Fedora 45 makes package signatures a default enforcement boundary

Fedora 45’s most consequential changes may appear when something does not install or when a debugging tool can no longer inspect another user’s process. The release, available November 3, turns stricter package-signature verification and tighter unprivileged process tracing into defaults.

The package change follows RPM 6.1’s enforcing signature-check behavior: a package must have a verified signature to install unless the user explicitly overrides the check. The security gain is a stronger default trust boundary. The operational consequence is that local or third-party packages with missing or invalid signatures will need investigation instead of quietly passing through an installation workflow.

That is a useful change for managed fleets, where “it installed” should include evidence about who signed the package. It can also surface old build pipelines that distribute unsigned RPMs. The right response is to repair provenance—sign artifacts and distribute the corresponding trusted key through an approved channel—not to normalize disabling verification everywhere.

Debugging becomes more deliberate

Fedora 45 also restricts ptrace access between unprivileged users by default. Process tracing is a powerful debugging capability, but it can expose information from another process. Tightening the default reduces an avenue for one local user’s process to inspect a sibling task owned by a different unprivileged user.

Developers may notice this when debuggers, profilers or diagnostic scripts stop attaching across user boundaries. First check the user and process ownership, then use the narrowest authorized debugging setup. A blanket system-wide relaxation would restore convenience by weakening the very boundary the change intends to establish.

These controls are not a substitute for patching or least privilege. They change the system’s starting posture. Administrators should test build agents, developer workstations and support runbooks against the new behavior, especially where package installation or cross-user tracing is automated.

Fedora 45 also brings storage into setup

The release integrates Stratis storage support into the Anaconda installer, including graphical and Kickstart workflows. For users planning managed storage layouts, that places more of the configuration path directly in installation. It is a separate feature from signature enforcement, but both reward teams that test their installation recipes before rolling an image across a fleet.

A practical upgrade plan is simple: inventory unsigned RPMs, verify signing keys and package sources, run debugger and profiler workflows under the intended account model, and validate automated installation recipes—including any Stratis configuration—in a disposable system. Record expected exceptions rather than carrying informal workarounds between machines.

Fedora 45’s shift is less about a dramatic new security product than about defaults that make integrity and process isolation harder to bypass accidentally. That is good system design when the surrounding tools and documentation explain the new boundary. Teams that prepare their packaging and debugging workflows can keep the protections without turning routine maintenance into guesswork. These default changes fit a broader security principle: build verification and observability into routine operations. Our guides to OpenSSH’s recent authentication issue and industrial system hardening show why deployment context matters.