Fedora 45 ships November 3 with GNOME 51, kmscon, and mandatory RPM signature checks
On November 3, 2026, Fedora Linux 45 is delivered after two delays, bringing GNOME 51, the Linux 7.2 kernel, and a notable hardening: mandatory RPM signatures, reproducible builds, and ptrace restricted by default. Administrators should prepare for enforced package signature verification and the move of RPM repository configs out of /etc.
November 3, 2026. Fedora Linux 45 lands on the mirrors, after Aoife Moloney, the project’s operations architect, confirmed that the RC-1.4 candidate passed every shipment bar. November 3, 2026, same day. The “GO” comes after two consecutive delays: a missed compose in early October, then an October 22 date that died on a cluster of blocker bugs. November 3, 2026, again. The release carries GNOME 51, KDE Plasma 6.8.1, the Linux 7.2 kernel, and, more importantly, platform hardening: mandatory RPM signatures, reproducible builds, and ptrace restricted by default. The headline fits in one line: for the first time, the security of the install chain is no longer an option you turn on — it is the default.
For an administrator, Fedora 45 is not just a new set of packages. It is a change of contract on package signing and repository locations, one to prepare for before the upgrade.
The GO that took two weeks to arrive
The green light is a relief more than a surprise. The release slipped twice: an early-October target skipped because the compose was not finished, then an October 22 target was dropped over a pile of blocker bugs — an AArch64 server image that ran over its size limit, and an LVM auto-activation failure after upgrading a LUKS-backed install. The following week Adam Will, the QA lead, walked the room through the last candidate blockers in a public meeting on the #fedora-meeting Matrix channel, from 18:02 to 19:28 UTC.
Two cases reveal the process. The SSH passphrase bug (#2558595), which broke auto-unlock at login after upgrading from Fedora 44, was rejected as a blocker: the core function works, and the fix is already in the candidates. The real blocker, the Stratis encrypted-pool boot failure (#2543511), was 80 percent fixed in RC-1.3 and fully fixed in RC-1.4. “All blockers have been addressed,” Will concluded. Fedora would rather ship late and right than on time and broken — which is exactly why the GO carries weight.
What actually changes under the hood
The most visible change is GNOME 51 on the Workstation edition and KDE Plasma 6.8.1 on the KDE edition, on a Linux 7.2 kernel. But this cycle is mostly about platform-level shifts.
kmscon replaces fbcon — the in-kernel virtual terminal — with a userspace solution, generally more capable and more secure. ptrace is restricted by default: an unprivileged process can no longer inspect other processes, the kind of door malware likes to exploit; full functionality returns via a sysctl once debugging tools are installed. Signature checking becomes enforced in RPM, following RPM 6.0: a package must carry a verified signature to install, unless explicitly overridden. And builds become fully reproducible, strengthening supply-chain trust.
The installer gains Stratis storage support, including Kickstart automation and partitioning through Cockpit Storage. Atomic desktops get a new WebUI installer replacing the old GTK-based Anaconda, with remote installation over HTTPS using PIN-based authentication.
The toolchain is current: GCC 16.2, Python 3.15, Glibc 2.44, LLVM 23, RPM 6.1, Go 1.27. MySQL 9.7 and MariaDB 12.3 become the defaults. Two structural changes pass quietly but matter: RPM repository configs migrate from /etc to /usr, and oo7 becomes the default Secrets service provider, pulling desktops away from GNOME Keyring.
Why mandatory signatures are the real story
The change worth an administrator’s attention is not GNOME 51: it is the mandatory signature check. Until now, installing an unsigned package was a warning you could ignore. Now the package refuses to install. The consequences are concrete.
Third-party repositories that do not sign their packages properly, home-grown install scripts that drop raw .rpm files, and tools that bypassed verification will fail visibly. That is exactly the point: make the absence of a signature impossible to ignore. The trade-off, for teams that maintain internal repositories, is making sure their signing keys are deployed and valid before the migration.
Reproducible builds complete the picture: a package rebuilt from source produces the same binary. Two mechanisms — signing and reproducibility — answer two distinct supply-chain threats, substitution and tampering, and Fedora 45 turns both on by default. The ptrace restriction closes a local door malware uses to steal secrets or latch onto a legitimate process.
What to do now
Upgrading from Fedora 44 is the nominal path, but a few checks avoid surprises on the day.
- Audit third-party repositories. Inventory every
.repoand its keys. A repository without a valid key will fail its packages after the migration. - Prepare internal tooling. Scripts that drop unsigned RPMs must either sign them or document an explicit override — best avoided.
- Understand the ptrace
sysctl. Teams that debug in production need to know the setting to re-enable it where necessary. - Test on an Atomic image. The switch from Anaconda to the WebUI installer changes deployment automation habits.
None of this blocks a fresh install. But a fleet-wide upgrade without this audit turns a welcome hardening into an outage on release day.
Verdict
The release is not judged on GNOME 51 but on the change of default: mandatory RPM signatures, reproducible builds, restricted ptrace. If you run a fleet of Fedora desktops, prepare the migration by auditing repositories and internal tooling before the switch — the value is real, but it is earned up front. If you run servers, the gains concentrate on the supply chain: a package that installs is now a package you can trace. The lesson outlives the distribution: the security that matters is no longer the one you configure, but the one that refuses to be turned off by default.