Allow cockpit through the firewall on install

2025-07-10 11:21:42 +01:00
20 changed files with 1986 additions and 1941 deletions
--- a/0001-cockpit-overview-support-SUSE_SUPPORT_PRODUCT-keys.patch
+++ b/0001-cockpit-overview-support-SUSE_SUPPORT_PRODUCT-keys.patch
@@ -1,69 +0,0 @@
-From ec3a1efce07770b7641e07d41a73732967c65175 Mon Sep 17 00:00:00 2001
-From: Luna D Dragon <luna.dragon@suse.com>
-Date: Tue, 8 Jul 2025 14:58:03 +0530
-Subject: [PATCH 1/3] cockpit overview: support SUSE_SUPPORT_PRODUCT keys
-
-SLE Micro 6.2(and Framework one components) have custom os-release keys namely in SUSE_SUPPORT_PRODUCT and
-SUSE_SUPPORT_PRODUCT_VERSION instead of the standard os prettyname which
-results in systemd not being able to determine the os name correctly.
-This patch should be dropped when systemd is fixed
---
- pkg/systemd/overview.jsx | 10 ++++++++--
- 1 file changed, 8 insertions(+), 2 deletions(-)
-
-diff --git a/pkg/systemd/overview.jsx b/pkg/systemd/overview.jsx
-index 868469d68..186fcf59e 100644
--- a/pkg/systemd/overview.jsx
-+++ b/pkg/systemd/overview.jsx
-@@ -42,6 +42,7 @@ import { ShutdownModal } from 'cockpit-components-shutdown.jsx';
- import { WithDialogs, DialogsContext } from "dialogs.jsx";
- 
- import "./overview.scss";
-+import { read_os_release } from "os-release.js";
- 
- const _ = cockpit.gettext;
- 
-@@ -98,6 +99,7 @@ class OverviewPage extends React.Component {
-         this.hostname_proxy.addEventListener("changed", data => {
-             this.setState({ hostnameData: data.detail });
-         });
-+        read_os_release().then(os_release => this.setState({ os_release }));
-     }
- 
-     render() {
-@@ -160,8 +162,12 @@ class OverviewPage extends React.Component {
-                             {this.hostname_text()}
-                         </h1>
-                         {this.state.hostnameData &&
-                         this.state.hostnameData.OperatingSystemPrettyName &&
-                         <div className="ct-overview-header-subheading" id="system_information_os_text">{cockpit.format(_("running $0"), this.state.hostnameData.OperatingSystemPrettyName)}</div>}
-+                         this.state.hostnameData.OperatingSystemPrettyName && (
-+                            <div className="ct-overview-header-subheading" id="system_information_os_text">
-+                                {(this.state.os_release && this.state.os_release.SUSE_PRETTY_NAME)
-+                                    ? cockpit.format(_("running $0"), this.state.os_release.SUSE_PRETTY_NAME)
-+                                    : cockpit.format(_("running $0"), this.state.hostnameData.OperatingSystemPrettyName)}
-+                            </div>)}
-                     </div>
-                     <div className='ct-overview-header-actions'>
-                         { show_superuser && <SuperuserIndicator proxy={this.superuser} /> }
-diff --git a/src/common/cockpitsystem.c b/src/common/cockpitsystem.c
-index 83e2965f7..73716fff7 100644
--- a/src/common/cockpitsystem.c
-+++ b/src/common/cockpitsystem.c
-@@ -107,6 +107,12 @@ cockpit_system_load_os_release (void)
-         }
-     }
- 
-+  gchar *value = g_hash_table_lookup (result, "SUSE_PRETTY_NAME");
-+  if (!value || strlen(value) == 0) {
-+    value = g_hash_table_lookup (result, "PRETTY_NAME");
-+    g_hash_table_replace (result, g_strdup ("SUSE_PRETTY_NAME"), g_strdup (value));
-+  }
-+
-  out:
-   g_clear_error (&error);
-   g_free (lines);
-
-- 
-2.50.0
-
--- a/0001-selinux-allow-login-to-read-motd-file.patch
+++ b/0001-selinux-allow-login-to-read-motd-file.patch
@@ -7,11 +7,11 @@ Date:   Fri Aug 6 15:11:23 2021 +0200
 Index: cockpit/selinux/cockpit.te
 ===================================================================
 diff --git a/selinux/cockpit.te b/selinux/cockpit.te
-index 931cbd775..4a439c8d5 100644
+index 50695ee..55b1226 100644
 --- a/selinux/cockpit.te
 +++ b/selinux/cockpit.te
-@@ -232,6 +232,14 @@ optional_policy(`
-     allow cockpit_session_t pidfs_t:filesystem getattr;
+@@ -224,6 +224,14 @@ optional_policy(`
+     gnome_exec_keyringd(cockpit_session_t)
 ')
 
 +# login may read motd file through pam
--- a/0002-cockpit-kdump-support-SLE-micro-6.2.patch
+++ b/0002-cockpit-kdump-support-SLE-micro-6.2.patch
@@ -1,37 +0,0 @@
-From 14b86b6d60b009c4294f06589a561e688ba49223 Mon Sep 17 00:00:00 2001
-From: Luna D Dragon <luna.dragon@suse.com>
-Date: Tue, 8 Jul 2025 14:58:25 +0530
-Subject: [PATCH 2/3] cockpit-kdump support SLE micro 6.2
-
-SLE micro 6.2 no longer has MicroOS in the NAME. This updates it to
-check if the VARIANT_ID is transactional to use transactional-update
-over manually enabling kdump.
---
- pkg/kdump/kdump-view.jsx | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/pkg/kdump/kdump-view.jsx b/pkg/kdump/kdump-view.jsx
-index eee4d16b1..7d8439f2b 100644
--- a/pkg/kdump/kdump-view.jsx
-+++ b/pkg/kdump/kdump-view.jsx
-@@ -421,7 +421,7 @@ export class KdumpPage extends React.Component {
- kdumpctl reset-crashkernel`;
-         }
-         let shell;
-        if (this.state.os_release.NAME?.includes('MicroOS')) {
-+        if (this.state.os_release.NAME?.includes('MicroOS') || this.state.os_release.VARIANT_ID?.includes("transactional")) {
-             enableCrashKernel = `
- # A reboot will be required if crashkernel was not set before
- transactional-update setup-kdump`;
-@@ -443,7 +443,7 @@ ${enableCrashKernel}
- 
-         Dialogs.show(
-             <ModificationsExportDialog
-              ansible={ this.state.os_release.NAME?.includes('MicroOS') ? null : exportAnsibleTask(this.props.kdumpStatus.config, this.state.os_release)}
-+              ansible={ (this.state.os_release.NAME?.includes('MicroOS') || this.state.os_release.VARIANT_ID?.includes("transactional")) ? null : exportAnsibleTask(this.props.kdumpStatus.config, this.state.os_release)}
-               shell={shell}
-               onClose={Dialogs.close}
-             />);
-- 
-2.50.0
-
--- a/0003-branding-use-SUSE_SUPPORT_PRODUCT-and-SUSE_SUPPORT_P.patch
+++ b/0003-branding-use-SUSE_SUPPORT_PRODUCT-and-SUSE_SUPPORT_P.patch
@@ -1,136 +0,0 @@
-From cfc476e5127ee3f21b70124e77ded9627e9692b5 Mon Sep 17 00:00:00 2001
-From: Luna D Dragon <luna.dragon@suse.com>
-Date: Tue, 8 Jul 2025 15:09:09 +0530
-Subject: [PATCH 3/3] branding: use SUSE_SUPPORT_PRODUCT and
- SUSE_SUPPORT_PRODUCT_VERSION
-
---
- Makefile.am                    |  1 +
- src/branding/suse/Makefile.am  | 11 +++++
- src/branding/suse/branding.css | 82 ++++++++++++++++++++++++++++++++++
- 3 files changed, 94 insertions(+)
- create mode 100644 src/branding/suse/Makefile.am
- create mode 100644 src/branding/suse/branding.css
-
-diff --git a/Makefile.am b/Makefile.am
-index 83f1ee7a7..1198d191e 100644
--- a/Makefile.am
-+++ b/Makefile.am
-@@ -167,6 +167,7 @@ include src/branding/debian/Makefile.am
- include src/branding/default/Makefile.am
- include src/branding/fedora/Makefile.am
- include src/branding/opensuse/Makefile.am
-+include src/branding/suse/Makefile.am
- include src/branding/rhel/Makefile.am
- include src/branding/ubuntu/Makefile.am
- include src/client/Makefile.am
-diff --git a/src/branding/suse/Makefile.am b/src/branding/suse/Makefile.am
-new file mode 100644
-index 000000000..4a1e7ab72
--- /dev/null
-+++ b/src/branding/suse/Makefile.am
-@@ -0,0 +1,11 @@
-+slemicrobrandingdir = $(datadir)/cockpit/branding/suse
-+
-+dist_slemicrobranding_DATA = \
-+    src/branding/suse/branding.css \
-+	$(NULL)
-+
-+install-data-hook::
-+	ln -sf /usr/share/wallpapers/SLEdefault/contents/images/1920x1200.png $(DESTDIR)$(slemicrobrandingdir)/default-1920x1200.png
-+	ln -sf /usr/share/pixmaps/distribution-logos/square-hicolor.svg $(DESTDIR)$(slemicrobrandingdir)/square-hicolor.svg
-+	ln -sf /usr/share/pixmaps/distribution-logos/favicon.ico $(DESTDIR)$(slemicrobrandingdir)/favicon.ico
-+	ln -sf /usr/share/pixmaps/distribution-logos/apple-touch-icon.png $(DESTDIR)$(slemicrobrandingdir)/apple-touch-icon.png
-\ No newline at end of file
-diff --git a/src/branding/suse/branding.css b/src/branding/suse/branding.css
-new file mode 100644
-index 000000000..c1617abc2
--- /dev/null
-+++ b/src/branding/suse/branding.css
-@@ -0,0 +1,82 @@
-+/* Extra overrides */
-+:root {
-+    --eos-bc-green-500: #30ba78;
-+    --eos-bc-pine-500: #0c322c;
-+    --eos-bc-gray-50: #F2F2F2;
-+    --eos-bc-white: #ffffff;
-+    --eos-bc-text: #333;
-+}
-+
-+
-+#brand:before {
-+    content: "${SUSE_PRETTY_NAME}";
-+}
-+
-+#option-group svg polygon {
-+    fill: var(--eos-bc-text);
-+}
-+
-+/* Nav & sidebar overwrites */
-+.navbar-pf {
-+    background: var(--eos-bc-pine-500);
-+}
-+
-+.navbar-pf-vertical {
-+    border-top: none;
-+}
-+
-+
-+/* Default overrides */
-+
-+.login-note {
-+    display: none;
-+    position: relative;
-+}
-+
-+body.login-pf {
-+    background-color: var(--eos-bc-pine-500);
-+}
-+
-+/* Only use background image on desktops */
-+@media(min-width: 1024px) {
-+    body.login-pf {
-+        background-image: url("default-1920x1200.png") !important;
-+        background-repeat: no-repeat;
-+        background-position: 100% 0 !important;
-+        background-size: cover;
-+    }
-+}
-+
-+/* Hide badge on desktops (already included in background) */
-+@media(max-width: 1023px) {
-+    #badge {
-+        width: 51px;
-+        height: 45px;
-+        background-image: url("square-hicolor.svg");
-+        background-repeat: no-repeat;
-+    }
-+}
-+
-+#brand {
-+    width: auto;
-+    height: auto;
-+    background-image: none;
-+    background-repeat: no-repeat;
-+    font-size: 2em;
-+    white-space: nowrap;
-+}
-+
-+/* Switch to small font faster to not clip long name */
-+@media(max-width: 560px) {
-+    #brand {
-+        font-size: inherit;
-+    }
-+}
-+
-+#index-brand {
-+    font-weight: bold;
-+}
-+
-+#index-brand:before {
-+    content: "${PRETTY_NAME}";
-+}
-\ No newline at end of file
-- 
-2.50.0
-
--- a/0009-packagekit-reboot-notification.patch
+++ b/0009-packagekit-reboot-notification.patch
@@ -1,116 +0,0 @@
-diff --git a/pkg/packagekit/updates.jsx b/pkg/packagekit/updates.jsx
-index ce4b3c4cc6d1..b423ee4c09bd 100644
--- a/pkg/packagekit/updates.jsx
-+++ b/pkg/packagekit/updates.jsx
-@@ -21,6 +21,7 @@ import 'polyfills'; // once per application
- import 'cockpit-dark-theme'; // once per page
- 
- import cockpit from "cockpit";
-+import { fsinfo } from 'cockpit/fsinfo';
- import React from "react";
- import { createRoot } from 'react-dom/client';
- 
-@@ -1079,12 +1080,19 @@ class OsUpdates extends React.Component {
-                     debug("tracer parsed restartPackages:", JSON.stringify(restartPackages));
-                     this.setState({ checkRestartAvailable: true, checkRestartRunning: false, restartPackages });
-                 })
-                .catch((exception, data) => {
-+                .catch(async (exception, data) => {
-                     // tracer not installed or supported (like on Arch)? then fall back to dnf needs-restarting
-                     if (exception.message?.includes("ModuleNotFoundError") ||
-                         exception.message?.includes("UnsupportedDistribution")) {
-                        debug('tracer not installed:', JSON.stringify(exception), "trying dnf needs-restarting");
-                        return this.checkDnfNeedsRestarting();
-+                        try {
-+                            // if there's a history for zypper, we can assume the system uses it
-+                            await fsinfo("/var/log/zypp/history", [], { superuser: "require" });
-+                            debug('tracer not installed:', JSON.stringify(exception), "trying zypper ps");
-+                            return this.checkZypperNeedsRestarting();
-+                        } catch {
-+                            debug('tracer not installed:', JSON.stringify(exception), "trying dnf needs-restarting");
-+                            return this.checkDnfNeedsRestarting();
-+                        }
-                     }
- 
-                     // log the error except for some common cases: polkit does not allow it
-@@ -1106,6 +1114,80 @@ class OsUpdates extends React.Component {
-                 });
-     }
- 
-+    checkZypperNeedsRestarting() {
-+        const restartPackages = { reboot: [], daemons: [], manual: [] };
-+        return cockpit.spawn(["zypper", "ps", "-ss", "--print", "%s"], { err: "message", superuser: "require" })
-+                .then((serviceOut) => {
-+                    debug("zypper ps -ss succeeded:", serviceOut);
-+
-+                    // set all the services to be manually restarted since it's
-+                    // not always clear if it's safe to restart them via cockpit
-+                    const data = serviceOut.trim();
-+                    if (data.length !== 0) {
-+                        serviceOut.trim()
-+                                .split("\n")
-+                                .forEach(line => restartPackages.manual.push(line));
-+                    }
-+
-+                    // Check if any kernels are updated since system boot,
-+                    // ignoring kernel-firmware updates as they can make things noisy
-+                    //
-+                    // /var/log/zypper.log can be quite big so it's better to
-+                    // handle the processing on machine instead of fetching the data
-+                    const kScript = `
-+                          stat -c %z /proc/ | \\
-+                          cut -d. -f 1 | \\
-+                          xargs -i \\
-+                          awk -F'|' -v boot="{}" \\
-+                          '/install\\|kernel/{if (boot <= $1 && index($0, "firmware") == 0) {print $3"-"$4"."$5}}' \\
-+                          /var/log/zypp/history
-+                          `;
-+
-+                    cockpit.script(kScript, undefined, { err: "message", superuser: "require" })
-+                            .then(kernels => {
-+                                debug("zypper kernel scripts succeeded:", kernels);
-+
-+                                if (kernels.trim().length == 0) {
-+                                    return;
-+                                }
-+
-+                                kernels.trim()
-+                                        .split("\n")
-+                                        .forEach(line => { restartPackages.reboot.push(line.trim()) });
-+                            })
-+                            .catch(ex => {
-+                                if (ex.problem !== "not-found" &&
-+                                // polkit does not allow it
-+                                ex.problem !== "access-denied" &&
-+                                // or unprivileged session
-+                                ex.problem !== "authentication-failed" &&
-+                                // or the session goes away while checking
-+                                ex.problem !== "terminated")
-+                                    console.error("zypper kernel fetching failed:", ex.toString());
-+                            })
-+                            .then(() => {
-+                                let checkRestartAvailable = false;
-+                                if (restartPackages.reboot.length !== 0 || restartPackages.manual.length !== 0)
-+                                    checkRestartAvailable = true;
-+
-+                                this.setState({ checkRestartAvailable, checkRestartRunning: false, restartPackages });
-+                            });
-+                }).catch((ex) => {
-+                    // log the error except for some common cases: no zypper
-+                    if (ex.problem !== "not-found" &&
-+                    // polkit does not allow it
-+                    ex.problem !== "access-denied" &&
-+                    // or unprivileged session
-+                    ex.problem !== "authentication-failed" &&
-+                    // or the session goes away while checking
-+                    ex.problem !== "terminated")
-+                        console.error("zypper ps -ss failed:", ex);
-+
-+                    // act like it's not available (demand reboot after every update)
-+                    this.setState({ checkRestartAvailable: false, checkRestartRunning: false, restartPackages });
-+                });
-+    }
-+
-     checkDnfNeedsRestarting() {
-         const restartPackages = { reboot: [], daemons: [], manual: [] };
- 
--- a/2
+++ b/2
@@ -23,7 +23,7 @@ if [ $? -eq 0 ]; then
 fi

 if [ -f /etc/nsswitch.conf ]; then
-    grep -Eq "passwd:.*systemd" /etc/nsswitch.conf
+    grep -Exq "passwd:.*?compat systemd" /etc/nsswitch.conf
    if [ $? -ne 0 ]; then
        echo "/etc/nsswitch.conf is out of date, please update it from /usr/etc/nsswitch.conf to use cockpit"
        failed=true
--- a/cockpit-340.tar.gz
+++ b/cockpit-340.tar.gz
--- a/cockpit-349.tar.gz
+++ b/cockpit-349.tar.gz
--- a/cockpit-suse-theme.tar
+++ b/cockpit-suse-theme.tar
--- a/cockpit.changes
+++ b/cockpit.changes
@@ -1,105 +1,7 @@
 -------------------------------------------------------------------
-Fri Oct 17 09:44:51 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
+Thu Jul 10 07:18:57 UTC 2025 - Alice Brooks <alice.brooks@suse.com>

- Update to 349
-  * Changes since 346
-    - 349
-      * Package manifests: add any test
-      * Bug fixes and translation updates
-    - 348
-      * Bug fixes and translation updates
-    - 347
-      * Site-specific branding support
-
-------------------------------------------------------------------
-Tue Sep 23 09:11:48 UTC 2025 - Luna D Dragon <luna.dragon@suse.com>
-
- add requirement on python3-pcp if pcp is installed bsc#1239759  
-
-------------------------------------------------------------------
-Thu Sep 18 07:40:59 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
-
- Rewrite hide-pcp.patch to apply to SLFO based versions of micro
-
-------------------------------------------------------------------
-Mon Sep  8 11:25:24 UTC 2025 - Miika Alikirri <miika.alikirri@suse.com>
-
- Update to 346
-  * Changes since 344
-    - 346
-      * Support branding Cockpit pages
-      * Storage: Support for Stratis "V2" pools
-    - 345
-      * Translation and dependency updates
-      * Shorter IPv6 addresses
-      * IPv6 addresses for WireGuard
-
-------------------------------------------------------------------
-Thu Aug 14 04:53:41 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
-
- Update to 344
-  * Changes since 340
-    - 344
-      * Bug fixes and translation updates
-    - 343
-      * login: Improve error message for unsupported shells
-      * cockpit: Handle file access issues with files in machines.d
-      * Translation updates
-    - 342
-      * systemd: ensure update() is called at least once for tuned-dialog
-      * Translation updates
-    - 341
-      * services: show link to podman page for quadlets
-      * Bug fixes and translation updates
- Remove kdump-nfs-fixes.patch as this was upstreamed
- Fix not falling back to PRETTY_NAME in SUSE_PRETTY_NAME patches bsc#1248446
-
-------------------------------------------------------------------
-Wed Jul 30 03:21:48 UTC 2025 - Luna D Dragon <luna.dragon@suse.com>
-
- drop duplicate %changelog macro
-
-------------------------------------------------------------------
-Wed Jul 23 12:53:37 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
-
- Add %postun for firewalld package to ensure the firewall state
-  remains as expected
-
-------------------------------------------------------------------
-Mon Jul 21 11:39:56 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
-
- Add cockpit-firewalld package for easily configuring the users
-  firewall jsc#PED-13228
-
-------------------------------------------------------------------
-Tue Jul 15 07:00:10 UTC 2025 - Luna D Dragon <luna.dragon@suse.com>
-
- add 0001-cockpit-overview-support-SUSE_SUPPORT_PRODUCT-keys.patch
- add 0002-cockpit-kdump-support-SLE-micro-6.2.patch
- add 0003-branding-use-SUSE_SUPPORT_PRODUCT-and-SUSE_SUPPORT_P.patch to fix bsc#1241003 
-
-------------------------------------------------------------------
-Mon Jul 14 08:04:06 UTC 2025 - Luna D Dragon <luna.dragon@suse.com>
-
- update check_cockpit_users to only check for systemd support in /etc/nsswitch.conf bsc#1246408
-
-------------------------------------------------------------------
-Fri Jul 11 07:13:59 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
-
- add a requirement on /usr/sbin/kdumptool for cockpit-kdump (bsc#1227402)
-
-------------------------------------------------------------------
-Fri Jul 11 06:50:17 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
-
- add libzypp-plugin-appdata dependency to cockpit-packagekit as
-  this will generate the swcatalog which it depends on for calculating
-  various cockpit packages
-
-------------------------------------------------------------------
-Thu Jul 10 10:10:21 UTC 2025 - Miika Alikirri <miika.alikirri@suse.com>
-
- Show reboot nofication after updates in packagekit
-  * Add 0009-packagekit-reboot-notification.patch
+- Allow Cockpit through the filewall by default

 -------------------------------------------------------------------
 Thu Jun 19 08:30:49 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
--- a/cockpit.pam
+++ b/cockpit.pam
@@ -0,0 +1,11 @@
+#%PAM-1.0
+auth substack common-auth
+# List of users to deny access to Cockpit, by default root is included.
+auth    required pam_listfile.so item=user sense=deny file=/etc/cockpit/disallowed-users onerr=succeed
+account required pam_nologin.so
+account include common-account
+password include common-password
+session required pam_loginuid.so
+session optional pam_keyinit.so force revoke
+session include common-session
+auth [user_unknown=ignore success=ok] pam_oath.so usersfile=${HOME}/.pam_oath_usersfile no_usersfile_okay window=20 digits=6
--- a/cockpit.spec
+++ b/cockpit.spec
@@ -38,14 +38,6 @@

 %define __lib lib

-%if 0%{?suse_version} > 1500
-%define pamconfdir %{_pam_vendordir}
-%define pamconfig tools/cockpit.suse.pam
-%else
-%define pamconfdir %{_sysconfdir}/pam.d
-%define pamconfig tools/cockpit.pam
-%endif
-
 %if %{defined _pamdir}
 %define pamdir %{_pamdir}
 %else
@@ -58,9 +50,10 @@ Summary:        Web Console for Linux servers
 License:        LGPL-2.1-or-later
 URL:            https://cockpit-project.org/

-Version:        349
+Version:        340
 Release:        0
 Source0:        cockpit-%{version}.tar.gz
+Source1:        cockpit.pam
 Source2:        cockpit-rpmlintrc
 Source3:        cockpit-suse-theme.tar
 Source4:        cockpit-no-pamoath.pam
@@ -75,6 +68,7 @@ Patch2:         suse_docs.patch
 Patch3:         suse-microos-branding.patch
 Patch4:         css-overrides.patch
 Patch5:         storage-btrfs.patch
+Patch6:         kdump-nfs-fixes.patch
 # SLE Micro specific patches
 Patch101:       hide-pcp.patch
 Patch102:       0002-selinux-temporary-remove-setroubleshoot-section.patch
@@ -87,10 +81,6 @@ Patch105:       fix-libexecdir.patch
 Patch106:       packagekit-single-install.patch
 Patch109:       0008-pybridge-endian-flag.patch
 Patch110:       add_preexec_cockpit.patch
-Patch111:       0001-cockpit-overview-support-SUSE_SUPPORT_PRODUCT-keys.patch
-Patch112:       0002-cockpit-kdump-support-SLE-micro-6.2.patch
-Patch113:       0003-branding-use-SUSE_SUPPORT_PRODUCT-and-SUSE_SUPPORT_P.patch
-Patch114:       0009-packagekit-reboot-notification.patch
 Patch201:       remove_rh_links.patch

 %define build_all 1
@@ -179,6 +169,7 @@ BuildRequires: xmlto

 %if 0%{?with_selinux}
 BuildRequires:  selinux-policy
+BuildRequires:  selinux-policy-%{selinuxtype}
 BuildRequires:  selinux-policy-devel
 %endif

@@ -197,10 +188,7 @@ Requires: cockpit-system
 # Optional components
 Recommends: (cockpit-storaged if udisks2)
 Recommends: (cockpit-packagekit if (dnf or zypper))
-%if 0%{?suse_version} == 0
-Recommends: (dnf5-daemonserver if dnf5)
-%endif
-Recommends: (cockpit-firewalld if firewalld)
+Suggests: python3-pcp

 %if 0%{?rhel} == 0
 Recommends: (cockpit-networkmanager if NetworkManager)
@@ -209,7 +197,7 @@ Recommends: (cockpit-ostree if rpm-ostree)
 Suggests: cockpit-selinux
 %endif
 %if 0%{?rhel} && 0%{?centos} == 0
-Recommends: subscription-manager-cockpit
+Requires: subscription-manager-cockpit
 %endif

 BuildRequires:  python3-devel
@@ -225,23 +213,18 @@ BuildRequires:  python3-pytest-timeout
 %setup -q -n cockpit-%{version} -a 3
 %patch -P 1 -p1
 %patch -P 2 -p1
-
-%if 0%{?is_opensuse} || 0%{?suse_version} < 1600
 %patch -P 3 -p1
-%else
-%patch -P  113 -p1
-%endif
-
 %patch -P 4 -p1
 %patch -P 5 -p1
+%patch -P 6 -p1

-%patch -P 101 -p1
 %patch -P 106 -p1
 %patch -P 109 -p1
-%patch -P 114 -p1

 # SLE Micro specific patches
 %if 0%{?is_smo}
+%patch -P 101 -p1
+%patch -P 107 -p1
 # Patches for versions lower then SLE Micro 5.5
 %if 0%{?sle_version} < 150500
 %patch -P 102 -p1
@@ -259,18 +242,15 @@ BuildRequires:  python3-pytest-timeout

 %if 0%{?suse_version} >= 1600
 %patch -P 110 -p1
-%if !0%{?is_opensuse}
-%patch -P  111 -p1
-%patch -P  112 -p1
-%endif
 %endif

 %patch -P 201 -p1

-# If we're not using cockpit.suse.pam
-# Then we should always use source4's pam
+%if 0%{?suse_version} > 1500
+cp %SOURCE1 tools/cockpit.pam
+%else
 cp %SOURCE4 tools/cockpit.pam
-
+%endif
 #
 local-npm-registry %{_sourcedir} install --include=dev --ignore-scripts
 touch package-lock.json
@@ -306,19 +286,20 @@ bzip2 -9 cockpit.pp
 make -j$(nproc) check

 %if 0%{?rhel} == 0 && 0%{?suse_version} == 0
-export NO_QUNIT=1
-%pytest
+%tox
 %endif

 %install
-%if 0%{?suse_version}
-export NO_BRP_STALE_LINK_ERROR="yes"
-%endif
 # In obs we get  write error: stdout
 %make_install | tee make_install.log
 make install-tests DESTDIR=%{buildroot}
-mkdir -p $RPM_BUILD_ROOT%{pamconfdir}
-install -p -m 644 %{pamconfig} $RPM_BUILD_ROOT%{pamconfdir}/cockpit
+%if 0%{?suse_version} > 1500
+mkdir -p $RPM_BUILD_ROOT%{_pam_vendordir}
+install -p -m 644 tools/cockpit.pam $RPM_BUILD_ROOT%{_pam_vendordir}/cockpit
+%else
+mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/pam.d
+install -p -m 644 tools/cockpit.pam $RPM_BUILD_ROOT%{_sysconfdir}/pam.d/cockpit
+%endif
 rm -f %{buildroot}/%{_libdir}/cockpit/*.so
 install -D -p -m 644 AUTHORS COPYING README.md %{buildroot}%{_docdir}/cockpit/

@@ -432,6 +413,14 @@ rm -f %{buildroot}/%{pamdir}/mock-pam-conv-mod.so
 sed -i "s|%{buildroot}||" *.list

 %if 0%{?suse_version}
+# remove brandings with stale symlinks. Means they don't match
+# the distro.
+pushd %{buildroot}/%{_datadir}/cockpit/branding
+ls --hide={default,kubernetes,opensuse,registry,suse} | xargs rm -rv
+popd
+# need this in SUSE as post build checks dislike stale symlinks
+install -m 644 -D /dev/null %{buildroot}/run/cockpit/issue
+
 test -e %{buildroot}/usr/share/cockpit/branding/opensuse/default-1920x1200.jpg  || install -m 644 -D /dev/null %{buildroot}/usr/share/cockpit/branding/opensuse/default-1920x1200.jpg
 test -e %{buildroot}/usr/share/cockpit/branding/suse/apple-touch-icon.png  || install -m 644 -D /dev/null %{buildroot}/usr/share/cockpit/branding/suse/apple-touch-icon.png
 test -e %{buildroot}/usr/share/cockpit/branding/suse/default-1920x1200.png || install -m 644 -D /dev/null %{buildroot}/usr/share/cockpit/branding/suse/default-1920x1200.png
@@ -535,7 +524,6 @@ Requires: jeos-firstboot
 Requires: /usr/bin/pwscore
 Requires: /usr/bin/date
 Requires: (sudo or polkit)
-Requires: (python3-pcp if pcp)
 Provides: cockpit-shell = %{version}-%{release}
 Provides: cockpit-systemd = %{version}-%{release}
 Provides: cockpit-tuned = %{version}-%{release}
@@ -544,9 +532,11 @@ Provides: cockpit-users = %{version}-%{release}
 Requires: NetworkManager >= 1.6
 Requires: sos
 Requires: sudo
+Recommends: PackageKit
 Recommends: setroubleshoot-server >= 3.3.3
 Recommends: kexec-tools
 Suggests: NetworkManager-team
+Suggests: python3-pcp
 Provides: cockpit-kdump = %{version}-%{release}
 Provides: cockpit-networkmanager = %{version}-%{release}
 Provides: cockpit-selinux = %{version}-%{release}
@@ -617,10 +607,13 @@ authentication via sssd/FreeIPA.
 %doc %{_mandir}/man8/pam_ssh_add.8.gz
 %dir %{_sysconfdir}/cockpit
 %config(noreplace) %{_sysconfdir}/cockpit/ws-certs.d
-# dir is not owned by pam in openSUSE needed for Leap15.6
-%dir %{pamconfdir}
+%if 0%{?suse_version} > 1500
+%{_pam_vendordir}/cockpit
+%else
+%config(noreplace) %{_sysconfdir}/pam.d/cockpit
+%endif
+# dir is not owned by pam in openSUSE
 %dir %{_sysconfdir}/motd.d
-%config(noreplace) %{pamconfdir}/cockpit
 # created in %post, so that users can rm the files
 %ghost %{_sysconfdir}/issue.d/cockpit.issue
 %ghost %{_sysconfdir}/motd.d/cockpit
@@ -691,6 +684,11 @@ if [ "$1" = 1 ]; then
    printf "# List of users which are not allowed to login to Cockpit\n" > /etc/cockpit/disallowed-users
    printf "root\n" >> /etc/cockpit/disallowed-users
    chmod 644 /etc/cockpit/disallowed-users
+
+    # Allow cockpit through the firewall
+    %if 0%{?suse_version} >= 1600
+    test -f %{_bindir}/firewall-cmd && firewall-cmd --quiet --permanent --add-service=cockpit && firewall-cmd --reload --quiet || true
+    %endif
 fi

 if [ "$1" = 2 ]; then
@@ -712,8 +710,6 @@ fi
 %endif
 %tmpfiles_create cockpit-ws.conf
 %systemd_post cockpit.socket cockpit.service
-# firewalld only partially picks up changes to its services files without this
-test -f %{_bindir}/firewall-cmd && firewall-cmd --reload --quiet || true

 # check for deprecated PAM config
 if test -f %{_sysconfdir}/pam.d/cockpit &&  grep -q pam_cockpit_cert %{_sysconfdir}/pam.d/cockpit; then
@@ -786,11 +782,7 @@ SELinux policy module for the cockpit-ws package.
 Summary: Cockpit user interface for kernel crash dumping
 Requires: cockpit-bridge >= %{required_base}
 Requires: cockpit-shell >= %{required_base}
-%if 0%{?suse_version}
-Requires: /usr/sbin/kdumptool
-%else
-Requires: /usr/bin/kdumpctl
-%endif
+Requires: kexec-tools
 BuildArch: noarch

 %description kdump
@@ -800,7 +792,6 @@ The Cockpit component for configuring kernel crash dumping.
 %license COPYING
 %{_datadir}/metainfo/org.cockpit_project.cockpit_kdump.metainfo.xml

-# sosreport is not supported on opensuse yet
 %if !0%{?suse_version}
 %package sosreport
 Summary: Cockpit user interface for diagnostic reports
@@ -839,6 +830,7 @@ The Cockpit component for managing networking.  This package uses NetworkManager
 %endif

 %if 0%{?rhel} == 0 && ( 0%{?suse_version} >= 1500 || 0%{?is_smo} )
+
 %package selinux
 Summary: Cockpit SELinux package
 Requires: cockpit-bridge >= %{required_base}
@@ -848,7 +840,7 @@ Requires:       policycoreutils-python-utils >= 3.1
 %if !0%{?suse_version}  || ( 0%{?is_smo} && 0%{?sle_version} >= 150500 ) || 0%{?suse_version} >= 1600
 Requires:       setroubleshoot-server >= 3.3.3
 %endif
-BuildArch: noarch
+BuildArch:      noarch

 %description selinux
 This package contains the Cockpit user interface integration with the
@@ -874,7 +866,7 @@ Requires: python3-dbus-python
 Recommends: udisks2-lvm2 >= 2.9
 Recommends: udisks2-iscsi >= 2.9
 %if ! 0%{?rhel}
-Recommends: (udisks2-btrfs >= 2.9 if (btrfs-progs or btrfsprogs))
+Recommends: udisks2-btrfs >= 2.9
 %endif
 Recommends: device-mapper-multipath
 Recommends: clevis-luks
@@ -909,7 +901,6 @@ Summary: Cockpit user interface for packages
 BuildArch: noarch
 Requires: cockpit-bridge >= %{required_base}
 Requires: PackageKit
-Requires: libzypp-plugin-appdata
 Recommends: python3-tracer
 # HACK: https://bugzilla.redhat.com/show_bug.cgi?id=1800468
 Requires: polkit
@@ -921,31 +912,5 @@ via PackageKit.
 %files -n cockpit-packagekit -f packagekit.list
 %license COPYING

-%package firewalld
-Summary: Allows Cockpit access through the firewall
-Requires: cockpit-bridge >= %{required_base}
-Requires: firewalld
-BuildArch: noarch
-
-%description firewalld
-This package allows Cockpit access through the firewall
-
-%files firewalld
-%license COPYING
-
-%postun firewalld
-if test -f %{_bindir}/firewall-cmd && firewall-cmd --state &>/dev/null; then
-    firewall-cmd --quiet --permanent --remove-service=cockpit && firewall-cmd --reload --quiet || true
-elif test -f %{_bindir}/firewall-offline-cmd; then
-    firewall-offline-cmd --quiet --remove-service=cockpit || true
-fi
-
-%posttrans firewalld
-if test -f %{_bindir}/firewall-cmd && firewall-cmd --state &>/dev/null; then
-    firewall-cmd --quiet --permanent --add-service=cockpit && firewall-cmd --reload --quiet || true
-elif test -f %{_bindir}/firewall-offline-cmd; then
-    firewall-offline-cmd --quiet --add-service=cockpit || true
-fi
-
 # The changelog is automatically generated and merged
 %changelog
--- a/css-overrides.patch
+++ b/css-overrides.patch
@@ -44,39 +44,39 @@ now, it fulfills the requirements of [3].
 create mode 100644 pkg/static/css-overrides.css

 diff --git a/pkg/apps/index.html b/pkg/apps/index.html
-index f8f8daa83..543cc5492 100644
+index fd17d5131..9aac50800 100644
 --- a/pkg/apps/index.html
 +++ b/pkg/apps/index.html
-@@ -24,6 +24,7 @@ along with Cockpit; If not, see <https://www.gnu.org/licenses/>.
+@@ -23,6 +23,7 @@ along with Cockpit; If not, see <https://www.gnu.org/licenses/>.
+     <title translate="yes">Applications</title>
     <meta charset="utf-8" />
     <link href="apps.css" type="text/css" rel="stylesheet" />
-     <link href="../../static/branding.css" rel="stylesheet" />
 +    <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet">
     <script type="text/javascript" src="../base1/cockpit.js"></script>
     <script type="text/javascript" src="../base1/po.js"></script>
     <script type="text/javascript" src="po.js"></script>
 diff --git a/pkg/kdump/index.html b/pkg/kdump/index.html
-index 77cf9ff38..af46a3d98 100644
+index 8138f050f..619416dd4 100644
 --- a/pkg/kdump/index.html
 +++ b/pkg/kdump/index.html
-@@ -26,6 +26,7 @@ along with Cockpit; If not, see <https://www.gnu.org/licenses/>.
-
+@@ -25,6 +25,7 @@ along with Cockpit; If not, see <https://www.gnu.org/licenses/>.
+     <meta name="viewport" content="width=device-width, initial-scale=1" />
+ 
     <link rel="stylesheet" href="kdump.css" />
-     <link href="../../static/branding.css" rel="stylesheet" />
 +    <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet" />
-
+ 
     <script type="text/javascript" src="kdump.js"></script>
     <script type="text/javascript" src="../base1/po.js"></script>
 diff --git a/pkg/metrics/index.html b/pkg/metrics/index.html
-index cbf10aab8..c42081e34 100644
+index cbb82dccc..b17bd1a76 100644
 --- a/pkg/metrics/index.html
 +++ b/pkg/metrics/index.html
-@@ -24,6 +24,7 @@ along with this package; If not, see <https://www.gnu.org/licenses/>.
-
+@@ -23,6 +23,7 @@ along with this package; If not, see <https://www.gnu.org/licenses/>.
+     <meta name="viewport" content="width=device-width, initial-scale=1" />
+ 
     <link rel="stylesheet" href="index.css" />
-     <link href="../../static/branding.css" rel="stylesheet" />
 +    <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet" />
-
+ 
     <script type="text/javascript" src="../base1/cockpit.js"></script>
     <script type="text/javascript" src="../manifests.js"></script>
 diff --git a/pkg/networkmanager/firewall.html b/pkg/networkmanager/firewall.html
@@ -85,44 +85,44 @@ index e5ea58276..6bc5327f5 100644
 +++ b/pkg/networkmanager/firewall.html
@@ -23,6 +23,7 @@ along with Cockpit; If not, see <https://www.gnu.org/licenses/>.
     <meta charset="utf-8" />
-
+ 
     <link href="firewall.css" type="text/css" rel="stylesheet" />
 +    <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet" />
-
+ 
     <script src="../base1/cockpit.js"></script>
     <script src="../base1/po.js"></script>
 diff --git a/pkg/networkmanager/index.html b/pkg/networkmanager/index.html
-index e73b89502..0e2c6e09e 100644
+index fc9cb5aff..3aceef1b2 100644
 --- a/pkg/networkmanager/index.html
 +++ b/pkg/networkmanager/index.html
-@@ -25,6 +25,7 @@
+@@ -24,6 +24,7 @@
+   <meta charset="utf-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
   <link href="networkmanager.css" type="text/css" rel="stylesheet" />
-   <link href="../../static/branding.css" rel="stylesheet" />
 +  <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet" />
   <script src="../base1/cockpit.js"></script>
   <script src="../manifests.js"></script>
   <script src="../base1/po.js"></script>
 diff --git a/pkg/packagekit/index.html b/pkg/packagekit/index.html
-index e3ec580c9..a91cdebec 100644
+index c95dfd263..f4f3baab6 100644
 --- a/pkg/packagekit/index.html
 +++ b/pkg/packagekit/index.html
-@@ -25,6 +25,7 @@ along with Cockpit; If not, see <https://www.gnu.org/licenses/>.
-
+@@ -24,6 +24,7 @@ along with Cockpit; If not, see <https://www.gnu.org/licenses/>.
+   <meta charset="utf-8" />
+ 
   <link href="updates.css" rel="stylesheet" />
-   <link href="../../static/branding.css" rel="stylesheet" />
 +  <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet" />
-
+ 
   <script src="../base1/cockpit.js"></script>
   <script src="../base1/po.js"></script>
 diff --git a/pkg/playground/index.html b/pkg/playground/index.html
-index cb5eb670f..081972401 100644
+index 4f2bce82d..6f87bc642 100644
 --- a/pkg/playground/index.html
 +++ b/pkg/playground/index.html
-@@ -6,6 +6,7 @@
+@@ -5,6 +5,7 @@
+     <title>Cockpit Development Playground</title>
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <link href="index.css" type="text/css" rel="stylesheet" />
-     <link href="../../static/branding.css" rel="stylesheet" />
 +    <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet" />
     <script src="../base1/cockpit.js"></script>
     <script src="../manifests.js"></script>
@@ -199,18 +199,6 @@ index 97a74791f..a2519cfd2 100644
     <script src="../base1/cockpit.js"></script>
     <script src="test.js"></script>
 </head>
-diff --git a/pkg/selinux/index.html b/pkg/selinux/index.html
-index f967e7b25..bc64e6d8c 100644
--- a/pkg/selinux/index.html
-+++ b/pkg/selinux/index.html
-@@ -26,6 +26,7 @@ along with Cockpit; If not, see <https://www.gnu.org/licenses/>.
-
-     <link rel="stylesheet" href="selinux.css" />
-     <link href="../../static/branding.css" rel="stylesheet" />
-+    <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet" />
-
-     <script type="text/javascript" src="../base1/cockpit.js"></script>
-     <script type="text/javascript" src="../base1/po.js"></script>
 diff --git a/pkg/shell/index.html b/pkg/shell/index.html
 index 6dd5ad1ac..1c6f3512c 100644
 --- a/pkg/shell/index.html
@@ -235,6 +223,18 @@ index c9adf7ae2..97f088f7c 100644
 </head>
 <body class="pf-v6-m-tabular-nums">
     <div class="curtains-ct">
+diff --git a/pkg/sosreport/index.html b/pkg/sosreport/index.html
+index e673383ad..224b42463 100644
+--- a/pkg/sosreport/index.html
+++ b/pkg/sosreport/index.html
+@@ -22,6 +22,7 @@ along with Cockpit; If not, see <https://www.gnu.org/licenses/>.
+     <title translate="yes">Diagnostic reports</title>
+     <meta charset="utf-8" />
+     <link href="sosreport.css" rel="stylesheet" />
+    <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet" />
+     <script type="text/javascript" src="../base1/cockpit.js"></script>
+     <script type="text/javascript" src="../base1/po.js"></script>
+     <script type="text/javascript" src="po.js"></script>
 diff --git a/pkg/static/css-overrides.css b/pkg/static/css-overrides.css
 new file mode 100644
 index 000000000..7481f7ecf
@@ -253,42 +253,6 @@ index 000000000..7481f7ecf
 + *   - https://github.com/cockpit-project/cockpit/pull/17437
 + *   - https://github.com/cockpit-project/cockpit/issues/16359
 + */
-diff --git a/pkg/sosreport/index.html b/pkg/sosreport/index.html
-index a37f816ee..37528f38b 100644
--- a/pkg/sosreport/index.html
-+++ b/pkg/sosreport/index.html
-@@ -23,6 +23,7 @@ along with Cockpit; If not, see <https://www.gnu.org/licenses/>.
-     <meta charset="utf-8" />
-     <link href="sosreport.css" rel="stylesheet" />
-     <link href="../../static/branding.css" rel="stylesheet" />
-+    <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet" />
-     <script type="text/javascript" src="../base1/cockpit.js"></script>
-     <script type="text/javascript" src="../base1/po.js"></script>
-     <script type="text/javascript" src="po.js"></script>
-diff --git a/pkg/static/login.html b/pkg/static/login.html
-index 4a3ade726..7ce60a214 100644
--- a/pkg/static/login.html
-+++ b/pkg/static/login.html
-@@ -11,6 +11,7 @@
-   <script type="text/javascript" src="cockpit/static/login.js"></script>
-   <link href="cockpit/static/login.css" type="text/css" rel="stylesheet" />
-   <link href="cockpit/static/branding.css" type="text/css" rel="stylesheet" />
-+  <link href="cockpit/static/css-overrides.css" type="text/css" rel="stylesheet" />
- </head>
-
- <body class="login-pf">
-diff --git a/pkg/storaged/index.html b/pkg/storaged/index.html
-index 9453ee003..bb69595d5 100644
--- a/pkg/storaged/index.html
-+++ b/pkg/storaged/index.html
-@@ -25,6 +25,7 @@
-     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-     <link href="storaged.css" type="text/css" rel="stylesheet" />
-     <link href="../../static/branding.css" rel="stylesheet" />
-+    <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet" />
-     <script src="../base1/cockpit.js"></script>
-     <script src="../base1/po.js"></script>
-     <script src="../manifests.js"></script>
 diff --git a/pkg/systemd/hwinfo.html b/pkg/systemd/hwinfo.html
 index a3413faca..549b80298 100644
 --- a/pkg/systemd/hwinfo.html
@@ -302,14 +266,14 @@ index a3413faca..549b80298 100644
     <script src="../base1/po.js"></script>
     <script src="po.js"></script>
 diff --git a/pkg/systemd/index.html b/pkg/systemd/index.html
-index 146b59304..28d660b67 100644
+index 91a268a4a..ee125fe65 100644
 --- a/pkg/systemd/index.html
 +++ b/pkg/systemd/index.html
-@@ -7,6 +7,7 @@
+@@ -6,6 +6,7 @@
+   <meta name="description" content="" />
   <meta name="viewport" content="width=device-width, initial-scale=1" />
   <link rel="stylesheet" href="overview.css" />
-   <link href="../../static/branding.css" rel="stylesheet" />
-+  <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet" />
+  <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet"/>
   <script type="text/javascript" src="../base1/cockpit.js"></script>
   <script type="text/javascript" src="../base1/po.js"></script>
   <script type="text/javascript" src="overview.js"></script>
@@ -326,17 +290,17 @@ index f89f1fa47..5086ce1f6 100644
   <script src="../base1/po.js"></script>
   <script src="po.js"></script>
 diff --git a/pkg/systemd/services.html b/pkg/systemd/services.html
-index a17e95e56..7eaa65efa 100644
+index 74fa456d4..e9c7047ee 100644
 --- a/pkg/systemd/services.html
 +++ b/pkg/systemd/services.html
-@@ -9,6 +9,7 @@
-     <script src="../base1/po.js"></script>
-     <script src="../manifests.js"></script>
-     <script src="services.js"></script>
+@@ -5,6 +5,7 @@
+     <meta charset="utf-8" />
+     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+     <link href="services.css" type="text/css" rel="stylesheet" />
 +    <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet" />
-     <script src="po.js"></script>
- </head>
-
+     <script src="../base1/cockpit.js"></script>
+     <script src="../base1/po.js"></script>
+     <script src="services.js"></script>
 diff --git a/pkg/systemd/terminal.html b/pkg/systemd/terminal.html
 index ce7216e4e..63547f9d3 100644
 --- a/pkg/systemd/terminal.html
@@ -350,17 +314,53 @@ index ce7216e4e..63547f9d3 100644
     <script src="../base1/po.js"></script>
     <script src="po.js"></script>
 diff --git a/pkg/users/index.html b/pkg/users/index.html
-index 6c8c81be9..533a5975a 100644
+index d26cf4781..b0c6ebf87 100644
 --- a/pkg/users/index.html
 +++ b/pkg/users/index.html
-@@ -25,6 +25,7 @@
+@@ -24,6 +24,7 @@
+     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <link href="users.css" type="text/css" rel="stylesheet" />
-     <link href="../../static/branding.css" rel="stylesheet" />
 +    <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet" />
     <script src="../base1/cockpit.js"></script>
     <script src="../base1/po.js"></script>
     <script src="po.js"></script>
+diff --git a/pkg/storaged/index.html b/pkg/storaged/index.html
+index 6893e4909..b6677bb56 100644
+--- a/pkg/storaged/index.html
+++ b/pkg/storaged/index.html
+@@ -24,6 +24,7 @@
+     <meta charset="utf-8" />
+     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+     <link href="storaged.css" type="text/css" rel="stylesheet" />
+    <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet">
+     <script src="../base1/cockpit.js"></script>
+     <script src="../base1/po.js"></script>
+     <script src="../manifests.js"></script>
+diff --git a/pkg/static/login.html b/pkg/static/login.html
+index 6a8fa4f44..9019499a5 100644
+--- a/pkg/static/login.html
+++ b/pkg/static/login.html
+@@ -11,6 +11,7 @@
+   <script type="text/javascript" src="cockpit/static/login.js"></script>
+   <link href="cockpit/static/login.css" type="text/css" rel="stylesheet" />
+   <link href="cockpit/static/branding.css" type="text/css" rel="stylesheet" />
+  <link href="cockpit/static/css-overrides.css" type="text/css" rel="stylesheet" />
+ </head>
+
+ <body class="login-pf">
+diff --git a/pkg/selinux/index.html b/pkg/selinux/index.html
+index cc3825a25..e1c814c6d 100644
+--- a/pkg/selinux/index.html
+++ b/pkg/selinux/index.html
+@@ -25,6 +25,7 @@ along with Cockpit; If not, see <https://www.gnu.org/licenses/>.
+     <meta name="viewport" content="width=device-width, initial-scale=1" />
+ 
+     <link rel="stylesheet" href="selinux.css" />
+    <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet">
+ 
+     <script type="text/javascript" src="../base1/cockpit.js"></script>
+     <script type="text/javascript" src="../base1/po.js"></script>
 -- 
 2.49.0

--- a/hide-pcp.patch
+++ b/hide-pcp.patch
@@ -1,77 +1,34 @@
-diff --git a/pkg/metrics/metrics.jsx b/pkg/metrics/metrics.jsx
-index 80f1087..fda6049 100644
--- a/pkg/metrics/metrics.jsx
-+++ b/pkg/metrics/metrics.jsx
-@@ -17,7 +17,7 @@
-  * along with Cockpit; If not, see <https://www.gnu.org/licenses/>.
-  */
+Index: cockpit/pkg/metrics/metrics.jsx
+===================================================================
+--- cockpit.orig/pkg/metrics/metrics.jsx
+++ cockpit/pkg/metrics/metrics.jsx
+@@ -1565,6 +1565,7 @@ const PCPConfig = ({ buttonVariant, firewalldRequest, needsLogout, setNeedsLogou
 
-import React, { useState, createRef } from 'react';
-+import React, { useState, createRef, useEffect } from 'react';
- 
- import { Alert } from "@patternfly/react-core/dist/esm/components/Alert/index.js";
- import { Breadcrumb, BreadcrumbItem } from "@patternfly/react-core/dist/esm/components/Breadcrumb/index.js";
-@@ -1510,6 +1510,7 @@ const PCPConfigDialog = ({
- const PCPConfig = ({ buttonVariant, firewalldRequest }) => {
-     const Dialogs = useDialogs();
-     const [packageInstallStatus, setPackageInstallStatus] = useState(null);
-+    const [isMicroOs, setIsMicroOs] = useState(false);
- 
-     const s_pmlogger = useObject(() => service.proxy("pmlogger.service"), null, []);
-     const s_pmproxy = useObject(() => service.proxy("pmproxy.service"), null, []);
-@@ -1531,6 +1532,12 @@ const PCPConfig = ({ buttonVariant, firewalldRequest }) => {
-           "redis-server exists", s_redis_server.exists, "state", s_redis_server.state,
-           "valkey exists", s_valkey.exists, "state", s_valkey.state);
- 
-+    useEffect(() => {
-+        read_os_release().then((os_release) => {
-+            setIsMicroOs(os_release?.ID_LIKE.includes("sle-micro") || os_release?.ID_LIKE.includes("microos"))
-+        });
-+    }, []);
-+
-     if (!superuser.allowed)
-         return null;
- 
-@@ -1543,8 +1550,13 @@ const PCPConfig = ({ buttonVariant, firewalldRequest }) => {
-                                       packageInstallCallback={() => setPackageInstallStatus("done")} />);
-     }
- 
-+    function is_micro_os() {
-+        return ;
-+    }
-+
     return (
         <Button variant={buttonVariant} icon={<CogIcon />}
-+                className={isMicroOs ? "pf-u-display-none" : ""}
+                className="pf-u-display-none"
                 isDisabled={ invalidService(s_pmlogger) || invalidService(s_pmproxy) ||
                              invalidService(s_redis) || invalidService(s_redis_server) || invalidService(s_valkey) }
-                 onClick={show_dialog}
-@@ -1578,6 +1590,7 @@ class MetricsHistory extends React.Component {
-             isBeibootBridge: false,
-             isPythonPCPInstalled: null,
-             selectedVisibility: this.columns.reduce((a, v) => ({ ...a, [v[0]]: true }), {}),
-+            isMicroOs: false,
-             boots: [], // journalctl --list-boots as [{started: Date, ended: Date}]
-         };
- 
-@@ -1609,6 +1622,10 @@ class MetricsHistory extends React.Component {
- 
-     // load and render the last 24 hours (plus current one) initially; this needs numCpu initialized for correct scaling
-     initialLoadData() {
-+        read_os_release().then((os_release) => {
-+            this.setState({ isMicroOs: os_release?.ID_LIKE.includes("sle-micro") || os_release?.ID_LIKE.includes("microos") });
-+        });
-+
-         cockpit.spawn(["date", "+%s"])
-                 .then(out => {
-                     const now = parseInt(out.trim()) * 1000;
-@@ -1815,6 +1832,9 @@ class MetricsHistory extends React.Component {
-     }
- 
-     render() {
-+        if (this.state.isMicroOs)
-+            return <></>;
-+
+                 onClick={show_dialog}>
+Index: cockpit-309/pkg/metrics/metrics.jsx
+===================================================================
+--- cockpit-309.orig/pkg/metrics/metrics.jsx
+++ cockpit-309/pkg/metrics/metrics.jsx
+@@ -1824,7 +1825,8 @@ class MetricsHistory extends React.Component {
         // on a single machine, cockpit-pcp depends on pcp; but this may not be the case in the beiboot scenario,
         // so additionally check if pcp is available on the logged in target machine
-         if (this.state.isPythonPCPInstalled === false || this.pmlogger_service.exists === false)
+         if ((cockpit.manifests && !cockpit.manifests.pcp) || this.pmlogger_service.exists === false)
+-            return <EmptyStatePanel
+            return <EmptyStatePanel />
+/*            return <EmptyStatePanel
+                         icon={ExclamationCircleIcon}
+                         title={_("Package cockpit-pcp is missing for metrics history")}
+                         action={this.state.isBeibootBridge === true
+@@ -1834,6 +1834,7 @@ class MetricsHistory extends React.Component {
+                             ? <Text>{ _("Installation not supported without installed cockpit package") }</Text>
+                             : this.state.packagekitExists && <Button onClick={this.handleInstall}>{_("Install cockpit-pcp")}</Button>}
+             />;
+*/
+ 
+         if (!this.state.metricsAvailable) {
+             let action;
--- a/kdump-nfs-fixes.patch
+++ b/kdump-nfs-fixes.patch
@@ -0,0 +1,153 @@
+From d1ffed4a006bc9f8aeb0e8f63e8d2a160720b4f6 Mon Sep 17 00:00:00 2001
+From: Alice Brooks <alice.brooks@suse.com>
+Date: Thu, 12 Jun 2025 08:48:16 +0100
+Subject: [PATCH] kdump: Remove nfs directory when using sysconfig
+ configuration style
+
+This is because the sysconfig style only has the KDUMP_SAVEDIR field
+so we can't work with two path fields as it's impossible to extract
+them again
+---
+ pkg/kdump/kdump-client.js |  4 ++++
+ pkg/kdump/kdump-view.jsx  | 24 +++++++++++++++---------
+ pkg/kdump/kdump.js        |  6 ++++++
+ 4 files changed, 26 insertions(+), 20 deletions(-)
+
+diff --git a/pkg/kdump/kdump-client.js b/pkg/kdump/kdump-client.js
+index d4c3d989a42d..35add2554a39 100644
+--- a/pkg/kdump/kdump-client.js
+++ b/pkg/kdump/kdump-client.js
+@@ -48,6 +48,7 @@ export class KdumpClient {
+             state: undefined,
+             config: undefined,
+             target: undefined,
+            sysconfig: undefined,
+         };
+         cockpit.event_target(this);
+ 
+@@ -62,6 +63,7 @@ export class KdumpClient {
+ 
+         // watch the config file
+         this.configClient = new ConfigFile("/etc/kdump.conf", true);
+        this.state.sysconfig = false;
+         this._watchConfigChanges();
+ 
+         this.configClient.wait().then(() => {
+@@ -69,6 +71,8 @@ export class KdumpClient {
+             if (this.configClient.settings === null) {
+                 this.configClient.close();
+                 this.configClient = new ConfigFileSUSE("/etc/sysconfig/kdump", true);
+                this.state.sysconfig = true;
+                this.dispatchEvent("kdumpSysconfigChanged", true);
+                 this._watchConfigChanges();
+             }
+         });
+diff --git a/pkg/kdump/kdump-view.jsx b/pkg/kdump/kdump-view.jsx
+index c6cc1e0d6bc6..8b5d74707e39 100644
+--- a/pkg/kdump/kdump-view.jsx
+++ b/pkg/kdump/kdump-view.jsx
+@@ -115,12 +115,15 @@ const exportAnsibleTask = (settings, os_release) => {
+     return ansible;
+ };
+ 
+-function getLocation(target) {
+function getLocation(target, sysconfig) {
+     let path = target.path || DEFAULT_KDUMP_PATH;
+ 
+     if (target.type === "ssh") {
+         path = `${target.server}:${path}`;
+     } else if (target.type == "nfs") {
+        if (sysconfig) {
+            path = '';
+        }
+         path = path[0] !== '/' ? '/' + path : path;
+         path = `${target.server}:${target.export + path}`;
+     }
+@@ -128,7 +131,7 @@ function getLocation(target) {
+     return path;
+ }
+ 
+-const KdumpSettingsModal = ({ settings, initialTarget, handleSave }) => {
+const KdumpSettingsModal = ({ settings, initialTarget, handleSave, sysconfig }) => {
+     const Dialogs = useDialogs();
+     const compressionAllowed = settings.compression?.allowed;
+     const [isSaving, setIsSaving] = useState(false);
+@@ -276,13 +279,15 @@ const KdumpSettingsModal = ({ settings, initialTarget, handleSave }) => {
+                                     placeholder="/export/cores" value={exportPath}
+                                     onChange={(_event, value) => setExportPath(value)} isRequired />
+                         </FormGroup>
+                        {sysconfig === false &&
+                         <FormGroup fieldId="kdump-settings-nfs-directory" label={_("Directory")} isRequired>
+                             <TextInput id="kdump-settings-nfs-directory" key="directory"
+-                                    placeholder={DEFAULT_KDUMP_PATH} value={directory}
+-                                    data-stored={directory}
+-                                    onChange={(_event, value) => setDirectory(value)}
+-                                    isRequired />
+                                          placeholder={DEFAULT_KDUMP_PATH} value={directory}
+                                          data-stored={directory}
+                                          onChange={(_event, value) => setDirectory(value)}
+                                          isRequired />
+                         </FormGroup>
+                        }
+                     </>
+                 }
+ 
+@@ -353,7 +358,7 @@ export class KdumpPage extends React.Component {
+         const target = this.props.kdumpStatus.target;
+         let verifyMessage;
+         if (!target.multipleTargets) {
+-            const path = getLocation(target);
+            const path = getLocation(target, this.props.sysconfig);
+             if (target.type === "local") {
+                 verifyMessage = fmt_to_fragments(
+                     ' ' + _("Results of the crash will be stored in $0 as $1, if kdump is properly configured."),
+@@ -403,7 +408,8 @@ export class KdumpPage extends React.Component {
+         const Dialogs = this.context;
+         Dialogs.show(<KdumpSettingsModal settings={this.props.kdumpStatus.config}
+                                          initialTarget={this.props.kdumpStatus.target}
+-                                         handleSave={this.props.onSaveSettings} />);
+                                         handleSave={this.props.onSaveSettings}
+                                         sysconfig={this.props.sysconfig} />);
+     }
+ 
+     handleAutomationClick() {
+@@ -459,7 +465,7 @@ ${enableCrashKernel}
+             if (target.multipleTargets) {
+                 kdumpLocation = _("invalid: multiple targets defined");
+             } else {
+-                const locationPath = getLocation(target);
+                const locationPath = getLocation(target, this.props.sysconfig);
+                 if (target.type == "local") {
+                     kdumpLocation = cockpit.format(_("Local, $0"), locationPath);
+                     targetCanChange = true;
+diff --git a/pkg/kdump/kdump.js b/pkg/kdump/kdump.js
+index 1a143defef15..b0f75e88c220 100644
+--- a/pkg/kdump/kdump.js
+++ b/pkg/kdump/kdump.js
+@@ -41,6 +41,7 @@ const initStore = function(rootElement) {
+     dataStore.domRootElement = rootElement;
+ 
+     dataStore.kdumpClient = new kdumpClient.KdumpClient();
+    dataStore.sysconfig = dataStore.kdumpClient.state.sysconfig;
+ 
+     dataStore.saveSettings = settings =>
+         dataStore.kdumpClient.validateSettings(settings)
+@@ -74,6 +75,7 @@ const initStore = function(rootElement) {
+             reservedMemory: dataStore.kdumpMemory,
+             kdumpStatus: dataStore.kdumpStatus,
+             kdumpCmdlineEnabled: dataStore.crashkernel || false,
+            sysconfig: dataStore.sysconfig,
+             onSaveSettings: dataStore.saveSettings,
+             onCrashKernel: dataStore.kdumpClient.crashKernel,
+             exportConfig: dataStore.exportConfig,
+@@ -117,6 +119,10 @@ const initStore = function(rootElement) {
+         dataStore.kdumpStatus = status;
+         render();
+     });
+    dataStore.kdumpClient.addEventListener('kdumpSysconfigChanged', function(event, sysconfig) {
+        dataStore.sysconfig = sysconfig;
+        render();
+    });
+ 
+     // render once
+     render();
--- a/node_modules.obscpio
+++ b/node_modules.obscpio
--- a/node_modules.spec.inc
+++ b/node_modules.spec.inc
--- a/package-lock.json
+++ b/package-lock.json
--- a/packagekit-single-install.patch
+++ b/packagekit-single-install.patch
@@ -28,7 +28,6 @@ index 80a16dda7..4fe94432a 100644
 
 import "./updates.scss";
 +import { Checkbox } from '@patternfly/react-core';
- import { Truncate } from '@patternfly/react-core/dist/esm/components/Truncate/index.js';
 
 const _ = cockpit.gettext;
 
--- a/remove_rh_links.patch
+++ b/remove_rh_links.patch
@@ -1,16 +1,7 @@
 diff --git a/pkg/networkmanager/bond.jsx b/pkg/networkmanager/bond.jsx
-index f56f02961..cae872b00 100644
+index b54b1db..062cd1d 100644
 --- a/pkg/networkmanager/bond.jsx
 +++ b/pkg/networkmanager/bond.jsx
-@@ -24,7 +24,7 @@ import { FormGroup } from "@patternfly/react-core/dist/esm/components/Form/index
- import { FormSelect, FormSelectOption } from "@patternfly/react-core/dist/esm/components/FormSelect/index.js";
- import { Popover } from "@patternfly/react-core/dist/esm/components/Popover/index.js";
- import { TextInput } from "@patternfly/react-core/dist/esm/components/TextInput/index.js";
-import { ExternalLinkSquareAltIcon, HelpIcon } from '@patternfly/react-icons';
-+import { HelpIcon } from '@patternfly/react-icons';
- 
- import { MacMenu, MemberInterfaceChoices, NetworkModal, Name, dialogSave } from './dialogs-common.jsx';
- import { ModelContext } from './model-context.jsx';
@@ -151,16 +151,6 @@ export const BondDialog = ({ connection, dev, settings }) => {
                                       {_("A network bond combines multiple network interfaces into one logical interface with higher throughput or redundancy.")}
                                   </div>
@@ -26,10 +17,10 @@ index f56f02961..cae872b00 100644
 -                                  </Button>
 -                              }
                           >
-                               <Button icon={<HelpIcon />} id="bond-help-popup-button" variant="plain" aria-label="Help" />
-                           </Popover>
+                               <Button id="bond-help-popup-button" variant="plain" aria-label="Help">
+                                   <HelpIcon />
 diff --git a/pkg/systemd/hwinfo.jsx b/pkg/systemd/hwinfo.jsx
-index d301f60a6..886bc6b0e 100644
+index d2d2d9b..af0bedc 100644
 --- a/pkg/systemd/hwinfo.jsx
 +++ b/pkg/systemd/hwinfo.jsx
@@ -205,11 +205,6 @@ const CPUSecurityMitigationsDialog = () => {
@@ -45,7 +36,7 @@ index d301f60a6..886bc6b0e 100644
                             </DataListCell>,
                         ]}
 diff --git a/pkg/systemd/overview-cards/cryptoPolicies.jsx b/pkg/systemd/overview-cards/cryptoPolicies.jsx
-index 6ee533993..aeb31ba16 100644
+index fa57de9..d4dd3be 100644
 --- a/pkg/systemd/overview-cards/cryptoPolicies.jsx
 +++ b/pkg/systemd/overview-cards/cryptoPolicies.jsx
@@ -143,7 +143,7 @@ const CryptoPolicyDialog = ({
@@ -72,13 +63,13 @@ index 6ee533993..aeb31ba16 100644
 -                </Button>
 -            }
         >
-             <Button icon={<HelpIcon />} variant="plain" aria-label={_("Help")} />
-         </Popover>
+             <Button variant="plain" aria-label={_("Help")}>
+                 <HelpIcon />
 diff --git a/pkg/systemd/overview-cards/tuned-dialog.jsx b/pkg/systemd/overview-cards/tuned-dialog.jsx
-index b67631b7d..b36ad88e3 100644
+index 38420ca..cd7e2a3 100644
 --- a/pkg/systemd/overview-cards/tuned-dialog.jsx
 +++ b/pkg/systemd/overview-cards/tuned-dialog.jsx
-@@ -278,38 +278,13 @@ const TunedDialog = ({
+@@ -278,36 +278,10 @@ const TunedDialog = ({
         };
     }, [tunedService]);
 
@@ -101,7 +92,9 @@ index b67631b7d..b36ad88e3 100644
 -                </Button>
 -            }
 -        >
-            <Button icon={<HelpIcon />} variant="plain" aria-label={_("Help")} />
+-            <Button variant="plain" aria-label={_("Help")}>
+-                <HelpIcon />
+-            </Button>
 -        </Popover>
 -    );
 -
@@ -109,12 +102,7 @@ index b67631b7d..b36ad88e3 100644
         <Modal position="top" variant="medium"
                className="ct-m-stretch-body"
                isOpen
+-               help={help}
                onClose={() => dialogResult.resolve()}
-         >
-            <ModalHeader title={_("Change performance profile")}
-                help={help}
-            />
-+            <ModalHeader title={_("Change performance profile")} />
-             <ModalBody>
-                 {error && <ModalError dialogError={typeof error == 'string' ? error : error.message} />}
-                 {loading && <EmptyStatePanel loading />}
+                title={_("Change performance profile")}
+                footer={