Resets the transaction and returns if the problems found are only that
the packages are already installed. Since `check_missing_packages` just
checks and doesn't install it shouldn't fail if all packages that are
being checked are installed.
Fixes: https://github.com/cockpit-project/cockpit/issues/23717
Signed-off-by: Freya Gustavsson <freya@venefilyn.se>
It is very unlikely that vendor/bug/cve urls can be tempered with, it
requires messing with a Bodhi update or repodata. But we already have a
function to validate urls so do our due diligence and also filter out
invalid urls from the package update information.
Simplify the code by creating new variables for urls and use them
consistently through the code. In a follow up commit we will make use of
this to filter bad/malicious urls.
Our Remarkable (markdown parser) link_open copied the package update
description urls directly into the DOM allowing cross site scripting via
for example mouse or click handlers. This issue is prevented by our
Content Security Policy but sanitizing is still an additional measure we
should apply.
Setting the href via `setAttribute` properly escapes extra options such
as `onmouseover`. Additionally this commit will filter out unwanted URL
schemes such as `javascript:` to prevent those from becoming another
exploit vector. Other code constructing anchor elements can also reuse
this helper to filter out unwanted URL schemes.
Resolves: COCKPIT-1899
Resolves: CVE-2026-91148
After the introduction of generating JavaScript translation files for
manifest files we now parse our PO files twice. Additionally we also
parse them again for every `config.subdirs` although parsing PO files
does not depend that configuration option. With these two improvements
building is now 2x as fast.
We didn't adhere to the standard fully and missed one spot where we used
capital K instead of lowercase one. Although the style is that all
suffixes use capital letter, kilobit is special in that it would
otherwise showcase Kelvin in it - which is why it is lowercase k.
Fixes: https://github.com/cockpit-project/cockpit/issues/23716
Signed-off-by: Freya Gustavsson <freya@venefilyn.se>
Anaconda and Blivet currently don't support using Clevis/Tang
encryption with Stratis so we shouldn't allow users creating
Stratis pools with Clevis encryption.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
On Ubuntu TestStorageResize flakes waiting on the "TEST" volume group to
be created likely missing an udev event. Apply the same workaround from
`testUnsupported` to resolve this, we are testing resizing not udev
events in this test.
This is asking for trouble, and the test has indeed started to fail
with
Cannot seek to the begin of the file. lseek(13, 0, SEEK_SET) error: Illegal seek
on rhel-8-10.
Some of the manipulations triggered by property updates might
accidentally remove the focus, so we put it back at the end, but only
when we had the focus at the start.
Switch to a virtual network interface so the test can run without an
extra virtual machine. DHCP isn't required for the tests as they just
test changing a MAC address.
This allows us in the next commit to move the RestartServices component
out to its own file with the goal to shrink `updates.jsx` to a more
reasonable line and component count.
Added benefit is that the two components are now in TypeScript making it
easier to convert `updates.jsx` to TypeScript.
Make some changes to the gh-project workflows:
- merge them into one. We're gonna be copying this around a lot, so we
may as well make it a bit easier. Keeps things as DRY as they can
be, given the circumstances.
- use the `gh-project` environment (there has never been a global
`GH_PROJECTS` secret and we don't want to add one)
- change to using `pull_request_target` instead of `pull_request`: we
don't get access to the environment (and secret) otherwise. This is
generally considered bad practice but it's pretty safe here since we
never check out the PR's code.
- add a comment about the 3 other approaches we tried/considered
Skip two DBus calls for tests which don't request either of these
properties. Only a handful of tests use these properties out of the 120
storage tests.
This is a "standard" desktopy File Chooser dialog.
It can be used directly with Dialogs.show:
Dialogs.show(
<FileChooser
title={"Select a file that starts with \"foo\""}
actionLabel="Load"
action={loadFile}
filters={
[
{
label: "TXT files",
filter: (name, type) => type === "reg" && !!name.match("\\.txt$")
},
]
}
shortcuts={
...
}
collections={
...
}
/>
)
Or as part of a specialized TextInput that can replace the
FileAutoComplete component:
<DialogFileChooserInput
label="File"
field={dlg.field("file")}
fileChooserProps={
{
title: "Select a file",
superuser: "try",
filters: [
...
],
shortcuts: [
...
],
collections: [
...
]
}
}
/>
CPUTemperatureSampler.sample() uses `return` where it means `continue`.
A reading of 0 is not recorded, but instead of skipping just that one
value the `return` aborts the whole loop, so every sensor after it in
os.listdir() order is dropped as well.
Since that order is not guaranteed, the CPU temperature graph loses a
varying number of lines from one boot to the next — possibly all of
them.
Add a regression test with a hwmon device that reports 0.
The new AWS infrastructure runs more tests in parallel so converting a
long test in two and making it non destructive should help with that
added parallelism. Additionally it benefits developers running
`TestSystemInfo.testBasic` locally without having to wait for 147
seconds for it to complete, it now takes 22 seconds in a X1 carbon (2025
model).
The error thrown by reset() said "LongRuningProcess" with a single 'n'.
The two sibling errors in run() and terminate(), and the class itself,
all spell it "LongRunningProcess".
codespell does not catch this because pyproject.toml excludes ./pkg from
its scan.
Adds `bot` label so it gets picked up by workflows that utilize the
`bot` label, such as `gh-project-add-prs`
Signed-off-by: Freya Gustavsson <freya@venefilyn.se>
Adds all new issues to GH project as-is. Any filtering that needs to be
done should be done so through labels that are added to issues or their
linked PRs.
Bot PRs are added when they are labeled with `bot` label as well since
they are very frequent and rarely lack separate issue tracking.
Signed-off-by: Freya Gustavsson <freya@venefilyn.se>
This test got added in f72324702d ("bots: Allow arbitrary destination
image names with image-customize") and expanded a couple of times. This
was before the `bots/` directory got split out from the main Cockpit
repository in 91d73df7df ("bots: Move bots and related tasks over to
cockpit-project/bots").
Whether this was overlooked or intentionally left (because the test
required /dev/kvm and we didn't want to run full tests runs in the bots
repo) isn't clear. What is clear is that this test is entirely testing
things that exist in the bots repository (image-customize and the
machines API) and should be run when changes are made to those things,
not whenever a change is made to Cockpit.
Since we now have `/dev/kvm` in GitHub Actions runners, we can run
virtual machine tests there. We have ported this test over in
https://github.com/cockpit-project/bots/pull/9394 and can drop it from
here.
