diff --git a/0006-totp-motd.patch b/0006-totp-motd.patch new file mode 100644 index 0000000..0cf03ee --- /dev/null +++ b/0006-totp-motd.patch @@ -0,0 +1,10 @@ +--- a/src/systemd/inactive.motd ++++ b/src/systemd/inactive.motd +@@ -1,2 +1,7 @@ + Activate the web console with: systemctl enable --now cockpit.socket + ++Note: Cockpit disallows root login by default. ++To create a regular user and optionally enable 2FA run both: ++ ++jeos-config user ++jeos-config otp diff --git a/_scmsync.obsinfo b/_scmsync.obsinfo index f747e7f..1d9144a 100644 --- a/_scmsync.obsinfo +++ b/_scmsync.obsinfo @@ -1,4 +1,4 @@ -mtime: 1724160305 -commit: 14257e4afc4b4e4056aa2c0ded35bcd58557bbf7e3bce531cf68bd67440ac9cb +mtime: 1728476339 +commit: 416aa9163d1b8de4091c35f889f67ad8008b2bb60ba87d63209a6e02db4c05d4 url: https://src.opensuse.org/cockpit/cockpit.git -revision: 14257e4afc4b4e4056aa2c0ded35bcd58557bbf7e3bce531cf68bd67440ac9cb +revision: 416aa9163d1b8de4091c35f889f67ad8008b2bb60ba87d63209a6e02db4c05d4 diff --git a/build.specials.obscpio b/build.specials.obscpio index 1113337..cc4c429 100644 --- a/build.specials.obscpio +++ b/build.specials.obscpio @@ -1,3 +1,3 @@ version https://git-lfs.github.com/spec/v1 -oid sha256:322d6cd67c1bf0efc416a76103ff92916681f6e258089fb6497cd5a08317a3b1 +oid sha256:dded7f5b020b9854608c9d82fb0407cee198e00ec6c482e623e0e9960a3b4929 size 256 diff --git a/cockpit.changes b/cockpit.changes index 08015aa..c14f8f9 100644 --- a/cockpit.changes +++ b/cockpit.changes @@ -1,3 +1,23 @@ +------------------------------------------------------------------- +Wed Oct 9 12:14:14 UTC 2024 - Alice Brooks + +- suse_docs.patch: update documentation to point at new links (bsc#1226050) +- remove_rh_links.patch: remove additional hardcoded RH refs (bsc#1221336) +- hide-pcp.patch: correct patch to properly disable pcp on micro + (bsc#1226049) +- suse-microos-branding.patch: use suse ID as branding instead of sle-micro + (bsc#1227441) + +------------------------------------------------------------------- +Mon Sep 30 07:08:12 UTC 2024 - Alice Brooks + +- add 0006-totp-motd.patch for guidance to enabling totp to the mtod + +------------------------------------------------------------------- +Wed Sep 18 12:37:18 UTC 2024 - Jan Zerebecki + +- support optional TOTP for authentication, requires pam_oath + ------------------------------------------------------------------- Tue Aug 20 13:24:06 UTC 2024 - Adam Majer diff --git a/cockpit.pam b/cockpit.pam index 376d79f..efef5db 100644 --- a/cockpit.pam +++ b/cockpit.pam @@ -8,3 +8,4 @@ password include common-password session required pam_loginuid.so session optional pam_keyinit.so force revoke session include common-session +auth [user_unknown=ignore success=ok] pam_oath.so usersfile=${HOME}/.pam_oath_usersfile no_usersfile_okay window=20 digits=6 diff --git a/cockpit.spec b/cockpit.spec index 7a99e09..c9bddd9 100644 --- a/cockpit.spec +++ b/cockpit.spec @@ -68,12 +68,15 @@ Patch5: storage-btrfs.patch # SLE Micro specific patches Patch101: hide-pcp.patch Patch102: 0002-selinux-temporary-remove-setroubleshoot-section.patch +Patch107: 0006-totp-motd.patch # For anything based on SLES 15 codebase (including Leap, SLE Micro) Patch103: 0004-leap-gnu18-removal.patch Patch104: selinux_libdir.patch Patch105: fix-libexecdir.patch Patch106: 0005-cockpit-ws-user-remove-default-deps.patch +Patch201: remove_rh_links.patch + %define build_all 1 %if 0%{?rhel} == 8 && 0%{?epel} == 0 && !0%{?build_all} @@ -229,6 +232,7 @@ BuildRequires: python3-tox-current-env %patch -P 4 -p1 %patch -P 5 -p1 %patch -P 106 -p1 +%patch -P 107 -p1 # SLE Micro specific patches %if 0%{?is_smo} @@ -245,6 +249,8 @@ BuildRequires: python3-tox-current-env %patch -P 105 -p1 %endif +%patch -P 201 -p1 + cp %SOURCE1 tools/cockpit.pam # local-npm-registry %{_sourcedir} install --include=dev --ignore-scripts @@ -428,13 +434,13 @@ sed -i "s|%{buildroot}||" *.list # remove brandings with stale symlinks. Means they don't match # the distro. pushd %{buildroot}/%{_datadir}/cockpit/branding -ls --hide={default,kubernetes,opensuse,registry,sle-micro,suse} | xargs rm -rv +ls --hide={default,kubernetes,opensuse,registry,suse} | xargs rm -rv popd # need this in SUSE as post build checks dislike stale symlinks install -m 644 -D /dev/null %{buildroot}/run/cockpit/motd test -e %{buildroot}/usr/share/cockpit/branding/opensuse/default-1920x1200.jpg || install -m 644 -D /dev/null %{buildroot}/usr/share/cockpit/branding/opensuse/default-1920x1200.jpg -test -e %{buildroot}/usr/share/cockpit/branding/sle-micro/apple-touch-icon.png || install -m 644 -D /dev/null %{buildroot}/usr/share/cockpit/branding/sle-micro/apple-touch-icon.png -test -e %{buildroot}/usr/share/cockpit/branding/sle-micro/default-1920x1200.png || install -m 644 -D /dev/null %{buildroot}/usr/share/cockpit/branding/sle-micro/default-1920x1200.png +test -e %{buildroot}/usr/share/cockpit/branding/suse/apple-touch-icon.png || install -m 644 -D /dev/null %{buildroot}/usr/share/cockpit/branding/suse/apple-touch-icon.png +test -e %{buildroot}/usr/share/cockpit/branding/suse/default-1920x1200.png || install -m 644 -D /dev/null %{buildroot}/usr/share/cockpit/branding/suse/default-1920x1200.png # remove files of not installable packages rm -r %{buildroot}%{_datadir}/cockpit/sosreport rm -f %{buildroot}/%{_prefix}/share/metainfo/org.cockpit-project.cockpit-sosreport.metainfo.xml @@ -526,6 +532,7 @@ Requires: cockpit-bridge >= %{version}-%{release} Requires: shadow-utils %endif Requires: grep +Requires: jeos-firstboot Requires: /usr/bin/pwscore Requires: /usr/bin/date Provides: cockpit-shell = %{version}-%{release} @@ -575,6 +582,7 @@ Suggests: sssd-dbus >= 2.6.2 %if 0%{?suse_version} Requires(pre): permissions Requires: distribution-logos +Requires: pam_oath >= 2.6.11.12 Requires: wallpaper-branding %endif # for cockpit-desktop diff --git a/hide-pcp.patch b/hide-pcp.patch index aa64c1c..9585301 100644 --- a/hide-pcp.patch +++ b/hide-pcp.patch @@ -2,11 +2,33 @@ Index: cockpit/pkg/metrics/metrics.jsx =================================================================== --- cockpit.orig/pkg/metrics/metrics.jsx +++ cockpit/pkg/metrics/metrics.jsx -@@ -1551,6 +1551,7 @@ const PCPConfig = ({ buttonVariant, fire +@@ -1565,6 +1565,7 @@ const PCPConfig = ({ buttonVariant, firewalldRequest, needsLogout, setNeedsLogou return ( } + />; ++*/ + + if (!this.state.metricsAvailable) { + let action; diff --git a/remove_rh_links.patch b/remove_rh_links.patch new file mode 100644 index 0000000..b4c7610 --- /dev/null +++ b/remove_rh_links.patch @@ -0,0 +1,108 @@ +Index: cockpit-309/pkg/systemd/overview-cards/cryptoPolicies.jsx +=================================================================== +--- cockpit-309.orig/pkg/systemd/overview-cards/cryptoPolicies.jsx ++++ cockpit-309/pkg/systemd/overview-cards/cryptoPolicies.jsx +@@ -115,7 +115,7 @@ const CryptoPolicyDialog = ({ + variant='link' + isInline + icon={} iconPosition="right" +- href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/security_hardening/assembly_installing-the-system-in-fips-mode_security-hardening"> ++ href="https://documentation.suse.com/sle-micro/6.0/html/Micro-selinux/selinux-article.html"> + {_("Learn more")} + + ), +@@ -154,16 +154,6 @@ const CryptoPolicyDialog = ({ + {_("Cryptographic Policies is a system component that configures the core cryptographic subsystems, covering the TLS, IPSec, SSH, DNSSec, and Kerberos protocols.")} + + } +- footerContent={ +- +- } + > + +- } +- > +- +- +- ); +- + return ( + { + + +
{ _("Disable simultaneous multithreading") } (nosmt)
+- +- +- { _("Read more...") } +- +- + + , + ]} +Index: cockpit-309/pkg/networkmanager/bond.jsx +=================================================================== +--- cockpit-309.orig/pkg/networkmanager/bond.jsx ++++ cockpit-309/pkg/networkmanager/bond.jsx +@@ -142,16 +142,6 @@ export const BondDialog = ({ connection, dev, settings }) => { + {_("A network bond combines multiple network interfaces into one logical interface with higher throughput or redundancy.")} + + } +- footerContent={ +- +- } + > +