Fedora 45 Candidate Beta-1.1 available for testing with security hardening and remote installs
Fedora 45 Candidate Beta-1.1 has arrived, kicking off the inital stretch of testing for the next major release. This version represents the first test candidate in preparation for the official beta. The project has its sights set on a final ship date in October or November, sticking to the six-month cadence that's kept Fedora reliable since Fedora 44 rolled out on April 28, 2026.
The security story in Fedora 45 is getting louder. The most significant shift is a default restriction on ptrace for unprivileged users. It disables some debugging permissions that could otherwise let malware inspect running processes. Fedora says the restriction is relaxed when you install debugging tools, so you won't be locked out of your own machine.
Then there's RPM signature enforcement. RPM 6.1 makes verifying package signatures the default behavior, following the upstream RPM 6.0 default. Only packages with verified signatures can install. If you're relying on unsigned third-party repositories, this might rattle you. It's a bold move for supply chain security, though the trade-off is clear: you're not being asked to trust random RPMs anymore.
Keep in mind that DNF5 also disables automatic vendor replacement by default, which changes how packages are upgraded from other distributions. On top of that, the GRUB EFI variant for Confidential Computing offers a minimal bootloader for UEFI-only systems booting Unified Kernel Images, and Sequoia introduces OpenPGP verification that supports Post-Quantum Cryptography.
It's a rather aggressive security posture for a general-purpose distro, though Fedora has been tightening things up for years. The disablement of the in-kernel Crypto Userspace API rounds out the message: the project is actively removing features with known security risks.
Remote installs via the browser
Perhaps the most ambitious new capability is web-based remote installation. The Anaconda WebUI, which started as a Workstation experiment in Fedora 42, now supports remote control of headless machines via a browser session. You boot the target with the inst.webui.remote flag, get a PIN, and manage the install over HTTPS with self-signed certificates.
It's currently scoped to Fedora Atomic Desktops like Silverblue and Kinoite. It removes the need for a VNC or RDP client, which is a quality-of-life win for sysadmins managing edge hardware and Raspberry Pis. The core functionality has been merged into the anaconda-webui repository, with the rest developed by Bruno Ciconelle.
The desktop experience is also shifting. kmscon is taking over as the default virtual console, replacing the kernel's fbcon for a more secure and feature-rich console. oo7 is becoming the default secrets provider, which is a notable shift from KWallet or GNOME Keyring.
Massive toolchain refresh
The toolchain is getting a heavy refresh. We're looking at GCC 16.2, glibc 2.44, binutils 2.47, and gdb 17.2. LLVM jumps to version 23. Python moves to 3.15. Go lands at 1.27. Perl hits 5.44, and Lua upgrades to 5.5. Protobuf gets a major update, and Ruby on Rails ships 8.1.
The mass rebuild triggered by libxml2 ABI changes is going to keep the build servers busy. Fedora aims for 99% reproducible package builds, with bugs filed against non-reproducible packages. At roughly 90% right now, there's work to do.
For container users, Podman 6 brings breaking API changes. It removes slirp4netns, cgroups v1 support, and the BoltDB backend. If you have old scripts relying on those, this is the time to update. MySQL 9.7 and MariaDB 12.3 are now the distribution defaults, and Pandas lands at version 3 with improved Copy-on-Write behavior.
Blockers and what to watch
Not everything is smooth. There are four accepted blockers, including an httpd issue with FreeIPA enrolment under OpenSSL 4 and a NULL pointer dereference in kmscon when a DRM device fails to initialize. Two proposed blockers are waiting for community votes, including a bug where Anaconda doesn't report to Bugzilla after a simulated crash.
Freeze exception votes are also pending. The oo7 wallet unlock story is particularly interesting: five separate login managers, including SDDM and Plasma Login Manager, have proposed exceptions to support unlocking oo7 wallets on login. It signals a major shift in desktop authentication infrastructure.
Head here for the Fedora 45 Beta Release Criteria, head here for the full ChangeSet, and head here for the blocker bug tracker. The final release is coming in the fall, but Fedora 45 needs you to find the bugs first.
You can download the release from here.
