# Fedora 45 ships with RPM 6.1 blocking unsigned packages

URL: https://techaiwire.com/articles/fedora-45-rpm-6-1-unsigned-packages-signature-check/

_By Claire Whitmore - Nov 4, 2026_

**By the numbers:**

- Nov 3 - release date, two weeks after the October 20 target
- RPM 6.1 - now refuses packages without a verified signature
- Dec 8, 2027 - end of support, per Fedora 45's own os-release file

Fedora Linux 45 shipped on November 3, 2026, and its package tool now refuses to install anything without a verified signature. That matters to anyone who builds their own RPM files or downloads one from a vendor's website. A command that worked on Fedora 44 now stops with an error.

The [Fedora Magazine announcement](https://fedoramagazine.org/announcing-fedora-linux-45/) promises "polished desktop upgrades, powerful new installer features, and updated toolchains." The release slipped twice from its October 20 target, [Linux Compatible reports](https://www.linuxcompatible.org/story/fedora-linux-45-officially-released-gnome-51-linux-72-kernel-and-breaking-changes). Each slip followed a "no-go" vote, when testers found a problem that blocked the release.

## What changed in RPM 6.1

RPM is the package format and installer under Fedora, Red Hat Enterprise Linux and their relatives. A signature is a cryptographic stamp. It proves who built a package and that nobody changed it since.

Fedora 45 "switches the default package verification mode in RPM 6.1 to enforcing signature checking by default," Fedora Project Leader Jef Spaleta writes on Red Hat's blog. The [Fedora change page](https://fedoraproject.org/wiki/Changes/Enforcing_signature_checking_by_default), owned by Panu Matilainen, puts it more plainly: "only packages with a verified signature can be installed."

The switch is one setting, `%_pkgverify_level`. It moves from `digest`, which only checks that the file is not damaged, to `all`, which also demands a valid signature. The change page says a package signed with a key the system has not imported fails too. Fedora first planned the switch alongside RPM 6.0 and postponed it to Fedora 45 "for time and resource reasons."

## Tested: one unsigned package on Fedora 44 and 45

In a Tech AI Wire test on macOS 26.6.2 with Docker Desktop 28.4.0, the official `fedora:44` and `fedora:45` container images ran the same unsigned test package. Both images were built on November 2 for arm64. The package, `taw-hello`, was built with `rpmbuild` inside Fedora 45 and carries no signature.

| Check | Fedora 44 | Fedora 45 |
| --- | --- | --- |
| `rpm --version` | 6.0.2 | 6.1.0 |
| `rpm --eval "%_pkgverify_level"` | digest | all |
| `rpmkeys --checksig` | "digests OK", exit 0 | "digests SIGNATURES NOT OK", exit 1 |
| `rpm -i` | installed, exit 0 | refused, exit 1 |
| `rpm -i --nosignature` | installed | installed |
| `dnf install` of the local file | installed, with a warning | installed, with a warning |

On Fedora 45, plain `rpm -i` printed one line and stopped:

```
$ rpm -i /pkgs/taw-hello-1.0-1.noarch.rpm
	package taw-hello-1.0-1.noarch does not verify: no signature
```

DNF, Fedora's higher-level package manager, behaved differently. On both releases, `dnf install` of the local file printed "Warning: skipped OpenPGP checks for 1 package from repository: @commandline" and installed it. So the new rule hits scripts and tools that call `rpm` directly, not a plain `dnf install`.

The test also confirmed the system-wide way back. After the line `%_pkgverify_level digest` went into `/etc/rpm/macros.verify`, Fedora 45's `rpm -i` installed the unsigned package again.

## Four ways to install a local package now

The change page lists the supported routes. Each fits a different case:

- **A one-off install:** add `--nosignature` to the `rpm` command, or use `dnf install`, which skipped the check in the test above.
- **Your own builds:** RPM 6.0 and later can sign local builds automatically with a passwordless key. Mock, Fedora's clean-room build tool, has a signing plugin. COPR, Fedora's community build service, signs packages on its own.
- **A vendor's packages:** import the vendor's signing key, so its signature verifies. DNF5 version 5.2.14.0 or newer can also turn the check off for one repository with `gpgcheck=0`.
- **The whole system:** the `macros.verify` line above restores the old behavior. It also removes the protection, so treat it as a last resort.

## Other Fedora 45 changes that can break scripts

The same containers asked Fedora's package repositories on November 4 which versions each release offers on arm64:

| Package | Fedora 44 | Fedora 45 |
| --- | --- | --- |
| Python | 3.14.10 | 3.15.0 |
| Go | 1.26.10 | 1.27.3 |
| LLVM | 22.1.8 | 23.1.4 |
| glibc | 2.43 | 2.44 |
| Perl | 5.42.3 | 5.44.0 |
| Podman | 5.8.9 | 6.1.3 |
| MySQL server | 8.4.10 | 9.7.2 |
| MariaDB server | 11.8.8 | 12.3.2 |
| pandas | 2.3.3 | 3.0.6 |
| GCC | 16.2.1 | 16.2.1 |
| Linux kernel | 7.2.15 | 7.2.15 |

Fedora 45 still offers MySQL 8.4 as a separate `mysql8.4-server` package, version 8.4.11. Four more changes can break existing setups:

- **Repository files moved.** In the Fedora 45 image, `/etc/yum.repos.d/` is empty and Fedora's repo files sit in `/usr/share/dnf5/repos.d/`. Linux Compatible warns that scripts using the old paths will break.
- **Podman 6** drops slirp4netns, cgroups v1 and the BoltDB database backend, according to Fedora's change list. Linux Compatible says to move to SQLite and use `--network=pasta`.
- **Debugging:** ptrace, the kernel hook that debuggers use, is now restricted for unprivileged users, Red Hat's post says. Installing debugging packages turns normal tracing back on.
- **Two VPN plugins retired:** NetworkManager-vpnc and NetworkManager-fortisslvpn "will be obsolete, starting in Fedora Linux 45," the announcement says.

The KDE edition moves to Plasma 6.8, the release that [dropped the X11 session](/articles/kde-plasma-6-8-released-x11-session-retired-wayland/). Fedora 45 also [replaces the kernel console with kmscon](/articles/fedora-45-kmscon-userspace-console/), a change first seen in the beta.

## What this means for developers

Before upgrading, search build scripts, Dockerfiles and CI jobs for direct `rpm -i` calls on files your team builds. Those are the calls that now fail. Signing internal packages is the lasting fix. Adding `--nosignature` everywhere brings back the risk the change removes.

Check any configuration tool that writes or edits files in `/etc/yum.repos.d/`. Test Python 3.15 and pandas 3 code before moving data jobs, and plan the MySQL 9.7 jump or pin `mysql8.4-server`. A container test covers the package tools only. It does not boot the desktop, the console or the kernel.

Fedora 44 users upgrade with `sudo dnf upgrade --refresh`, then `sudo dnf system-upgrade download --releasever=45` and `sudo dnf offline reboot`, per Linux Compatible. Fedora 45 gets updates until December 8, 2027, the date in its own `/etc/os-release` file.

## Sources

- [Announcing Fedora Linux 45](https://fedoramagazine.org/announcing-fedora-linux-45/) - Fedora Magazine
- [Changes/Enforcing signature checking by default](https://fedoraproject.org/wiki/Changes/Enforcing_signature_checking_by_default) - Fedora Project Wiki
- [Releases/45/ChangeSet](https://fedoraproject.org/wiki/Releases/45/ChangeSet) - Fedora Project Wiki
- [Announcing Fedora 45](https://www.redhat.com/en/blog/announcing-fedora-45) - Red Hat
- [Fedora Linux 45 Officially Released: GNOME 51, Linux 7.2 Kernel and Breaking Changes](https://www.linuxcompatible.org/story/fedora-linux-45-officially-released-gnome-51-linux-72-kernel-and-breaking-changes) - Linux Compatible