Always overwrite tools/cockpit.pam

We should do this since it's only ever used when we're operating under
0%{?suse_version} > 1500 when tools/cockpit.suse.pam is used

0001-cockpit-overview-support-SUSE_SUPPORT_PRODUCT-keys.patch

@@ -0,0 +1,69 @@
+From ec3a1efce07770b7641e07d41a73732967c65175 Mon Sep 17 00:00:00 2001
+From: Luna D Dragon <luna.dragon@suse.com>
+Date: Tue, 8 Jul 2025 14:58:03 +0530
+Subject: [PATCH 1/3] cockpit overview: support SUSE_SUPPORT_PRODUCT keys
+
+SLE Micro 6.2(and Framework one components) have custom os-release keys namely in SUSE_SUPPORT_PRODUCT and
+SUSE_SUPPORT_PRODUCT_VERSION instead of the standard os prettyname which
+results in systemd not being able to determine the os name correctly.
+This patch should be dropped when systemd is fixed
+---
+ pkg/systemd/overview.jsx | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/pkg/systemd/overview.jsx b/pkg/systemd/overview.jsx
+index 868469d68..186fcf59e 100644
+--- a/pkg/systemd/overview.jsx
++++ b/pkg/systemd/overview.jsx
+@@ -42,6 +42,7 @@ import { ShutdownModal } from 'cockpit-components-shutdown.jsx';
+ import { WithDialogs, DialogsContext } from "dialogs.jsx";
+ 
+ import "./overview.scss";
++import { read_os_release } from "os-release.js";
+ 
+ const _ = cockpit.gettext;
+ 
+@@ -98,6 +99,7 @@ class OverviewPage extends React.Component {
+         this.hostname_proxy.addEventListener("changed", data => {
+             this.setState({ hostnameData: data.detail });
+         });
++        read_os_release().then(os_release => this.setState({ os_release }));
+     }
+ 
+     render() {
+@@ -160,8 +162,12 @@ class OverviewPage extends React.Component {
+                             {this.hostname_text()}
+                         </h1>
+                         {this.state.hostnameData &&
+-                         this.state.hostnameData.OperatingSystemPrettyName &&
+-                         <div className="ct-overview-header-subheading" id="system_information_os_text">{cockpit.format(_("running $0"), this.state.hostnameData.OperatingSystemPrettyName)}</div>}
++                         this.state.hostnameData.OperatingSystemPrettyName && (
++                            <div className="ct-overview-header-subheading" id="system_information_os_text">
++                                {(this.state.os_release && this.state.os_release.SUSE_PRETTY_NAME)
++                                    ? cockpit.format(_("running $0"), this.state.os_release.SUSE_PRETTY_NAME)
++                                    : cockpit.format(_("running $0"), this.state.hostnameData.OperatingSystemPrettyName)}
++                            </div>)}
+                     </div>
+                     <div className='ct-overview-header-actions'>
+                         { show_superuser && <SuperuserIndicator proxy={this.superuser} /> }
+diff --git a/src/common/cockpitsystem.c b/src/common/cockpitsystem.c
+index 83e2965f7..73716fff7 100644
+--- a/src/common/cockpitsystem.c
++++ b/src/common/cockpitsystem.c
+@@ -107,6 +107,12 @@ cockpit_system_load_os_release (void)
+         }
+     }
+ 
++  gchar *value = g_hash_table_lookup (result, "SUSE_PRETTY_NAME");
++  if (!value || strlen(value) == 0) {
++    value = g_hash_table_lookup (result, "PRETTY_NAME");
++    g_hash_table_replace (result, g_strdup ("SUSE_PRETTY_NAME"), g_strdup (value));
++  }
++
+  out:
+   g_clear_error (&error);
+   g_free (lines);
+
+-- 
+2.50.0
+

0001-selinux-allow-login-to-read-motd-file.patch

@@ -7,11 +7,11 @@ Date:   Fri Aug 6 15:11:23 2021 +0200
 Index: cockpit/selinux/cockpit.te
 ===================================================================
 diff --git a/selinux/cockpit.te b/selinux/cockpit.te
-index 50695ee..55b1226 100644
+index 931cbd775..4a439c8d5 100644
 --- a/selinux/cockpit.te
 +++ b/selinux/cockpit.te
-@@ -224,6 +224,14 @@ optional_policy(`
+@@ -232,6 +232,14 @@ optional_policy(`
-     gnome_exec_keyringd(cockpit_session_t)
+     allow cockpit_session_t pidfs_t:filesystem getattr;
  ')
  
 +# login may read motd file through pam

0002-cockpit-kdump-support-SLE-micro-6.2.patch

@@ -0,0 +1,37 @@
+From 14b86b6d60b009c4294f06589a561e688ba49223 Mon Sep 17 00:00:00 2001
+From: Luna D Dragon <luna.dragon@suse.com>
+Date: Tue, 8 Jul 2025 14:58:25 +0530
+Subject: [PATCH 2/3] cockpit-kdump support SLE micro 6.2
+
+SLE micro 6.2 no longer has MicroOS in the NAME. This updates it to
+check if the VARIANT_ID is transactional to use transactional-update
+over manually enabling kdump.
+---
+ pkg/kdump/kdump-view.jsx | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/pkg/kdump/kdump-view.jsx b/pkg/kdump/kdump-view.jsx
+index eee4d16b1..7d8439f2b 100644
+--- a/pkg/kdump/kdump-view.jsx
++++ b/pkg/kdump/kdump-view.jsx
+@@ -421,7 +421,7 @@ export class KdumpPage extends React.Component {
+ kdumpctl reset-crashkernel`;
+         }
+         let shell;
+-        if (this.state.os_release.NAME?.includes('MicroOS')) {
++        if (this.state.os_release.NAME?.includes('MicroOS') || this.state.os_release.VARIANT_ID?.includes("transactional")) {
+             enableCrashKernel = `
+ # A reboot will be required if crashkernel was not set before
+ transactional-update setup-kdump`;
+@@ -443,7 +443,7 @@ ${enableCrashKernel}
+ 
+         Dialogs.show(
+             <ModificationsExportDialog
+-              ansible={ this.state.os_release.NAME?.includes('MicroOS') ? null : exportAnsibleTask(this.props.kdumpStatus.config, this.state.os_release)}
++              ansible={ (this.state.os_release.NAME?.includes('MicroOS') || this.state.os_release.VARIANT_ID?.includes("transactional")) ? null : exportAnsibleTask(this.props.kdumpStatus.config, this.state.os_release)}
+               shell={shell}
+               onClose={Dialogs.close}
+             />);
+-- 
+2.50.0
+

0003-branding-use-SUSE_SUPPORT_PRODUCT-and-SUSE_SUPPORT_P.patch

@@ -0,0 +1,136 @@
+From cfc476e5127ee3f21b70124e77ded9627e9692b5 Mon Sep 17 00:00:00 2001
+From: Luna D Dragon <luna.dragon@suse.com>
+Date: Tue, 8 Jul 2025 15:09:09 +0530
+Subject: [PATCH 3/3] branding: use SUSE_SUPPORT_PRODUCT and
+ SUSE_SUPPORT_PRODUCT_VERSION
+
+---
+ Makefile.am                    |  1 +
+ src/branding/suse/Makefile.am  | 11 +++++
+ src/branding/suse/branding.css | 82 ++++++++++++++++++++++++++++++++++
+ 3 files changed, 94 insertions(+)
+ create mode 100644 src/branding/suse/Makefile.am
+ create mode 100644 src/branding/suse/branding.css
+
+diff --git a/Makefile.am b/Makefile.am
+index 83f1ee7a7..1198d191e 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -167,6 +167,7 @@ include src/branding/debian/Makefile.am
+ include src/branding/default/Makefile.am
+ include src/branding/fedora/Makefile.am
+ include src/branding/opensuse/Makefile.am
++include src/branding/suse/Makefile.am
+ include src/branding/rhel/Makefile.am
+ include src/branding/ubuntu/Makefile.am
+ include src/client/Makefile.am
+diff --git a/src/branding/suse/Makefile.am b/src/branding/suse/Makefile.am
+new file mode 100644
+index 000000000..4a1e7ab72
+--- /dev/null
++++ b/src/branding/suse/Makefile.am
+@@ -0,0 +1,11 @@
++slemicrobrandingdir = $(datadir)/cockpit/branding/suse
++
++dist_slemicrobranding_DATA = \
++    src/branding/suse/branding.css \
++	$(NULL)
++
++install-data-hook::
++	ln -sf /usr/share/wallpapers/SLEdefault/contents/images/1920x1200.png $(DESTDIR)$(slemicrobrandingdir)/default-1920x1200.png
++	ln -sf /usr/share/pixmaps/distribution-logos/square-hicolor.svg $(DESTDIR)$(slemicrobrandingdir)/square-hicolor.svg
++	ln -sf /usr/share/pixmaps/distribution-logos/favicon.ico $(DESTDIR)$(slemicrobrandingdir)/favicon.ico
++	ln -sf /usr/share/pixmaps/distribution-logos/apple-touch-icon.png $(DESTDIR)$(slemicrobrandingdir)/apple-touch-icon.png
+\ No newline at end of file
+diff --git a/src/branding/suse/branding.css b/src/branding/suse/branding.css
+new file mode 100644
+index 000000000..c1617abc2
+--- /dev/null
++++ b/src/branding/suse/branding.css
+@@ -0,0 +1,82 @@
++/* Extra overrides */
++:root {
++    --eos-bc-green-500: #30ba78;
++    --eos-bc-pine-500: #0c322c;
++    --eos-bc-gray-50: #F2F2F2;
++    --eos-bc-white: #ffffff;
++    --eos-bc-text: #333;
++}
++
++
++#brand:before {
++    content: "${SUSE_PRETTY_NAME}";
++}
++
++#option-group svg polygon {
++    fill: var(--eos-bc-text);
++}
++
++/* Nav & sidebar overwrites */
++.navbar-pf {
++    background: var(--eos-bc-pine-500);
++}
++
++.navbar-pf-vertical {
++    border-top: none;
++}
++
++
++/* Default overrides */
++
++.login-note {
++    display: none;
++    position: relative;
++}
++
++body.login-pf {
++    background-color: var(--eos-bc-pine-500);
++}
++
++/* Only use background image on desktops */
++@media(min-width: 1024px) {
++    body.login-pf {
++        background-image: url("default-1920x1200.png") !important;
++        background-repeat: no-repeat;
++        background-position: 100% 0 !important;
++        background-size: cover;
++    }
++}
++
++/* Hide badge on desktops (already included in background) */
++@media(max-width: 1023px) {
++    #badge {
++        width: 51px;
++        height: 45px;
++        background-image: url("square-hicolor.svg");
++        background-repeat: no-repeat;
++    }
++}
++
++#brand {
++    width: auto;
++    height: auto;
++    background-image: none;
++    background-repeat: no-repeat;
++    font-size: 2em;
++    white-space: nowrap;
++}
++
++/* Switch to small font faster to not clip long name */
++@media(max-width: 560px) {
++    #brand {
++        font-size: inherit;
++    }
++}
++
++#index-brand {
++    font-weight: bold;
++}
++
++#index-brand:before {
++    content: "${PRETTY_NAME}";
++}
+\ No newline at end of file
+-- 
+2.50.0
+

0009-packagekit-reboot-notification.patch

@@ -0,0 +1,116 @@
+diff --git a/pkg/packagekit/updates.jsx b/pkg/packagekit/updates.jsx
+index ce4b3c4cc6d1..b423ee4c09bd 100644
+--- a/pkg/packagekit/updates.jsx
++++ b/pkg/packagekit/updates.jsx
+@@ -21,6 +21,7 @@ import 'polyfills'; // once per application
+ import 'cockpit-dark-theme'; // once per page
+ 
+ import cockpit from "cockpit";
++import { fsinfo } from 'cockpit/fsinfo';
+ import React from "react";
+ import { createRoot } from 'react-dom/client';
+ 
+@@ -1079,12 +1080,19 @@ class OsUpdates extends React.Component {
+                     debug("tracer parsed restartPackages:", JSON.stringify(restartPackages));
+                     this.setState({ checkRestartAvailable: true, checkRestartRunning: false, restartPackages });
+                 })
+-                .catch((exception, data) => {
++                .catch(async (exception, data) => {
+                     // tracer not installed or supported (like on Arch)? then fall back to dnf needs-restarting
+                     if (exception.message?.includes("ModuleNotFoundError") ||
+                         exception.message?.includes("UnsupportedDistribution")) {
+-                        debug('tracer not installed:', JSON.stringify(exception), "trying dnf needs-restarting");
+-                        return this.checkDnfNeedsRestarting();
++                        try {
++                            // if there's a history for zypper, we can assume the system uses it
++                            await fsinfo("/var/log/zypp/history", [], { superuser: "require" });
++                            debug('tracer not installed:', JSON.stringify(exception), "trying zypper ps");
++                            return this.checkZypperNeedsRestarting();
++                        } catch {
++                            debug('tracer not installed:', JSON.stringify(exception), "trying dnf needs-restarting");
++                            return this.checkDnfNeedsRestarting();
++                        }
+                     }
+ 
+                     // log the error except for some common cases: polkit does not allow it
+@@ -1106,6 +1114,80 @@ class OsUpdates extends React.Component {
+                 });
+     }
+ 
++    checkZypperNeedsRestarting() {
++        const restartPackages = { reboot: [], daemons: [], manual: [] };
++        return cockpit.spawn(["zypper", "ps", "-ss", "--print", "%s"], { err: "message", superuser: "require" })
++                .then((serviceOut) => {
++                    debug("zypper ps -ss succeeded:", serviceOut);
++
++                    // set all the services to be manually restarted since it's
++                    // not always clear if it's safe to restart them via cockpit
++                    const data = serviceOut.trim();
++                    if (data.length !== 0) {
++                        serviceOut.trim()
++                                .split("\n")
++                                .forEach(line => restartPackages.manual.push(line));
++                    }
++
++                    // Check if any kernels are updated since system boot,
++                    // ignoring kernel-firmware updates as they can make things noisy
++                    //
++                    // /var/log/zypper.log can be quite big so it's better to
++                    // handle the processing on machine instead of fetching the data
++                    const kScript = `
++                          stat -c %z /proc/ | \\
++                          cut -d. -f 1 | \\
++                          xargs -i \\
++                          awk -F'|' -v boot="{}" \\
++                          '/install\\|kernel/{if (boot <= $1 && index($0, "firmware") == 0) {print $3"-"$4"."$5}}' \\
++                          /var/log/zypp/history
++                          `;
++
++                    cockpit.script(kScript, undefined, { err: "message", superuser: "require" })
++                            .then(kernels => {
++                                debug("zypper kernel scripts succeeded:", kernels);
++
++                                if (kernels.trim().length == 0) {
++                                    return;
++                                }
++
++                                kernels.trim()
++                                        .split("\n")
++                                        .forEach(line => { restartPackages.reboot.push(line.trim()) });
++                            })
++                            .catch(ex => {
++                                if (ex.problem !== "not-found" &&
++                                // polkit does not allow it
++                                ex.problem !== "access-denied" &&
++                                // or unprivileged session
++                                ex.problem !== "authentication-failed" &&
++                                // or the session goes away while checking
++                                ex.problem !== "terminated")
++                                    console.error("zypper kernel fetching failed:", ex.toString());
++                            })
++                            .then(() => {
++                                let checkRestartAvailable = false;
++                                if (restartPackages.reboot.length !== 0 || restartPackages.manual.length !== 0)
++                                    checkRestartAvailable = true;
++
++                                this.setState({ checkRestartAvailable, checkRestartRunning: false, restartPackages });
++                            });
++                }).catch((ex) => {
++                    // log the error except for some common cases: no zypper
++                    if (ex.problem !== "not-found" &&
++                    // polkit does not allow it
++                    ex.problem !== "access-denied" &&
++                    // or unprivileged session
++                    ex.problem !== "authentication-failed" &&
++                    // or the session goes away while checking
++                    ex.problem !== "terminated")
++                        console.error("zypper ps -ss failed:", ex);
++
++                    // act like it's not available (demand reboot after every update)
++                    this.setState({ checkRestartAvailable: false, checkRestartRunning: false, restartPackages });
++                });
++    }
++
+     checkDnfNeedsRestarting() {
+         const restartPackages = { reboot: [], daemons: [], manual: [] };
+ 

check_cockpit_users

@@ -23,7 +23,7 @@ if [ $? -eq 0 ]; then
 fi
 
 if [ -f /etc/nsswitch.conf ]; then
-    grep -Exq "passwd:.*?compat systemd" /etc/nsswitch.conf
+    grep -Eq "passwd:.*systemd" /etc/nsswitch.conf
     if [ $? -ne 0 ]; then
         echo "/etc/nsswitch.conf is out of date, please update it from /usr/etc/nsswitch.conf to use cockpit"
         failed=true

cockpit.changes

@@ -1,3 +1,84 @@
+-------------------------------------------------------------------
+Thu Aug 14 04:53:41 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
+
+- Update to 344
+  * Changes since 340
+    - 344
+      * Bug fixes and translation updates
+    - 343
+      * login: Improve error message for unsupported shells
+      * cockpit: Handle file access issues with files in machines.d
+      * Translation updates
+    - 342
+      * systemd: ensure update() is called at least once for tuned-dialog
+      * Translation updates
+    - 341
+      * services: show link to podman page for quadlets
+      * Bug fixes and translation updates
+- Remove kdump-nfs-fixes.patch as this was upstreamed
+- Fix not falling back to PRETTY_NAME in SUSE_PRETTY_NAME patches bsc#1248446
+
+-------------------------------------------------------------------
+Wed Jul 30 03:21:48 UTC 2025 - Luna D Dragon <luna.dragon@suse.com>
+
+- drop duplicate %changelog macro
+
+-------------------------------------------------------------------
+Wed Jul 23 12:53:37 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
+
+- Add %postun for firewalld package to ensure the firewall state
+  remains as expected
+
+-------------------------------------------------------------------
+Mon Jul 21 11:39:56 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
+
+- Add cockpit-firewalld package for easily configuring the users
+  firewall jsc#PED-13228
+
+-------------------------------------------------------------------
+Tue Jul 15 07:00:10 UTC 2025 - Luna D Dragon <luna.dragon@suse.com>
+
+- add 0001-cockpit-overview-support-SUSE_SUPPORT_PRODUCT-keys.patch
+- add 0002-cockpit-kdump-support-SLE-micro-6.2.patch
+- add 0003-branding-use-SUSE_SUPPORT_PRODUCT-and-SUSE_SUPPORT_P.patch to fix bsc#1241003 
+
+-------------------------------------------------------------------
+Mon Jul 14 08:04:06 UTC 2025 - Luna D Dragon <luna.dragon@suse.com>
+
+- update check_cockpit_users to only check for systemd support in /etc/nsswitch.conf bsc#1246408
+
+-------------------------------------------------------------------
+Fri Jul 11 07:13:59 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
+
+- add a requirement on /usr/sbin/kdumptool for cockpit-kdump (bsc#1227402)
+
+-------------------------------------------------------------------
+Fri Jul 11 06:50:17 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
+
+- add libzypp-plugin-appdata dependency to cockpit-packagekit as
+  this will generate the swcatalog which it depends on for calculating
+  various cockpit packages
+
+-------------------------------------------------------------------
+Thu Jul 10 10:10:21 UTC 2025 - Miika Alikirri <miika.alikirri@suse.com>
+
+- Show reboot nofication after updates in packagekit
+  * Add 0009-packagekit-reboot-notification.patch
+
+-------------------------------------------------------------------
+Thu Jun 19 08:30:49 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
+
+- Add kdump-nfs-fixes.patch to fix bsc#1241949
+
+-------------------------------------------------------------------
+Mon Jun 16 06:29:04 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
+
+- Update to 340
+  * Detect multiple mount points when creating btrfs subvolumes
+  * Disk Self-Test error warnings on the overview page
+  * Prevent modifying partitions in unsupported places
+  * Bug fixes and translation updates
+
 -------------------------------------------------------------------
 Fri May 23 07:46:41 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
 

cockpit.pam

@@ -1,11 +0,0 @@
-#%PAM-1.0
-auth substack common-auth
-# List of users to deny access to Cockpit, by default root is included.
-auth    required pam_listfile.so item=user sense=deny file=/etc/cockpit/disallowed-users onerr=succeed
-account required pam_nologin.so
-account include common-account
-password include common-password
-session required pam_loginuid.so
-session optional pam_keyinit.so force revoke
-session include common-session
-auth [user_unknown=ignore success=ok] pam_oath.so usersfile=${HOME}/.pam_oath_usersfile no_usersfile_okay window=20 digits=6

cockpit.spec

@@ -38,6 +38,14 @@
 
 %define __lib lib
 
+%if 0%{?suse_version} > 1500
+%define pamconfdir %{_pam_vendordir}
+%define pamconfig tools/cockpit.suse.pam
+%else
+%define pamconfdir %{_sysconfdir}/pam.d
+%define pamconfig tools/cockpit.pam
+%endif
+
 %if %{defined _pamdir}
 %define pamdir %{_pamdir}
 %else
@@ -50,10 +58,9 @@ Summary:        Web Console for Linux servers
 License:        LGPL-2.1-or-later
 URL:            https://cockpit-project.org/
 
-Version:        338
+Version:        344
 Release:        0
 Source0:        cockpit-%{version}.tar.gz
-Source1:        cockpit.pam
 Source2:        cockpit-rpmlintrc
 Source3:        cockpit-suse-theme.tar
 Source4:        cockpit-no-pamoath.pam
@@ -80,6 +87,10 @@ Patch105:       fix-libexecdir.patch
 Patch106:       packagekit-single-install.patch
 Patch109:       0008-pybridge-endian-flag.patch
 Patch110:       add_preexec_cockpit.patch
+Patch111:       0001-cockpit-overview-support-SUSE_SUPPORT_PRODUCT-keys.patch
+Patch112:       0002-cockpit-kdump-support-SLE-micro-6.2.patch
+Patch113:       0003-branding-use-SUSE_SUPPORT_PRODUCT-and-SUSE_SUPPORT_P.patch
+Patch114:       0009-packagekit-reboot-notification.patch
 Patch201:       remove_rh_links.patch
 
 %define build_all 1
@@ -168,7 +179,6 @@ BuildRequires: xmlto
 
 %if 0%{?with_selinux}
 BuildRequires:  selinux-policy
-BuildRequires:  selinux-policy-%{selinuxtype}
 BuildRequires:  selinux-policy-devel
 %endif
 
@@ -187,6 +197,7 @@ Requires: cockpit-system
 # Optional components
 Recommends: (cockpit-storaged if udisks2)
 Recommends: (cockpit-packagekit if (dnf or zypper))
+Recommends: (cockpit-firewalld if firewalld)
 Suggests: python3-pcp
 
 %if 0%{?rhel} == 0
@@ -212,12 +223,19 @@ BuildRequires:  python3-pytest-timeout
 %setup -q -n cockpit-%{version} -a 3
 %patch -P 1 -p1
 %patch -P 2 -p1
+
+%if 0%{?is_opensuse} || 0%{?suse_version} < 1600
 %patch -P 3 -p1
+%else
+%patch -P  113 -p1
+%endif
+
 %patch -P 4 -p1
 %patch -P 5 -p1
 
 %patch -P 106 -p1
 %patch -P 109 -p1
+%patch -P 114 -p1
 
 # SLE Micro specific patches
 %if 0%{?is_smo}
@@ -240,15 +258,18 @@ BuildRequires:  python3-pytest-timeout
 
 %if 0%{?suse_version} >= 1600
 %patch -P 110 -p1
+%if !0%{?is_opensuse}
+%patch -P  111 -p1
+%patch -P  112 -p1
+%endif
 %endif
 
 %patch -P 201 -p1
 
-%if 0%{?suse_version} > 1500
+# If we're not using cockpit.suse.pam
-cp %SOURCE1 tools/cockpit.pam
+# Then we should always use source4's pam
-%else
 cp %SOURCE4 tools/cockpit.pam
-%endif
+
 #
 local-npm-registry %{_sourcedir} install --include=dev --ignore-scripts
 touch package-lock.json
@@ -284,20 +305,19 @@ bzip2 -9 cockpit.pp
 make -j$(nproc) check
 
 %if 0%{?rhel} == 0 && 0%{?suse_version} == 0
-%tox
+export NO_QUNIT=1
+%pytest
 %endif
 
 %install
+%if 0%{?suse_version}
+export NO_BRP_STALE_LINK_ERROR="yes"
+%endif
 # In obs we get  write error: stdout
 %make_install | tee make_install.log
 make install-tests DESTDIR=%{buildroot}
-%if 0%{?suse_version} > 1500
+mkdir -p $RPM_BUILD_ROOT%{pamconfdir}
-mkdir -p $RPM_BUILD_ROOT%{_pam_vendordir}
+install -p -m 644 %{pamconfig} $RPM_BUILD_ROOT%{pamconfdir}/cockpit
-install -p -m 644 tools/cockpit.pam $RPM_BUILD_ROOT%{_pam_vendordir}/cockpit
-%else
-mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/pam.d
-install -p -m 644 tools/cockpit.pam $RPM_BUILD_ROOT%{_sysconfdir}/pam.d/cockpit
-%endif
 rm -f %{buildroot}/%{_libdir}/cockpit/*.so
 install -D -p -m 644 AUTHORS COPYING README.md %{buildroot}%{_docdir}/cockpit/
 
@@ -411,14 +431,6 @@ rm -f %{buildroot}/%{pamdir}/mock-pam-conv-mod.so
 sed -i "s|%{buildroot}||" *.list
 
 %if 0%{?suse_version}
-# remove brandings with stale symlinks. Means they don't match
-# the distro.
-pushd %{buildroot}/%{_datadir}/cockpit/branding
-ls --hide={default,kubernetes,opensuse,registry,suse} | xargs rm -rv
-popd
-# need this in SUSE as post build checks dislike stale symlinks
-install -m 644 -D /dev/null %{buildroot}/run/cockpit/issue
-
 test -e %{buildroot}/usr/share/cockpit/branding/opensuse/default-1920x1200.jpg  || install -m 644 -D /dev/null %{buildroot}/usr/share/cockpit/branding/opensuse/default-1920x1200.jpg
 test -e %{buildroot}/usr/share/cockpit/branding/suse/apple-touch-icon.png  || install -m 644 -D /dev/null %{buildroot}/usr/share/cockpit/branding/suse/apple-touch-icon.png
 test -e %{buildroot}/usr/share/cockpit/branding/suse/default-1920x1200.png || install -m 644 -D /dev/null %{buildroot}/usr/share/cockpit/branding/suse/default-1920x1200.png
@@ -605,13 +617,10 @@ authentication via sssd/FreeIPA.
 %doc %{_mandir}/man8/pam_ssh_add.8.gz
 %dir %{_sysconfdir}/cockpit
 %config(noreplace) %{_sysconfdir}/cockpit/ws-certs.d
-%if 0%{?suse_version} > 1500
+# dir is not owned by pam in openSUSE needed for Leap15.6
-%{_pam_vendordir}/cockpit
+%dir %{pamconfdir}
-%else
-%config(noreplace) %{_sysconfdir}/pam.d/cockpit
-%endif
-# dir is not owned by pam in openSUSE
 %dir %{_sysconfdir}/motd.d
+%config(noreplace) %{pamconfdir}/cockpit
 # created in %post, so that users can rm the files
 %ghost %{_sysconfdir}/issue.d/cockpit.issue
 %ghost %{_sysconfdir}/motd.d/cockpit
@@ -777,7 +786,11 @@ SELinux policy module for the cockpit-ws package.
 Summary: Cockpit user interface for kernel crash dumping
 Requires: cockpit-bridge >= %{required_base}
 Requires: cockpit-shell >= %{required_base}
-Requires: kexec-tools
+%if 0%{?suse_version}
+Requires: /usr/sbin/kdumptool
+%else
+Requires: /usr/bin/kdumpctl
+%endif
 BuildArch: noarch
 
 %description kdump
@@ -787,6 +800,7 @@ The Cockpit component for configuring kernel crash dumping.
 %license COPYING
 %{_datadir}/metainfo/org.cockpit_project.cockpit_kdump.metainfo.xml
 
+# sosreport is not supported on opensuse yet
 %if !0%{?suse_version}
 %package sosreport
 Summary: Cockpit user interface for diagnostic reports
@@ -825,7 +839,6 @@ The Cockpit component for managing networking.  This package uses NetworkManager
 %endif
 
 %if 0%{?rhel} == 0 && ( 0%{?suse_version} >= 1500 || 0%{?is_smo} )
-
 %package selinux
 Summary: Cockpit SELinux package
 Requires: cockpit-bridge >= %{required_base}
@@ -896,6 +909,7 @@ Summary: Cockpit user interface for packages
 BuildArch: noarch
 Requires: cockpit-bridge >= %{required_base}
 Requires: PackageKit
+Requires: libzypp-plugin-appdata
 Recommends: python3-tracer
 # HACK: https://bugzilla.redhat.com/show_bug.cgi?id=1800468
 Requires: polkit
@@ -907,5 +921,31 @@ via PackageKit.
 %files -n cockpit-packagekit -f packagekit.list
 %license COPYING
 
+%package firewalld
+Summary: Allows Cockpit access through the firewall
+Requires: cockpit-bridge >= %{required_base}
+Requires: firewalld
+BuildArch: noarch
+
+%description firewalld
+This package allows Cockpit access through the firewall
+
+%files firewalld
+%license COPYING
+
+%postun firewalld
+if test -f %{_bindir}/firewall-cmd && firewall-cmd --state &>/dev/null; then
+    firewall-cmd --quiet --permanent --remove-service=cockpit && firewall-cmd --reload --quiet || true
+elif test -f %{_bindir}/firewall-offline-cmd; then
+    firewall-offline-cmd --quiet --remove-service=cockpit || true
+fi
+
+%posttrans firewalld
+if test -f %{_bindir}/firewall-cmd && firewall-cmd --state &>/dev/null; then
+    firewall-cmd --quiet --permanent --add-service=cockpit && firewall-cmd --reload --quiet || true
+elif test -f %{_bindir}/firewall-offline-cmd; then
+    firewall-offline-cmd --quiet --add-service=cockpit || true
+fi
+
 # The changelog is automatically generated and merged
 %changelog

css-overrides.patch

@@ -290,17 +290,17 @@ index f89f1fa47..5086ce1f6 100644
    <script src="../base1/po.js"></script>
    <script src="po.js"></script>
 diff --git a/pkg/systemd/services.html b/pkg/systemd/services.html
-index 74fa456d4..e9c7047ee 100644
+index a17e95e56..7eaa65efa 100644
 --- a/pkg/systemd/services.html
 +++ b/pkg/systemd/services.html
-@@ -5,6 +5,7 @@
+@@ -9,6 +9,7 @@
-     <meta charset="utf-8" />
-     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-     <link href="services.css" type="text/css" rel="stylesheet" />
-+    <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet" />
-     <script src="../base1/cockpit.js"></script>
      <script src="../base1/po.js"></script>
+     <script src="../manifests.js"></script>
      <script src="services.js"></script>
++    <link href="../../static/css-overrides.css" type="text/css" rel="stylesheet" />
+     <script src="po.js"></script>
+ </head>
+ 
 diff --git a/pkg/systemd/terminal.html b/pkg/systemd/terminal.html
 index ce7216e4e..63547f9d3 100644
 --- a/pkg/systemd/terminal.html

remove_rh_links.patch

@@ -1,8 +1,8 @@
 diff --git a/pkg/networkmanager/bond.jsx b/pkg/networkmanager/bond.jsx
-index 80956bd7b..de8e667aa 100644
+index b54b1db..062cd1d 100644
 --- a/pkg/networkmanager/bond.jsx
 +++ b/pkg/networkmanager/bond.jsx
-@@ -142,16 +142,6 @@ export const BondDialog = ({ connection, dev, settings }) => {
+@@ -151,16 +151,6 @@ export const BondDialog = ({ connection, dev, settings }) => {
                                        {_("A network bond combines multiple network interfaces into one logical interface with higher throughput or redundancy.")}
                                    </div>
                                }
@@ -20,10 +20,10 @@ index 80956bd7b..de8e667aa 100644
                                <Button id="bond-help-popup-button" variant="plain" aria-label="Help">
                                    <HelpIcon />
 diff --git a/pkg/systemd/hwinfo.jsx b/pkg/systemd/hwinfo.jsx
-index 30196f0dc..d53948374 100644
+index d2d2d9b..af0bedc 100644
 --- a/pkg/systemd/hwinfo.jsx
 +++ b/pkg/systemd/hwinfo.jsx
-@@ -201,11 +201,6 @@ const CPUSecurityMitigationsDialog = () => {
+@@ -205,11 +205,6 @@ const CPUSecurityMitigationsDialog = () => {
                              <DataListCell key="primary content">
                                  <span>
                                      <div className='nosmt-heading'>{ _("Disable simultaneous multithreading") } (nosmt)</div>
@@ -36,19 +36,19 @@ index 30196f0dc..d53948374 100644
                              </DataListCell>,
                          ]}
 diff --git a/pkg/systemd/overview-cards/cryptoPolicies.jsx b/pkg/systemd/overview-cards/cryptoPolicies.jsx
-index dc8b996ec..2f6fc8ac4 100644
+index fa57de9..d4dd3be 100644
 --- a/pkg/systemd/overview-cards/cryptoPolicies.jsx
 +++ b/pkg/systemd/overview-cards/cryptoPolicies.jsx
-@@ -115,7 +115,7 @@ const CryptoPolicyDialog = ({
+@@ -143,7 +143,7 @@ const CryptoPolicyDialog = ({
                      variant='link'
                      isInline
                      icon={<ExternalLinkSquareAltIcon />} iconPosition="right"
--                    href="https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/security_hardening/switching-rhel-to-fips-mode_security-hardening">
+-                    href="https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/security_hardening/using-the-system-wide-cryptographic-policies_security-hardening">
 +                    href="https://documentation.suse.com/sle-micro/6.0/html/Micro-selinux/selinux-article.html">
                  {_("Learn more")}
              </Button>
          </Flex>),
-@@ -154,16 +154,6 @@ const CryptoPolicyDialog = ({
+@@ -184,16 +184,6 @@ const CryptoPolicyDialog = ({
                      {_("Cryptographic Policies is a system component that configures the core cryptographic subsystems, covering the TLS, IPSec, SSH, DNSSec, and Kerberos protocols.")}
                  </div>
              }
@@ -66,10 +66,10 @@ index dc8b996ec..2f6fc8ac4 100644
              <Button variant="plain" aria-label={_("Help")}>
                  <HelpIcon />
 diff --git a/pkg/systemd/overview-cards/tuned-dialog.jsx b/pkg/systemd/overview-cards/tuned-dialog.jsx
-index 258f42640..3ec591cb7 100644
+index 5f3c3ffc1..b36ad88e3 100644
 --- a/pkg/systemd/overview-cards/tuned-dialog.jsx
 +++ b/pkg/systemd/overview-cards/tuned-dialog.jsx
-@@ -275,36 +275,10 @@ const TunedDialog = ({
+@@ -278,40 +278,13 @@ const TunedDialog = ({
          };
      }, [tunedService]);
  
@@ -102,7 +102,12 @@ index 258f42640..3ec591cb7 100644
          <Modal position="top" variant="medium"
                 className="ct-m-stretch-body"
                 isOpen
--               help={help}
                 onClose={() => dialogResult.resolve()}
-                title={_("Change performance profile")}
+         >
-                footer={
+-            <ModalHeader title={_("Change performance profile")}
+-                help={help}
+-            />
++            <ModalHeader title={_("Change performance profile")} />
+             <ModalBody>
+                 {error && <ModalError dialogError={typeof error == 'string' ? error : error.message} />}
+                 {loading && <EmptyStatePanel loading />}