+++ This bug was initially created as a clone of Bug #2126038 +++

Description of problem:

Firefox Nightly now reports unsupported CSS selectors. Since that fix was implemented, Firefox Nightly users can no longer log in into Cockpit, the login page just shows:

   This web browser is too old to run the Web Console (missing selector(:is():where()))

This is due to a bad CSS capability check in Cockpit's login page.

See this issue for details: https://bugzilla.mozilla.org/show_bug.cgi?id=1790259

Chromium is affected in the same way.

Current *releases* of Firefox and Chromium are fine still, but it is expected that the upcoming versions will contain this change.

Version-Release number of selected component (if applicable):

cockpit-ws-275-1.el9

How reproducible: Always


Steps to Reproduce:
1. Try to log into Cockpit with Firefox nightly

Actual results: Login page shows the error above, login is not possible.

Expected results: Login should work normally.

This was reported upstream in https://github.com/cockpit-project/cockpit/issues/17724 and fixed in https://github.com/cockpit-project/cockpit/pull/17726

--- Additional comment from Martin Pitt on 2022-09-12 08:31:26 UTC ---

Requesting blocker+ for RHEL 9.1. I'll also clone this for 8.7. We will most probably also need to fix this in earlier RHEL releases in Z-stream.

--- Additional comment from RHEL Program Management on 2022-09-12 08:31:34 UTC ---

A request has been made to block the RHEL release until this bug has been addressed.  If you only meant to get a check-in exception please set "exception?" instead.  For blocker requests please follow the instructions in this comment to verify BZ accuracy and provide answers to 3 blocker review questions. You can fill out this form by clicking the [reply] link on this comment, and then reply in-line to this message.  Please do this even if you believe the case is obvious, or already covered in the BZ, as a way to make it easier for reviewers to approve this request.

Verify the following information is set in the BZ:
- Confirm the Internal Target Release field reflects which release to block

Answer the following 4 questions:
1. What is the scope of harm if this BZ is not resolved in this release?  Reviewers want to know which RHEL features or customers are affected and if it will impact any Layered Product or Hardware partner plans.
2. What are the risks associated with resolving this BZ?  Reviewers want to know the scope of retesting, potential regressions
3. Provide any other details that meet blocker criteria or should be weighed in making a decision (Other releases affected, upstream status, business impacts, etc).

4. Provide reasoning why this request is being solved after regular DTD cycle. This will help us to assess & improve the exception process.

--- Additional comment from Martin Pitt on 2022-09-12 08:42:22 UTC ---

> 1. What is the scope of harm if this BZ is not resolved in this release? 

It will not be possible to log into the Web Console any more once the current nightly Firefox/Chrome browsers get released and widely used.

> 2. What are the risks associated with resolving this BZ?  Reviewers want to
> know the scope of retesting, potential regressions

For Cockpit itself, changes to the login page's capability checks have the potential to break with older browsers. The current check is just plain wrong, and gets fixed to adhere to the W3C spec. But it needs to be tested with older and current Firefox, Chromium, and other browsers (in particular Safari).

For other RHEL components or RH products there is no regression potential. Cockpit has very few reverse dependencies -- the only known one is Foreman/Satellite, which has a [Web Console] button. But this is set up in a way to not ever show the login page, the user gets right into an authenticated Cockpit session. Specifically, the login page is for human users, it is not an API.

The fix is minimal, targeted, and very straightforward (at least to someone with some CSS background): https://github.com/cockpit-project/cockpit/pull/17726/files

> 3. Provide any other details that meet blocker criteria or should be weighed
> in making a decision (Other releases affected, upstream status, business
> impacts, etc).

The Web Console is a popular and widely announced RHEL feature; e.g. it gets a significant number of feature requests and support cases, is installed by default, and is even advertised in motd. As such, failure to log in would be a fairly embarassing and bad behaviour.

> 4. Provide reasoning why this request is being solved after regular DTD
> cycle. This will help us to assess & improve the exception process.

The change in Firefox nightly that exposed/caused this only happened 6 days ago (https://hg.mozilla.org/integration/autoland/rev/3e0a5d1881e9474173e0455972f35022be5192f6). The Cockpit bug was only found/reported yesterday, and a fix got available today.

--- Additional comment from Martin Pitt on 2022-09-12 08:45:49 UTC ---

We have the fix available, and can upload it to RHEL 9.1/8.7 within a day. I'm not entirely sure wrt. exception vs. blocker -- if the reviewers think that exception+ is more appropriate, that's of course fine for us as well.