add missing change log entry

This commit makes check_cockpit_users only check for systemd dynamic
user support in nsswitch. We do not need to check for compat based on
what Thorsten Kukuk has said. Checking for arguments before systemd
maybe be problematic as for example usrfiles maybe present on some
hermetic-usr systems.

0009-packagekit-reboot-notification.patch

@@ -0,0 +1,116 @@
+diff --git a/pkg/packagekit/updates.jsx b/pkg/packagekit/updates.jsx
+index ce4b3c4cc6d1..b423ee4c09bd 100644
+--- a/pkg/packagekit/updates.jsx
++++ b/pkg/packagekit/updates.jsx
+@@ -21,6 +21,7 @@ import 'polyfills'; // once per application
+ import 'cockpit-dark-theme'; // once per page
+ 
+ import cockpit from "cockpit";
++import { fsinfo } from 'cockpit/fsinfo';
+ import React from "react";
+ import { createRoot } from 'react-dom/client';
+ 
+@@ -1079,12 +1080,19 @@ class OsUpdates extends React.Component {
+                     debug("tracer parsed restartPackages:", JSON.stringify(restartPackages));
+                     this.setState({ checkRestartAvailable: true, checkRestartRunning: false, restartPackages });
+                 })
+-                .catch((exception, data) => {
++                .catch(async (exception, data) => {
+                     // tracer not installed or supported (like on Arch)? then fall back to dnf needs-restarting
+                     if (exception.message?.includes("ModuleNotFoundError") ||
+                         exception.message?.includes("UnsupportedDistribution")) {
+-                        debug('tracer not installed:', JSON.stringify(exception), "trying dnf needs-restarting");
+-                        return this.checkDnfNeedsRestarting();
++                        try {
++                            // if there's a history for zypper, we can assume the system uses it
++                            await fsinfo("/var/log/zypp/history", [], { superuser: "require" });
++                            debug('tracer not installed:', JSON.stringify(exception), "trying zypper ps");
++                            return this.checkZypperNeedsRestarting();
++                        } catch {
++                            debug('tracer not installed:', JSON.stringify(exception), "trying dnf needs-restarting");
++                            return this.checkDnfNeedsRestarting();
++                        }
+                     }
+ 
+                     // log the error except for some common cases: polkit does not allow it
+@@ -1106,6 +1114,80 @@ class OsUpdates extends React.Component {
+                 });
+     }
+ 
++    checkZypperNeedsRestarting() {
++        const restartPackages = { reboot: [], daemons: [], manual: [] };
++        return cockpit.spawn(["zypper", "ps", "-ss", "--print", "%s"], { err: "message", superuser: "require" })
++                .then((serviceOut) => {
++                    debug("zypper ps -ss succeeded:", serviceOut);
++
++                    // set all the services to be manually restarted since it's
++                    // not always clear if it's safe to restart them via cockpit
++                    const data = serviceOut.trim();
++                    if (data.length !== 0) {
++                        serviceOut.trim()
++                                .split("\n")
++                                .forEach(line => restartPackages.manual.push(line));
++                    }
++
++                    // Check if any kernels are updated since system boot,
++                    // ignoring kernel-firmware updates as they can make things noisy
++                    //
++                    // /var/log/zypper.log can be quite big so it's better to
++                    // handle the processing on machine instead of fetching the data
++                    const kScript = `
++                          stat -c %z /proc/ | \\
++                          cut -d. -f 1 | \\
++                          xargs -i \\
++                          awk -F'|' -v boot="{}" \\
++                          '/install\\|kernel/{if (boot <= $1 && index($0, "firmware") == 0) {print $3"-"$4"."$5}}' \\
++                          /var/log/zypp/history
++                          `;
++
++                    cockpit.script(kScript, undefined, { err: "message", superuser: "require" })
++                            .then(kernels => {
++                                debug("zypper kernel scripts succeeded:", kernels);
++
++                                if (kernels.trim().length == 0) {
++                                    return;
++                                }
++
++                                kernels.trim()
++                                        .split("\n")
++                                        .forEach(line => { restartPackages.reboot.push(line.trim()) });
++                            })
++                            .catch(ex => {
++                                if (ex.problem !== "not-found" &&
++                                // polkit does not allow it
++                                ex.problem !== "access-denied" &&
++                                // or unprivileged session
++                                ex.problem !== "authentication-failed" &&
++                                // or the session goes away while checking
++                                ex.problem !== "terminated")
++                                    console.error("zypper kernel fetching failed:", ex.toString());
++                            })
++                            .then(() => {
++                                let checkRestartAvailable = false;
++                                if (restartPackages.reboot.length !== 0 || restartPackages.manual.length !== 0)
++                                    checkRestartAvailable = true;
++
++                                this.setState({ checkRestartAvailable, checkRestartRunning: false, restartPackages });
++                            });
++                }).catch((ex) => {
++                    // log the error except for some common cases: no zypper
++                    if (ex.problem !== "not-found" &&
++                    // polkit does not allow it
++                    ex.problem !== "access-denied" &&
++                    // or unprivileged session
++                    ex.problem !== "authentication-failed" &&
++                    // or the session goes away while checking
++                    ex.problem !== "terminated")
++                        console.error("zypper ps -ss failed:", ex);
++
++                    // act like it's not available (demand reboot after every update)
++                    this.setState({ checkRestartAvailable: false, checkRestartRunning: false, restartPackages });
++                });
++    }
++
+     checkDnfNeedsRestarting() {
+         const restartPackages = { reboot: [], daemons: [], manual: [] };
+ 

check_cockpit_users

@@ -23,7 +23,7 @@ if [ $? -eq 0 ]; then
 fi
 
 if [ -f /etc/nsswitch.conf ]; then
-    grep -Exq "passwd:.*?compat systemd" /etc/nsswitch.conf
+    grep -Eq "passwd:.*systemd" /etc/nsswitch.conf
     if [ $? -ne 0 ]; then
         echo "/etc/nsswitch.conf is out of date, please update it from /usr/etc/nsswitch.conf to use cockpit"
         failed=true

cockpit.changes

@@ -1,3 +1,20 @@
+-------------------------------------------------------------------
+Wed Jul 30 03:21:48 UTC 2025 - Luna D Dragon <luna.dragon@suse.com>
+
+- drop duplicate %changelog macro
+
+-------------------------------------------------------------------
+Wed Jul 23 12:53:37 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
+
+- Add %postun for firewalld package to ensure the firewall state
+  remains as expected
+
+-------------------------------------------------------------------
+Mon Jul 21 11:39:56 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
+
+- Add cockpit-firewalld package for easily configuring the users
+  firewall jsc#PED-13228
+
 -------------------------------------------------------------------
 Tue Jul 15 07:00:10 UTC 2025 - Luna D Dragon <luna.dragon@suse.com>
 
@@ -5,6 +22,16 @@ Tue Jul 15 07:00:10 UTC 2025 - Luna D Dragon <luna.dragon@suse.com>
 - add 0002-cockpit-kdump-support-SLE-micro-6.2.patch
 - add 0003-branding-use-SUSE_SUPPORT_PRODUCT-and-SUSE_SUPPORT_P.patch to fix bsc#1241003 
 
+-------------------------------------------------------------------
+Mon Jul 14 08:04:06 UTC 2025 - Luna D Dragon <luna.dragon@suse.com>
+
+- update check_cockpit_users to only check for systemd support in /etc/nsswitch.conf bsc#1246408
+
+-------------------------------------------------------------------
+Fri Jul 11 07:13:59 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
+
+- add a requirement on /usr/sbin/kdumptool for cockpit-kdump (bsc#1227402)
+
 -------------------------------------------------------------------
 Fri Jul 11 06:50:17 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
 
@@ -12,6 +39,12 @@ Fri Jul 11 06:50:17 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
   this will generate the swcatalog which it depends on for calculating
   various cockpit packages
 
+-------------------------------------------------------------------
+Thu Jul 10 10:10:21 UTC 2025 - Miika Alikirri <miika.alikirri@suse.com>
+
+- Show reboot nofication after updates in packagekit
+  * Add 0009-packagekit-reboot-notification.patch
+
 -------------------------------------------------------------------
 Thu Jun 19 08:30:49 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
 

cockpit.spec

@@ -84,6 +84,7 @@ Patch110:       add_preexec_cockpit.patch
 Patch111:       0001-cockpit-overview-support-SUSE_SUPPORT_PRODUCT-keys.patch
 Patch112:       0002-cockpit-kdump-support-SLE-micro-6.2.patch
 Patch113:       0003-branding-use-SUSE_SUPPORT_PRODUCT-and-SUSE_SUPPORT_P.patch
+Patch114:       0009-packagekit-reboot-notification.patch
 Patch201:       remove_rh_links.patch
 
 %define build_all 1
@@ -191,6 +192,7 @@ Requires: cockpit-system
 # Optional components
 Recommends: (cockpit-storaged if udisks2)
 Recommends: (cockpit-packagekit if (dnf or zypper))
+Recommends: (cockpit-firewalld if firewalld)
 Suggests: python3-pcp
 
 %if 0%{?rhel} == 0
@@ -229,6 +231,7 @@ BuildRequires:  python3-pytest-timeout
 
 %patch -P 106 -p1
 %patch -P 109 -p1
+%patch -P 114 -p1
 
 # SLE Micro specific patches
 %if 0%{?is_smo}
@@ -792,7 +795,7 @@ SELinux policy module for the cockpit-ws package.
 Summary: Cockpit user interface for kernel crash dumping
 Requires: cockpit-bridge >= %{required_base}
 Requires: cockpit-shell >= %{required_base}
-Requires: kexec-tools
+Requires: /usr/sbin/kdumptool
 BuildArch: noarch
 
 %description kdump
@@ -923,5 +926,31 @@ via PackageKit.
 %files -n cockpit-packagekit -f packagekit.list
 %license COPYING
 
+%package firewalld
+Summary: Allows Cockpit access through the firewall
+Requires: cockpit-bridge >= %{required_base}
+Requires: firewalld
+BuildArch: noarch
+
+%description firewalld
+This package allows Cockpit access through the firewall
+
+%files firewalld
+%license COPYING
+
+%postun firewalld
+if test -f %{_bindir}/firewall-cmd && firewall-cmd --state &>/dev/null; then
+    firewall-cmd --quiet --permanent --remove-service=cockpit && firewall-cmd --reload --quiet || true
+elif test -f %{_bindir}/firewall-offline-cmd; then
+    firewall-offline-cmd --quiet --remove-service=cockpit || true
+fi
+
+%posttrans firewalld
+if test -f %{_bindir}/firewall-cmd && firewall-cmd --state &>/dev/null; then
+    firewall-cmd --quiet --permanent --add-service=cockpit && firewall-cmd --reload --quiet || true
+elif test -f %{_bindir}/firewall-offline-cmd; then
+    firewall-offline-cmd --quiet --add-service=cockpit || true
+fi
+
 # The changelog is automatically generated and merged
 %changelog