In our CI packagekit holds a lock on /var/lib/apt/lists/lock while we
try to run apt-get clean. Make sure PackageKit is stopped before we
invoke any apt commands.
Only on Debian/Ubuntu is the package manager cache shared with
PackageKit on all other OSes PackageKit uses a separate cache directory.
From our logs:
Warning: The unit file, source configuration file or drop-ins of packagekit.service changed on disk. Run 'systemctl daemon-reload' to reload units.
In our CI this test sometimes flakes on fedora-44/devel, due to the
automatic updates button to still be disabled. To give our tests more
time to wait on PackageKit/dnf5 to finish, first assert the page loaded.
chronyd runs as an unprivileged system user. With a tight umask,
Cockpit created /etc/chrony/sources.d and cockpit.sources as 750/640
root:root, so chronyd could not read NTP servers set in the UI.
Force 755/644 independently of the session umask, matching the
timesyncd fix. Cover it in testTimeServersChronyd with umask 077.
Resolves: RHEL-253609
Assisted-by: LLM
Co-authored-by: Freya Gustavsson <freya@venefilyn.se>
Use the `update_packages` abstraction in the Software Updates page so
Cockpit can support dnf5daemon as well. This does not re-use
`get_running_updates` emits the same callbacks in `update_packages` now.
This to prevent us racing with `update_packages` to obtain the
transaction or as alternative having to expose PackageKit's internal
transaction DBus path.
The extra code duplication in the end isn't that much to consider the
alternatives.
Move the initial watching of updates to a new method which can be
implemented by PackageKit or DNF5Daemon. The current implementation
still returns a transaction_path which is PackageKit specific but for
now this is temporary until the next commit moves update_packages over
to the PackageManager API.
The DNF5Daemon implementation will have to wait until we have
update_packages() available.
While we have `atob` and `btoa` it doesn't support anything other than
Latin1, which causes issues for mountpoint names that exceed what Latin1
supports - such as Chinese.
Tests were updated with a new Chinese name, this caused a reordering of
the modal and subsequently had to be updated in the tests. The Chinese
mount name "数据资料" roughly translates to data and information
according to DeepL.
Fixes: https://github.com/cockpit-project/cockpit/issues/23783
Signed-off-by: Freya Gustavsson <freya@venefilyn.se>
The PackageKit UpdateDetail signal provides markdown in the
`update_text` and uses remarkable to parse the markdown contents.
Remarkable however has not been updated since 6 years, additionally it
requires us to use `dangerouslySetInnerHTML` which can lead to XSS
issues.
The npm ecosystem has two other markdown alternatives `react-markdown`
and a `markdown-to-jsx`. The latter has zero dependencies while
`react-markdown` has eleven and requires additional plugins like
`rehype-external-links` to add a rel/target to external links.
https://www.freedesktop.org/software/PackageKit/gtk-doc/Transaction.htmlhttps://github.com/jonschlinkert/remarkable/issues/438
RHEL does not have this package and it was accidentally available on
ELN. Solves Testing Farm failing with:
No match for argument: kernel-modules-internal
Within account details there is a select dropdown to select groups for a
user. This was meant to be sorted by `isAdmin` field, followed by
alphabetical order. In reality the alphabetical sorting wasn't done
correctly and we got strange sorting. On top of that, the `isAdmin` sort
method didn't take into consideration sorting the groups with `isAdmin`
set to true.
Fixes: https://github.com/cockpit-project/cockpit/issues/22909
Signed-off-by: Freya Gustavsson <freya@venefilyn.se>
In pixel-test changes on new tasks container (2026-10-03) our hack to
hide scrollbars in pixeltests stopped working.
Setting `overflow-y: clip` both on `main` and on .pf-v6-c-page__main-container
makes this hack work again.
Presuming that .po files are an untrusted input, the "Language" string
in the .po file header could easily be set to something like
" + console.log("pwned") + "
which would escape the naive application of double quotes to either side
of it by the plugin when inserting it into the header of the .po.js
file. Use JSON.stringify() to make sure we get the quoting right.
This might have been done in a separate file but cockpit-po-plugin is
currently standalone, so let's keep it that way. This file is imported
into external projects.
Add a test case that runs once on module import: it's cheap (~1-2ms).
CVE-2026-92769
Fixes: https://redhat.atlassian.net/browse/RHEL-219811
This wasn't necessary earlier since machine.audit_messages() doesn't
seem to actually find any audit messages.
(For Fedora, see https://github.com/cockpit-project/bots/issues/9468.
Other images have similar problems, apparently.)
If we fix this, explicitly allowing the expected messages is
necessary.
Commit fd35533544 was insufficient, it only fixed one
scenario where we have to exclude tests, while storage-{basic,extra} and
main are left unfixed as they still ran teaming/btrfs tests.
The ubuntu-stable image is being retired (cockpit-project/bots#9447,
cockpit-project/bots#9453), so its test-side workarounds are now dead
code:
- has_sudo_rs no longer needs to exclude ubuntu-stable; every
remaining ubuntu* image ships sudo-rs.
- the lintian missing-debian-watch-file-standard suppression only
needs debian-trixie now.
Assisted-by: claude
systemd can racily set up the instance socket. There is a window
during which connecting to the socket fails with EACCES.
Like ENOENT and ECONNREFUSED, this is transient and resolved
by retrying, so don't warn about it.
`msgcat` gives a warning nowadays stating that it is more for PO-files
and shouldn't be used for merging POT-files. Instead it recommends that
we use `xgettext` for that as `msgcat` could produce output that isn't
intended.
As a caveat to using `xgettext` for concatenating POT-files it also
throws errors when the set charset for the source POT-files differ from
each other. Some of the POT-files, namely `po/cockpit.js.pot` and
`po/cockpit.appstream.pot`, don't get charset configured correctly and
instead shows `charset=CHARSET` by default.
While this now includes `sed` replace for the charsets as a way to
force-configure it as UTF-8, efforts were made to solve the issue
using supported means. With the research I did I found that there are
`--from-code=UTF-8` which we already utilize and should tell `xgettext`
about the charset. If it detects anything that isn't UTF-8 it will
ignore the `--from-code` value AFAICT and therefore won't set the
charset. There has been attempts to find other solutions but non were found.
See-also: https://www.gnu.org/software/gettext/manual/html_node/msgcat-Invocation.html#Invoking-the-msgcat-Program
See-also: https://www.gnu.org/software/gettext/manual/html_node/Combining-POTs.html
Introduced-in: df13e4104f
Fixes: https://github.com/cockpit-project/cockpit/issues/23757
Signed-off-by: Freya Gustavsson <freya@venefilyn.se>
This prevents updates to source strings in pot file that only changes
the order in which the strings appear when a string is used in multiple
files.
Fixes: https://github.com/cockpit-project/cockpit/issues/23754
Signed-off-by: Freya Gustavsson <freya@venefilyn.se>
We should not try to control the "display" style of PatternFly
elements. They might have their own CSS rules for it with unknown
specificity.
Specifically, a DropdownItem has "display: flex" from PatternFly with
the same specificity as our "display: none" from the
".file-chooser-hide-on-wide" class. Which one is in effect seems to
be decided by the roll of a dice.
There is something unknown going on that makes using a real mouse
click unreliable. Maybe the menu is being animated and the click
misses the menu item while it is flying around, or maybe something
else. We don't want to test the menu here, we just want to log out.
