Making test-functions strict required some test adjustments where we
incorrectly expected an number while we receive in fact a string. As
getAttribute() returns either a string or null.
The anaconda WebUI branding symlinks point to files from fedora-logos.
Fedora < 46 does not ship those files, so the symlinks are
expected to dangle there.
On Debian testing dropping caches causes ext4 journal writes when
running grep on /usr. This caused CI to flake and made it unable to land
any changes to pkg/metrics.
Switching to dd and reading directly from the block device circumvents
these issues.
On Ubuntu uutils does not properly support iflag=direct, so we keep
using GNU dd:
dd if=/dev/vda of=/dev/null bs=4096 count=1 iflag=direct
dd: IO error: Invalid input
Ability to select individual updates, making updating more flexible.
The selection of individual updates is implemented by using a context
provider and a simple reducer to make UI updates more snappy. A more
naive approach that requires re-rendering the whole state every time
update is (un)selected will freeze up the UI for multiple seconds if
there are hundreds of updates. And for tens of seconds if there are
thousands of updates.
On our new test infrastructure, we have enough CPU/Memory overhead to
spin up without running into issues.
This sleep was very problematic as it made skipping destructive tests
take 15 seconds in total. On an Arch test run 5 skipped tests takes up 1
minute of idle waiting time.
Before this change Cockpit would show the TPM2 slot as "Unknown type",
now we at least show that this slot is configured to use a TPM module
and parse, make additional information available for the UI to later
show if the data is sealed to a Platform Configuration Register (PCR)
state.
Only support removing not editing a TPM2 slot as Cockpit does not
support creating a TPM2 slot.
The Testing Farm has no /dev/tpm available so testing is skipped there.
Resolves: https://redhat.atlassian.net/browse/RHEL-167807
`nmcli dev del` allows passing multiple devices that should be deleted.
Reduce the amount of calls required.
This also handles v_eth better which are represented by two devices but
once either is deleted both are removed automatically.
For devices managed by NetworkManager `ip link del` may not be enough
and NM brings the device back. Since `add_veth` is used to create a
virtual device managed by NM use `nmcli` to delete it instead.
In our CI packagekit holds a lock on /var/lib/apt/lists/lock while we
try to run apt-get clean. Make sure PackageKit is stopped before we
invoke any apt commands.
Only on Debian/Ubuntu is the package manager cache shared with
PackageKit on all other OSes PackageKit uses a separate cache directory.
From our logs:
Warning: The unit file, source configuration file or drop-ins of packagekit.service changed on disk. Run 'systemctl daemon-reload' to reload units.
In our CI this test sometimes flakes on fedora-44/devel, due to the
automatic updates button to still be disabled. To give our tests more
time to wait on PackageKit/dnf5 to finish, first assert the page loaded.
chronyd runs as an unprivileged system user. With a tight umask,
Cockpit created /etc/chrony/sources.d and cockpit.sources as 750/640
root:root, so chronyd could not read NTP servers set in the UI.
Force 755/644 independently of the session umask, matching the
timesyncd fix. Cover it in testTimeServersChronyd with umask 077.
Resolves: RHEL-253609
Assisted-by: LLM
Co-authored-by: Freya Gustavsson <freya@venefilyn.se>
While we have `atob` and `btoa` it doesn't support anything other than
Latin1, which causes issues for mountpoint names that exceed what Latin1
supports - such as Chinese.
Tests were updated with a new Chinese name, this caused a reordering of
the modal and subsequently had to be updated in the tests. The Chinese
mount name "数据资料" roughly translates to data and information
according to DeepL.
Fixes: https://github.com/cockpit-project/cockpit/issues/23783
Signed-off-by: Freya Gustavsson <freya@venefilyn.se>
RHEL does not have this package and it was accidentally available on
ELN. Solves Testing Farm failing with:
No match for argument: kernel-modules-internal
Within account details there is a select dropdown to select groups for a
user. This was meant to be sorted by `isAdmin` field, followed by
alphabetical order. In reality the alphabetical sorting wasn't done
correctly and we got strange sorting. On top of that, the `isAdmin` sort
method didn't take into consideration sorting the groups with `isAdmin`
set to true.
Fixes: https://github.com/cockpit-project/cockpit/issues/22909
Signed-off-by: Freya Gustavsson <freya@venefilyn.se>
In pixel-test changes on new tasks container (2026-10-03) our hack to
hide scrollbars in pixeltests stopped working.
Setting `overflow-y: clip` both on `main` and on .pf-v6-c-page__main-container
makes this hack work again.
This wasn't necessary earlier since machine.audit_messages() doesn't
seem to actually find any audit messages.
(For Fedora, see https://github.com/cockpit-project/bots/issues/9468.
Other images have similar problems, apparently.)
If we fix this, explicitly allowing the expected messages is
necessary.
Commit fd35533544 was insufficient, it only fixed one
scenario where we have to exclude tests, while storage-{basic,extra} and
main are left unfixed as they still ran teaming/btrfs tests.
The ubuntu-stable image is being retired (cockpit-project/bots#9447,
cockpit-project/bots#9453), so its test-side workarounds are now dead
code:
- has_sudo_rs no longer needs to exclude ubuntu-stable; every
remaining ubuntu* image ships sudo-rs.
- the lintian missing-debian-watch-file-standard suppression only
needs debian-trixie now.
Assisted-by: claude
There is something unknown going on that makes using a real mouse
click unreliable. Maybe the menu is being animated and the click
misses the menu item while it is flying around, or maybe something
else. We don't want to test the menu here, we just want to log out.
Resets the transaction and returns if the problems found are only that
the packages are already installed. Since `check_missing_packages` just
checks and doesn't install it shouldn't fail if all packages that are
being checked are installed.
Fixes: https://github.com/cockpit-project/cockpit/issues/23717
Signed-off-by: Freya Gustavsson <freya@venefilyn.se>
It is very unlikely that vendor/bug/cve urls can be tempered with, it
requires messing with a Bodhi update or repodata. But we already have a
function to validate urls so do our due diligence and also filter out
invalid urls from the package update information.
Our Remarkable (markdown parser) link_open copied the package update
description urls directly into the DOM allowing cross site scripting via
for example mouse or click handlers. This issue is prevented by our
Content Security Policy but sanitizing is still an additional measure we
should apply.
Setting the href via `setAttribute` properly escapes extra options such
as `onmouseover`. Additionally this commit will filter out unwanted URL
schemes such as `javascript:` to prevent those from becoming another
exploit vector. Other code constructing anchor elements can also reuse
this helper to filter out unwanted URL schemes.
Resolves: COCKPIT-1899
Resolves: CVE-2026-91148
Anaconda and Blivet currently don't support using Clevis/Tang
encryption with Stratis so we shouldn't allow users creating
Stratis pools with Clevis encryption.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
