Cockpit 0.90

This is a summary of the Cockpit weekly release. This week it was 0.90 Debian Source Packages ---------------------- As a step towards working getting Cockpit into Debian we now create Debian source packages during our continuous delivery process. These end up here for now: deb-src https://fedorapeople.org/groups/cockpit/debian-unstable ./ Content Security Policy ----------------------- Because the Cockpit javascript code has as much access to the system as the logged in user, Cockpit needs to make sure that attackers cannot sneak in javascript code into the browser session. Obviously we do this by escaping HTML output carefully and other best practices. But in addition to that we've started to deploy Content Security Policy. If you're unfamiliar with Content Security Policy it's a bit like SELinux for a browser session. It tells the browser we explicitly don't want to execute any code, styling or other resources that get loaded from Cockpit itself. We haven't turned on the strict policy for all of Cockpit yet, and we're doing it component by component. https://en.wikipedia.org/wiki/Content_Security_Policy https://github.com/cockpit-project/cockpit/pull/3334 Documentation about Cockpit start up ------------------------------------ The Cockpit start up has now been documented: http://cockpit-project.org/guide/latest/startup.html Vagrantfile working with VirtualBox ----------------------------------- The Cockpit development Vagrantfile works with VirtualBox, and apparently even works on Mac OS: http://stef.thewalter.net/cockpit-vagrantfile.html Get it ------ You can get Cockpit 0.90 in Fedora 23 or Fedora Rawhide: https://bodhi.fedoraproject.org/updates/FEDORA-2016-acdf3ab918 Or via COPR for CentOS, RHEL, and earlier versions of Fedora: https://copr.fedoraproject.org/coprs/g/cockpit/cockpit-preview/ Or download the tarball here: https://github.com/cockpit-project/cockpit/releases/tag/0.90 Happy new year! Stef