Fedora 45 ships with RPM 6.1 blocking unsigned packages

Fedora Linux 45 shipped on November 3, 2026, and its package tool now refuses to install anything without a verified signature. That matters to anyone who builds their own RPM files or downloads one from a vendor's website. A command that worked on Fedora 44 now stops with an error.

The Fedora Magazine announcement promises "polished desktop upgrades, powerful new installer features, and updated toolchains." The release slipped twice from its October 20 target, Linux Compatible reports. Each slip followed a "no-go" vote, when testers found a problem that blocked the release.

What changed in RPM 6.1

RPM is the package format and installer under Fedora, Red Hat Enterprise Linux and their relatives. A signature is a cryptographic stamp. It proves who built a package and that nobody changed it since.

Fedora 45 "switches the default package verification mode in RPM 6.1 to enforcing signature checking by default," Fedora Project Leader Jef Spaleta writes on Red Hat's blog. The Fedora change page, owned by Panu Matilainen, puts it more plainly: "only packages with a verified signature can be installed."

The switch is one setting, %_pkgverify_level. It moves from digest, which only checks that the file is not damaged, to all, which also demands a valid signature. The change page says a package signed with a key the system has not imported fails too. Fedora first planned the switch alongside RPM 6.0 and postponed it to Fedora 45 "for time and resource reasons."

Tested: one unsigned package on Fedora 44 and 45

In a Tech AI Wire test on macOS 26.6.2 with Docker Desktop 28.4.0, the official fedora:44 and fedora:45 container images ran the same unsigned test package. Both images were built on November 2 for arm64. The package, taw-hello, was built with rpmbuild inside Fedora 45 and carries no signature.

Check	Fedora 44	Fedora 45
rpm --version	6.0.2	6.1.0
rpm --eval "%_pkgverify_level"	digest	all
rpmkeys --checksig	"digests OK", exit 0	"digests SIGNATURES NOT OK", exit 1
rpm -i	installed, exit 0	refused, exit 1
rpm -i --nosignature	installed	installed
dnf install of the local file	installed, with a warning	installed, with a warning

On Fedora 45, plain rpm -i printed one line and stopped:

$ rpm -i /pkgs/taw-hello-1.0-1.noarch.rpm
	package taw-hello-1.0-1.noarch does not verify: no signature

DNF, Fedora's higher-level package manager, behaved differently. On both releases, dnf install of the local file printed "Warning: skipped OpenPGP checks for 1 package from repository: @commandline" and installed it. So the new rule hits scripts and tools that call rpm directly, not a plain dnf install.

The test also confirmed the system-wide way back. After the line %_pkgverify_level digest went into /etc/rpm/macros.verify, Fedora 45's rpm -i installed the unsigned package again.

Four ways to install a local package now

The change page lists the supported routes. Each fits a different case:

• A one-off install: add --nosignature to the rpm command, or use dnf install, which skipped the check in the test above.
• Your own builds: RPM 6.0 and later can sign local builds automatically with a passwordless key. Mock, Fedora's clean-room build tool, has a signing plugin. COPR, Fedora's community build service, signs packages on its own.
• A vendor's packages: import the vendor's signing key, so its signature verifies. DNF5 version 5.2.14.0 or newer can also turn the check off for one repository with gpgcheck=0.
• The whole system: the macros.verify line above restores the old behavior. It also removes the protection, so treat it as a last resort.

Other Fedora 45 changes that can break scripts

The same containers asked Fedora's package repositories on November 4 which versions each release offers on arm64:

Package	Fedora 44	Fedora 45
Python	3.14.10	3.15.0
Go	1.26.10	1.27.3
LLVM	22.1.8	23.1.4
glibc	2.43	2.44
Perl	5.42.3	5.44.0
Podman	5.8.9	6.1.3
MySQL server	8.4.10	9.7.2
MariaDB server	11.8.8	12.3.2
pandas	2.3.3	3.0.6
GCC	16.2.1	16.2.1
Linux kernel	7.2.15	7.2.15

Fedora 45 still offers MySQL 8.4 as a separate mysql8.4-server package, version 8.4.11. Four more changes can break existing setups:

• Repository files moved. In the Fedora 45 image, /etc/yum.repos.d/ is empty and Fedora's repo files sit in /usr/share/dnf5/repos.d/. Linux Compatible warns that scripts using the old paths will break.
• Podman 6 drops slirp4netns, cgroups v1 and the BoltDB database backend, according to Fedora's change list. Linux Compatible says to move to SQLite and use --network=pasta.
• Debugging: ptrace, the kernel hook that debuggers use, is now restricted for unprivileged users, Red Hat's post says. Installing debugging packages turns normal tracing back on.
• Two VPN plugins retired: NetworkManager-vpnc and NetworkManager-fortisslvpn "will be obsolete, starting in Fedora Linux 45," the announcement says.

The KDE edition moves to Plasma 6.8, the release that dropped the X11 session. Fedora 45 also replaces the kernel console with kmscon, a change first seen in the beta.

What this means for developers

Before upgrading, search build scripts, Dockerfiles and CI jobs for direct rpm -i calls on files your team builds. Those are the calls that now fail. Signing internal packages is the lasting fix. Adding --nosignature everywhere brings back the risk the change removes.

Check any configuration tool that writes or edits files in /etc/yum.repos.d/. Test Python 3.15 and pandas 3 code before moving data jobs, and plan the MySQL 9.7 jump or pin mysql8.4-server. A container test covers the package tools only. It does not boot the desktop, the console or the kernel.

Fedora 44 users upgrade with sudo dnf upgrade --refresh, then sudo dnf system-upgrade download --releasever=45 and sudo dnf offline reboot, per Linux Compatible. Fedora 45 gets updates until December 8, 2027, the date in its own /etc/os-release file.