This is a summary of the Cockpit weekly release. This week it was 0.90
Debian Source Packages
----------------------
As a step towards working getting Cockpit into Debian we now create
Debian source packages during our continuous delivery process. These end
up here for now:
deb-src
https://fedorapeople.org/groups/cockpit/debian-unstable ./
Content Security Policy
-----------------------
Because the Cockpit javascript code has as much access to the system as
the logged in user, Cockpit needs to make sure that attackers cannot
sneak in javascript code into the browser session.
Obviously we do this by escaping HTML output carefully and other best
practices. But in addition to that we've started to deploy Content
Security Policy.
If you're unfamiliar with Content Security Policy it's a bit like
SELinux for a browser session. It tells the browser we explicitly don't
want to execute any code, styling or other resources that get loaded
from Cockpit itself.
We haven't turned on the strict policy for all of Cockpit yet, and we're
doing it component by component.
https://en.wikipedia.org/wiki/Content_Security_Policy
https://github.com/cockpit-project/cockpit/pull/3334
Documentation about Cockpit start up
------------------------------------
The Cockpit start up has now been documented:
http://cockpit-project.org/guide/latest/startup.html
Vagrantfile working with VirtualBox
-----------------------------------
The Cockpit development Vagrantfile works with VirtualBox, and
apparently even works on Mac OS:
http://stef.thewalter.net/cockpit-vagrantfile.html
Get it
------
You can get Cockpit 0.90 in Fedora 23 or Fedora Rawhide:
https://bodhi.fedoraproject.org/updates/FEDORA-2016-acdf3ab918
Or via COPR for CentOS, RHEL, and earlier versions of Fedora:
https://copr.fedoraproject.org/coprs/g/cockpit/cockpit-preview/
Or download the tarball here:
https://github.com/cockpit-project/cockpit/releases/tag/0.90
Happy new year!
Stef