diff --git a/.gitignore b/.gitignore
index 23307db..edffff4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -102,3 +102,4 @@
 /cockpit-131.tar.xz
 /cockpit-132.tar.xz
 /cockpit-133.tar.xz
+/cockpit-135.tar.xz
diff --git a/cockpit.spec b/cockpit.spec
index 56f83e7..3ab72cd 100644
--- a/cockpit.spec
+++ b/cockpit.spec
@@ -1,5 +1,5 @@
 # This spec file has been automatically updated
-Version:	133
+Version:	135
 Release: 1%{?dist}
 #
 # This file is maintained at the following location:
@@ -61,14 +61,12 @@ BuildRequires: zlib-devel
 BuildRequires: krb5-devel
 BuildRequires: libxslt-devel
 BuildRequires: docbook-style-xsl
-BuildRequires: keyutils-libs-devel
 BuildRequires: glib-networking
 BuildRequires: sed
 BuildRequires: git
 
 BuildRequires: glib2-devel >= 2.37.4
 BuildRequires: systemd-devel
-BuildRequires: polkit
 BuildRequires: pcp-libs-devel
 BuildRequires: krb5-server
 BuildRequires: gdb
@@ -127,6 +125,7 @@ machines.
 # Apply patches using git in order to support binary patches. Note that
 # we also reset mtimes since patches should be "complete" and include both
 # generated and source file changes
+# Keep this in sync with tools/debian/rules.
 if [ -n "%{patches}" ]; then
 	git init
 	git config user.email "unused@example.com" && git config user.name "Unused"
@@ -167,8 +166,10 @@ echo '%{_sysconfdir}/cockpit/machines.d' >> base.list
 %if %{defined build_dashboard}
 echo '%dir %{_datadir}/%{name}/dashboard' >> dashboard.list
 find %{buildroot}%{_datadir}/%{name}/dashboard -type f >> dashboard.list
+find %{buildroot}%{_datadir}/%{name}/ssh -type f >> dashboard.list
 %else
 rm -rf %{buildroot}/%{_datadir}/%{name}/dashboard
+rm -rf %{buildroot}/%{_datadir}/%{name}/ssh
 touch dashboard.list
 %endif
 
@@ -236,6 +237,7 @@ echo '%dir %{_datadir}/%{name}/kubernetes' > kubernetes.list
 find %{buildroot}%{_datadir}/%{name}/kubernetes -type f >> kubernetes.list
 %else
 rm -rf %{buildroot}/%{_datadir}/%{name}/kubernetes
+rm %{buildroot}/%{_libexecdir}/cockpit-stub
 touch kubernetes.list
 %endif
 
@@ -273,9 +275,7 @@ cat kdump.list subscriptions.list sosreport.list networkmanager.list selinux.lis
 
 %package bridge
 Summary: Cockpit bridge server-side component
-Obsoletes: %{name}-daemon < 0.48-2
 Requires: glib-networking
-Requires: polkit
 
 %description bridge
 The Cockpit bridge component installed server side and runs commands on the
@@ -285,8 +285,7 @@ system on behalf of the web based user interface.
 %{_datadir}/%{name}/base1/bundle.min.js.gz
 %doc %{_mandir}/man1/cockpit-bridge.1.gz
 %{_bindir}/cockpit-bridge
-%attr(4755, -, -) %{_libexecdir}/cockpit-polkit
-%{_libdir}/security/pam_reauthorize.so
+%{_libexecdir}/cockpit-askpass
 
 %package doc
 Summary: Cockpit deployment and developer guide
@@ -332,7 +331,7 @@ The Cockpit components for managing software updates for ostree based systems.
 
 %package pcp
 Summary: Cockpit PCP integration
-Requires: %{name}-bridge = %{version}-%{release}
+Requires: %{name}-bridge >= 134.x
 Requires: pcp
 
 %description pcp
@@ -352,8 +351,7 @@ Cockpit support for reading PCP metrics and loading PCP archives.
 %package dashboard
 Summary: Cockpit SSH remoting and dashboard
 Requires: libssh >= %{libssh_version}
-Requires: cockpit-ws = %{version}-%{release}
-Provides: cockpit-ssh = %{version}-%{release}
+Provides: %{name}-ssh
 
 %description dashboard
 Cockpit support for remoting to other servers, bastion hosts, and a basic dashboard
@@ -369,11 +367,6 @@ test -f %{_bindir}/chcon && chcon -t cockpit_ws_exec_t %{_libexecdir}/cockpit-ss
 
 %package storaged
 Summary: Cockpit user interface for storage, using Storaged
-# Lock bridge dependency due to --with-storaged-iscsi-sessions
-# which uses new less stable /manifests.js request path.
-%if 0%{?rhel}
-Requires: %{name}-bridge >= %{version}-%{release}
-%endif
 Requires: %{name}-shell >= 122
 Requires: storaged >= 2.1.1
 %if 0%{?fedora} >= 24 || 0%{?rhel} >= 8
@@ -395,13 +388,11 @@ The Cockpit component for managing storage.  This package uses Storaged.
 %package system
 Summary: Cockpit admin interface package for configuring and troubleshooting a system
 BuildArch: noarch
-Requires: %{name}-bridge = %{version}-%{release}
+Requires: %{name}-bridge >= %{version}-%{release}
 Requires: shadow-utils
 Requires: grep
 Requires: libpwquality
 Requires: /usr/bin/date
-Provides: %{name}-assets
-Obsoletes: %{name}-assets < 0.32
 Provides: %{name}-realmd = %{version}-%{release}
 Provides: %{name}-shell = %{version}-%{release}
 Obsoletes: %{name}-shell < 127
@@ -431,7 +422,7 @@ This package contains the Cockpit shell and system configuration interfaces.
 %package tests
 Summary: Tests for Cockpit
 Requires: %{name}-bridge >= %{version}-%{release}
-Requires: %{name}-shell >= %{version}-%{release}
+Requires: %{name}-system >= %{version}-%{release}
 Requires: openssh-clients
 Provides: %{name}-test-assets
 Obsoletes: %{name}-test-assets < 132
@@ -450,7 +441,6 @@ Summary: Cockpit Web Service
 Requires: glib-networking
 Requires: openssl
 Requires: glib2 >= 2.37.4
-Obsoletes: cockpit-selinux-policy <= 0.83
 Requires(post): systemd
 Requires(preun): systemd
 Requires(postun): systemd
@@ -471,7 +461,6 @@ The Cockpit Web Service listens on the network, and authenticates users.
 %{_sbindir}/remotectl
 %{_libdir}/security/pam_ssh_add.so
 %{_libexecdir}/cockpit-ws
-%{_libexecdir}/cockpit-stub
 %attr(4750, root, cockpit-ws) %{_libexecdir}/cockpit-session
 %attr(775, -, wheel) %{_localstatedir}/lib/%{name}
 %{_datadir}/%{name}/static
@@ -598,6 +587,7 @@ Requires: %{name}-bridge >= 124.x
 Requires: %{name}-shell >= 124.x
 BuildRequires: golang-bin
 BuildRequires: golang-src
+Provides: cockpit-stub = %{version}-%{release}
 
 %description kubernetes
 The Cockpit components for visualizing and configuring a Kubernetes
@@ -606,11 +596,22 @@ cluster. Installed on the Kubernetes master. This package is not yet complete.
 %files kubernetes -f kubernetes.list
 %{_libexecdir}/cockpit-kube-auth
 %{_libexecdir}/cockpit-kube-launch
-
+%{_libexecdir}/cockpit-stub
 %endif
 
 # The changelog is automatically generated and merged
 %changelog
+* Wed Mar 15 2017 Stef Walter <<stefw@redhat.com>> - 135-1
+- It is now possible to use file descriptors passed over the DBus API
+- Add "Disks" tab to Virtual Machines
+- Hide the top navigation bar if empty, i.e. if dashboard is not available
+- Redesign the page menu and machine switcher
+- Show "Locked/Unlocked" indicator for privilege escalation in the top bar
+- Make privilege escalation work with sudo reauthorization
+- Add developer tool for closing active pages
+- Use official /etc/ssh/ssh_known_hosts for adding remotely managed machines
+- Connect to other machines with SSH via cockpit-bridge instead of cockpit-ws
+
 * Thu Mar 02 2017 Martin Pitt <<mpitt@redhat.com>> - 133-1
 
 - Remotely managed machines are now configured in /etc/cockpit/machines.d/*.json
diff --git a/sources b/sources
index d24e1eb..8020b65 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (cockpit-133.tar.xz) = 91381d5bb5293eb421f0a400e7b5b3b57260fcd1f45a05e15499c93a39d384bcddc86d1a473613e2af2278547c99a8bf06b1b8a85da5c2c7e0dad10043abbdfa
+SHA512 (cockpit-135.tar.xz) = cf1a3b643a89a197d3d45ee474f4d8e978cee950268b17f4b2e481671840c47b1f2ae1d42a1eb92b1fff022b0dc46213d13d3722bb639560a6c2e7553afaf62b