diff --git a/.cockpit.metadata b/.cockpit.metadata
index 3e9e1da..10cfa67 100644
--- a/.cockpit.metadata
+++ b/.cockpit.metadata
@@ -1 +1 @@
-2bd41c0c665037e937b1dc37a664c4a793b98195 SOURCES/cockpit-0.103.tar.xz
+4da5c385142bb7cf41fcd8a56a5c3ad4be780bd6 SOURCES/cockpit-0.108.tar.xz
diff --git a/.gitignore b/.gitignore
index a9086ad..5120c7e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-SOURCES/cockpit-0.103.tar.xz
+SOURCES/cockpit-0.108.tar.xz
diff --git a/SOURCES/0001-Makefile.am-fix-make-dist-from-tarballs.patch b/SOURCES/0001-Makefile.am-fix-make-dist-from-tarballs.patch
new file mode 100644
index 0000000..fa7a626
--- /dev/null
+++ b/SOURCES/0001-Makefile.am-fix-make-dist-from-tarballs.patch
@@ -0,0 +1,29 @@
+From cadee7a6670c42cddb0869f476327285aa5b219b Mon Sep 17 00:00:00 2001
+From: Lars Uebernickel <lars@uebernic.de>
+Date: Mon, 30 May 2016 17:45:27 +0200
+Subject: Makefile.am: fix make dist from tarballs
+
+When not inside a git checkout, `make dist` echos the directories to
+include. Tar expects them to be newline-separated.
+
+Fixes #4494
+---
+ Makefile.am | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Makefile.am b/Makefile.am
+index 9ec83da..d4cfab4 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -255,7 +255,7 @@ COMMITTED_DIST = \
+ 
+ # Build up the distribution using $COMMITTED_DIST and include node_modules and bower licenses
+ dist-hook: dist-doc-hook
+-	( cd $(srcdir); git ls-tree HEAD --name-only -r $(COMMITTED_DIST) || echo $(COMMITTED_DIST) ) | \
++	( cd $(srcdir); git ls-tree HEAD --name-only -r $(COMMITTED_DIST) || (echo $(COMMITTED_DIST) | tr ' ' '\n' ) ) | \
+ 		tar -C $(srcdir) -cf - -T - | tar -C $(distdir) -xf -
+ 	tar -C $(srcdir) -cf - --exclude='phantomjs*' --exclude='jshint*' node_modules/ | tar -C $(distdir) -xf -
+ 	echo $(VERSION) > $(distdir)/.tarball
+-- 
+1.8.3.1
+
diff --git a/SPECS/cockpit.spec b/SPECS/cockpit.spec
index 70dc18c..2c47a2e 100644
--- a/SPECS/cockpit.spec
+++ b/SPECS/cockpit.spec
@@ -4,7 +4,7 @@
 #
 
 %define branding auto
-%define tag 0.103
+%define tag 0.108
 %define rev 1
 
 %if %{defined gitcommit}
@@ -40,6 +40,8 @@ Source0:        cockpit-%{version}.tar.gz
 Source0:        https://github.com/cockpit-project/cockpit/releases/download/%{version}/cockpit-%{version}.tar.xz
 %endif
 
+Patch1:         0001-Makefile.am-fix-make-dist-from-tarballs.patch
+
 BuildRequires: pkgconfig(gio-unix-2.0)
 BuildRequires: pkgconfig(json-glib-1.0)
 BuildRequires: pkgconfig(polkit-agent-1) >= 0.105
@@ -64,7 +66,10 @@ BuildRequires: pcp-libs-devel
 BuildRequires: gdb
 
 %if %{defined gitcommit}
+# on fedora 24, nodejs provides npm
+%if 0%{?fedora} > 0 && 0%{?fedora} < 24
 BuildRequires: npm
+%endif
 BuildRequires: nodejs
 # For kerberos tests
 BuildRequires: krb5-server
@@ -146,8 +151,12 @@ The Cockpit Web Service listens on the network, and authenticates users.
 
 %prep
 %setup -q
+%patch1 -p1
 
 %build
+aclocal
+automake --add-missing
+autoconf
 exec 2>&1
 %configure --disable-silent-rules --with-cockpit-user=cockpit-ws --with-branding=auto --with-selinux-config-type=etc_t
 make -j4 %{?extra_flags} all
@@ -213,8 +222,6 @@ find %{buildroot}%{_datadir}/%{name}/ostree -type f >> ostree.list
 # on RHEL systems we don't have the required setroubleshoot-server packages
 %if 0%{?rhel}
 rm -rf %{buildroot}%{_datadir}/%{name}/selinux
-%elseif 0%{?centos_ver}
-rm -rf %{buildroot}%{_datadir}/%{name}/selinux
 %else
 echo '%dir %{_datadir}/%{name}/selinux' > selinux.list
 find %{buildroot}%{_datadir}/%{name}/selinux -type f >> selinux.list
@@ -384,7 +391,6 @@ Requires: %{name}-shell = %{version}-%{release}
 Requires: rpm-ostree >= 2015.10-1
 %else
 Requires: /usr/libexec/rpm-ostreed
-Requires: rpm-ostree-client >= 2015.11-1
 %endif
 
 %description ostree
@@ -497,9 +503,9 @@ pulls in some necessary packages via dependencies.
 %endif
 
 %changelog
-* Mon May 16 2016 Johnny Hughes <ohnny@centos.org> - 0.103-1
-- add in Requries rpm-ostree-client to cockpit-ostree for CentOS
-- modify to remove <name>/selinux for CentOS (as well as the original RHEL) 
+* Tue May 31 2016 Dominik Perpeet <dperpeet@redhat.com> - 0.108-1
+- Update to 0.108 release
+- Strict browser security policy for Cockpit is now enforced. This defines which code can be run in a Cockpit session and mitigates a number of browser based attacks.
 
 * Tue Apr 19 2016 Dominik Perpeet <dperpeet@redhat.com> - 0.103-1
 - Update to 0.103 release