ -63,19 +42,15 @@ fi
 ###
 ### UPDATE
 ###
+# # initialize all submodules
 git -C cockpit checkout $newVersion
-pushd $PWD
-cd cockpit
-npm install --include optional
-rm -rf node_modules
-popd
-cp "cockpit/package-lock.json" .
+git -C cockpit submodule update --init --depth 1
+diff cockpit/node_modules/.package.json cockpit/package.json
+cp cockpit/node_modules/.package-lock.json package-lock.json
+
 # update node_modules
 osc service mr
-rm --verbose *.tgz || true

-# # initialize all submodules
-git -C cockpit submodule update --init --depth 1
 # remove node_modules and tests
 git -C cockpit submodule deinit node_modules test/reference

@@ -107,7 +82,7 @@ echo "Archive created: cockpit-$newVersion.tar"
 git -C cockpit remote show suse || git -C cockpit remote add suse git@github.com:openSUSE/cockpit.git
 git -C cockpit fetch suse opensuse-$curVersion
 git -C cockpit checkout -b opensuse-$newVersion suse/opensuse-$curVersion
-git -C cockpit rebase -i $newVersion || true
+git -C cockpit rebase -i $newVersion

 echo "Don't forget to:"
 echo "  1. finish rebase"
@@ -117,5 +92,4 @@ echo "  4. set new default branch on GitHub"

 # Updating version in spec file
 sed -i -e "s,^\(\s*Version:\s*\)\(.*\)\s*$,\1${newVersion}," cockpit/tools/cockpit.spec
-git rm cockpit-$curVersion.tar.gz
-git add cockpit-$newVersion.tar.gz
+