Fedora 45 Final Declared NO-GO; New Ship Date Slips to November 3
With an eMudhra certificate still sitting in its trust store, Fedora is pushing the release out another two weeks.
Fedora 45 isn't landing when the team first promised it. At the scheduled Go/No-Go meeting on Wednesday, October 22, 2026, release lead Aoife Moloney declared the final build NO-GO. The new target date is Tuesday, November 3, 2026.
The official read on the mailing list was blunt: "Due to outstanding blocker bugs, F45 Final RC-1.2 was declared NO-GO in today's Go/No-Go meeting." The plan now is to aim for "target date #2," and the next gate is set for October 29.
This isn't Fedora's first stumble. The release has now blown two straight gates, and this second miss is the kind you'd actually want to pay attention to.
Fedora runs on a fairly rigid cadence, shipping roughly three major releases a year. Each one pushes through Alpha, Beta, and a pile of release candidates before the "Final" build can be called ready. The Go/No-Go meeting is the checkpoint. The team checks that a candidate compose exists, that blocker bugs are handled, that test matrices are complete, and that side products like Fedora CoreOS are on track.
A NO-GO just means one of those checks failed. The date slides.
Fedora 45 has failed two of them in a row. The first happened on October 15, when no candidate media had been published in time. This one is different. It's a live security problem sitting right in the middle of the release.
The eMudhra compromise sits at the center
The decisive blocker is bug 2556376, and it's not really a Fedora bug so much as an industry one. On October 19, around 17:00 UTC, Cloudflare flagged that the private keys behind eight eMudhra intermediate certificates had been compromised.
The catch was that those keys had been weakly generated. In practical terms, an attacker could recover them straight out of the published certificates, no special access required. From there, issuing fake TLS certificates for any domain is trivial, which lets you impersonate a website and rewrite encrypted traffic in a man-in-the-middle position.
eMudhra is an Indian certificate authority whose roots are trusted worldwide, so the fallout came fast. Cloudflare, Mozilla, and Google raced to update their trust stores within hours. Mozilla's Dennis Jackson even put together a crowdsourced status page, emudhra.we-have-a-problem.com, to track which packages had been fixed.
Red Hat followed on its own schedule, publishing security bulletin RHSB-2026-012 on October 21. It tracks the issue under several CVEs, including CVE-2026-111943 for the Go ecosystem, CVE-2026-91403 for Java, and CVE-2026-114406 for downstream RHEL ca-certificates changes.
The fix is a trust-store update. The ca-certificates package, which holds the system-wide list of trusted roots and intermediates, needs to start distrusting the compromised certificates. Red Hat is careful to note this isn't a flaw in its own software. It's a broken third-party CA, and systems stay exposed until that trust store is patched.
Here's where Fedora gets caught in the crossfire. The version of ca-certificates that shipped inside Fedora 45's RC-2 was 2026.2.92_v9.0.319-1.fc45, and per comment #9 in the bug, one compromised certificate was still sitting inside it. The fix that went in hadn't fully cleared the problem.
So the team needs a new candidate: an updated ca-certificates with the offending cert pulled out, cut into an RC-3, and verified by QA. That hadn't happened by the time the meeting ran, so the room had no choice but to hold the line.
The meeting itself was led by Adam Will, a long-time Fedora Quality Engineering member who normally chairs blocker reviews. About 23 people showed up in the #fedora-meeting Matrix channel, logged via meetbot. The team also worked through a batch of other issues.
A Stratis encrypted pool failing to boot (bug 2543511) was accepted as a genuine blocker. Another Stratis issue, one that drops you to emergency mode after an unanswered passphrase prompt, was bounced. A network-config complaint tied to the ip= kernel parameter was ruled out too, with Will flagging a possible s390x-specific quirk to explain it.
Keep in mind that this Stratis boot failure matters especially, since Stratis installer support is one of Fedora 45's headline features. You're arguably going to want your encrypted pools to actually boot.
(For the record, a couple of lines in the auto-generated meetbot log mistakenly reference an "F44 Final" meeting. Those are transcription errors — the whole meeting concerns F45 — and Moloney corrected the record, but it's the sort of thing that could confuse someone reading the raw log at 2 a.m.)
What you're actually waiting for
Even with a rocky finish, Fedora 45 carries a fairly meaty feature set. From the September 15 beta onward, the highlights include KMSCON taking over the virtual-terminal console, Stratis storage options in the Anaconda installer, and a push toward hardened defaults, including restricting ptrace and enforcing package signature checks by default.
There's also a DRM Panic front-end for showing kernel panic messages on the direct-render-manager screen, and Fedora Workstation 45 ships with GNOME 51.
The package list is current enough to be useful: Go 1.27, Python 3.15, GCC 16.2, glibc 2.44, LLVM 23, and RPM 6.1. Reports also mention smoother behavior on Snapdragon X1 laptops and a still-open debate over whether LibreOffice should be replaced by Collabora Office.
It's a solid feature set for a release that took this long to ship. Though the Stratis encryption bug sitting in the blocker list is a little uncomfortable given how heavily the installer feature is being pushed.
What comes next
The clock now runs to the next Go/No-Go meeting on Thursday, October 29, 2026 at 17:00 UTC, still in #fedora-meeting. If QE can get an updated ca-certificates into an RC-3 and QA can verify it, Fedora 45 targets November 3. Nothing's fully cleared yet though.
The Stratis boot blocker (2543511) remains open, and if it isn't fixed before the 29th, that's another potential freeze-exception or post-release tracking item. A full slip past November 3 stays possible either way.
Per the meeting's action items, Nik Nikovsky has already told the release party planners that the delay is happening. You can follow the blockers live in the BlockerBugs application, where the F45 Final milestone lists the accepted blockers and proposed freeze exceptions as they resolve. Watch bug 2556376 and 2543511, and the next meeting should tell you whether November 3 holds.
