Fedora Linux 45 is out, and the most visible change for many users is a refusal. RPM, the low-level package tool, now rejects packages that lack a verified digital signature. Fedora published the release on November 3, 2026, in its official Fedora Linux 45 announcement on Fedora Magazine.
Most release coverage lists the new version numbers. This article focuses on what behaves differently after you upgrade, who will notice, and what to do about it.
What changes for you
Several Fedora 45 changes alter default behavior rather than just adding features. The table below sums up the ones most likely to surprise people, based on Fedora’s own change pages.
| Change | Who notices | What to do |
|---|---|---|
| RPM requires valid signatures | People installing local or self-built unsigned .rpm files | Sign packages, import the right keys, or use –nosignature |
| Repo files move to /usr | People who look for or edit files in /etc/yum.repos.d | Keep edits in /etc; packaged files now live in /usr/share/dnf5/repos.d |
| ptrace restricted for normal users | Developers using hand-built or script-based debugging tools | Install yama-ptrace-enable if a tool cannot attach |
| kmscon replaces fbcon on text consoles | Users of setfont, loadkeys or gpm | Configure /etc/kmscon/kmscon.conf instead |
| Two VPN plugins retired | Users of NetworkManager-vpnc or NetworkManager-fortisslvpn | Move connections to a supported plugin |
Unsigned packages now fail by default
Until now, RPM itself only checked that a package was intact by comparing hashes. DNF handled signature checks for repository packages. According to the signature enforcement change page, RPM now requires both a verified signature and a valid digest before it installs anything.
If you only install from Fedora or signed third-party repositories, nothing should change. Problems start with unsigned files, such as a package you built yourself. You can skip the check for one command with the –nosignature flag. To restore the old behavior system-wide, Fedora suggests a macro file such as /etc/rpm/macros.verify containing “%_pkgverify_level digest”. A repository set to gpgcheck=0 in DNF also still allows unsigned packages from that source.
Packagers who build locally may need to update their workflow. RPM 6.0 and later include an autosign helper at /usr/lib/rpm/rpm-setup-autosign, and mock has a signing plugin.
Repository files leave /etc
Fedora moved its packaged repository definitions from /etc/yum.repos.d to /usr/share/dnf5/repos.d. Its signing keys moved to /usr/share/pki/rpm-gpg. The repo relocation change page says unmodified files move automatically during the upgrade.
Files you edited stay in /etc and override the packaged version. As a result, /etc now shows only your own changes, which makes them easier to spot and undo. Fedora also notes that the older DNF4 and YUM no longer work as system package managers.
Debuggers need an extra package
Fedora 45 turns on the kernel’s Yama ptrace scope 1 by default. Normal users can then debug only their own child processes, not other running processes. Root is not affected. The ptrace restriction change page explains that gdb, strace, ltrace, lldb, delve, elfutils and systemtap pull in a package called yama-ptrace-enable. That package restores the old behavior. If you use a hand-compiled or script-based tool, install it yourself.
A new text console
Virtual terminals now use kmscon, a console that runs in user space, instead of the kernel’s fbcon. The kmscon change page lists better Unicode and font rendering, scrolling, and keyboard layouts that match the desktop. A kmscon crash restarts a service rather than causing a kernel panic. On the other hand, setfont, loadkeys and gpm no longer work, and starting a graphical session with startx needs a helper script. If kmscon fails to start, Fedora falls back to the old console.
Retired VPN plugins
The announcement says NetworkManager-vpnc and NetworkManager-fortisslvpn are obsolete starting with Fedora 45. Users should move their VPN connections to supported alternatives before relying on them.
Changes most people will not notice
Desktop users get oo7, a secrets service written in Rust, in place of GNOME Keyring as the default store for saved passwords. The oo7 change page says it migrates existing GNOME Keyring data automatically. Fedora cites scoped access for apps and limited secret access for sandboxed apps as benefits. The oo7 project documentation describes it as a Rust library with a D-Bus backend and an encrypted file backend.
Kernel crashes also get friendlier. Under the DRM Panic frontend change, the panic screen shows a QR code. Scanning it opens a Fedora web app that explains the error and pre-fills a Bugzilla report. Fedora says the crash data stays in the URL fragment, so no information leaves the phone.
Other user-facing additions include:
- Stratis storage support in the Anaconda installer, covered below.
- IPv6-mostly network support enabled by default in NetworkManager.
- chpasswd and newusers now follow system PAM password policies.
- Encapsule, a small tool for running untrusted developer tools in a container.
- The Lazarus IDE built with more widget sets than GTK2.
Editions and versions
Fedora ships Workstation, KDE Plasma Desktop, Server, Cloud, CoreOS and IoT editions. Atomic desktops include Silverblue, Kinoite and Sericea, and spins include Cinnamon, Xfce, MATE and COSMIC. When the beta arrived in September, Linuxiac reported Linux 7.2, GNOME 51 and KDE Plasma 6.7. Linuxiac also reported that Fedora CoreOS enables systemd-oomd and zram swap by default.
Fedora’s Fedora 45 change set lists these toolchain and package updates:
- GCC 16.2, binutils 2.47, glibc 2.44 and gdb 17.2
- LLVM 23, Go 1.27, Python 3.15, Perl 5.44 and Lua 5.5
- RPM 6.1, Ruby on Rails 8.1, Fontconfig 2.18 and IBus 1.5.35
- MySQL 9.7 and MariaDB 12.3 as distribution defaults
- Podman 6, which brings breaking API and CLI changes and drops slirp4netns, cgroups v1 and BoltDB
- Pandas 3 and setuptools 82, which removes pkg_resources
Technical details for admins and packagers
RPM 6.1 and Sequoia
The RPM 6.1 change page says NSS lookups for users and groups return by default. That helps sites that manage accounts centrally. A separate keystore lock lets queries run during transactions again. Macros gain new modifiers, and Fedora says the release has no intentional incompatibilities.
Packagers also get a new %openpgpverify macro. Per the Sequoia macro change page, it checks upstream source signatures with the Rust-based Sequoia tool instead of GnuPG. It supports post-quantum signatures. Fedora says it has no impact on end users.
Stratis in the installer
Anaconda can now install Fedora onto Stratis filesystems, including the root filesystem. The Stratis installer change page lists Kickstart support through autopart –type=stratis and new stratispool and stratisfs commands. In the web installer, you build the layout in the Cockpit storage editor. Boot partitions such as /boot stay outside the pool, and the older GTK installer gets no Stratis support. Default layouts do not change.
Atomic desktops and boot
Atomic desktop ISOs now use the web-based Anaconda installer, which also supports remote installs over HTTPS with PIN authentication. Fedora builds these ISOs with image-builder instead of lorax, according to the image-builder change page. Silverblue and Kinoite gain qcow2 virtual machine images and, on ARM64 only, raw images for single-board computers.
A related Flatpak filtering change lets atomic desktops limit visible Fedora Flatpaks and optionally enable a verified open-source subset of Flathub. Fedora warns that some users of Fedora Flatpaks may need to enable the full remote to keep getting updates.
Fedora also adds grub-cc, a minimal UEFI-only GRUB that boots Unified Kernel Images. The grub-cc change page says it targets virtual machines and confidential computing, and does not replace standard GRUB. A first phase also restricts the kernel’s Crypto Userspace API ahead of its planned upstream removal.
How to upgrade
- Check whether you install any unsigned local packages, and plan how to sign them or bypass the check.
- Move any VPN connection that uses vpnc or fortisslvpn plugins to a supported plugin.
- Follow Fedora’s offline upgrade guide linked from the announcement, or download fresh media from the Fedora Project website.
- Review the Common Issues list on Ask Fedora for known problems after upgrading.
What remains unclear
Fedora has not said how many atomic desktops will turn on the Flathub filter beyond Silverblue, which its change page expects to adopt it. The packaged kmscon may also lack mouse and screen rotation support for now. Users who rely on those console features should watch the change page before upgrading servers or kiosks.
