By Fedora 45 is out today, after two failed NO-GO votes in October that pushed the release into November. Most coverage will focus on GNOME 51 and the toolchain bumps. That’s fine. But the most important thing in this release is something you’ll never see: every package now builds reproducibly — meaning anyone can compile the same source and get a byte-for-byte identical binary to what ships. For a Linux distribution that feeds directly into RHEL, that is a supply-chain security milestone.
The Feature You Won’t Notice
Reproducible builds have been the goal in Linux packaging for years. Fedora 45 makes it real with a formal 99% target and bugs filed against any package that fails. The mechanics are simple: identical source code, built in the identical environment, must produce an identical binary every time — no timestamp differences, no build-system nondeterminism.
Why does this matter? Because it closes one of the quieter attack surfaces in software distribution. A compromised build server can silently replace a binary after compilation. With reproducible builds, that swap becomes detectable — anyone can rebuild the same package and compare checksums. The XZ Utils backdoor in 2024 demonstrated exactly what motivated actors will do when they get access. Reproducible builds raise the cost of that attack significantly. The Reproducible Builds project has tracked progress across distros for years; Fedora is now enforcing it, not just tracking it.
Fedora ships upstream. RHEL follows. This change will eventually land in enterprise Linux.
Toolchain: Everything Moves
Fedora 45 ships a substantial toolchain refresh. Here is what matters for developers:
- Python 3.15 — now the default stack, replacing 3.14
- GCC 16.2 — latest GNU compiler, with Binutils 2.47 and glibc 2.44
- GDB 17.2 — updated debugging support
- LLVM 23, Go 1.27, Podman 6, Perl 5.44
- RPM 6.1 — package manager base with strict signature enforcement
Fedora has always been aggressive about shipping current toolchains — that’s part of why Red Hat uses it as a proving ground. If you build C code on Fedora 45, you’re on GCC 16.2 against glibc 2.44, the same combination that will reach RHEL 11 when it ships. Phoronix has a detailed breakdown of the kernel and toolchain changes if you want the full picture.
encapsule: A Safe Place for Untrusted Scripts
New in Fedora 45 is encapsule, a small CLI tool that addresses a problem every developer has quietly accepted: running scripts from the internet is a trust problem. The curl-pipe-bash pattern is everywhere, and most of the time it’s fine. The times it isn’t fine are memorable.
encapsule runs tools inside isolated Podman containers, with the host’s home directory and system shielded from whatever happens inside:
# Spin up a temporary isolated container
encapsule run fedora-toolbox:45
# Run an untrusted install script safely
encapsule run fedora-toolbox:45 --init "curl https://example.com/install.sh | bash"
# Create a persistent project sandbox
encapsule run fedora-toolbox:45 -p myproject --init "dnf install -y gcc make"The design wraps Podman with sensible defaults and project directory scoping. It won’t stop every attack, but it eliminates the class of “I ran an install script and now my dotfiles are gone” problems. For evaluating new CLI tools before trusting them to your host, this is the right workflow. The encapsule source is on GitHub under Apache-2.0.
Security by Default
Two changes tighten the default security posture. RPM 6.1 now enforces package signatures — unsigned packages are rejected unless you explicitly override. And ptrace is restricted for unprivileged users, so processes can no longer inspect each other’s memory without elevation. Debugging tools re-enable ptrace when installed, so your development workflow stays intact.
KMSCON replaces the in-kernel fbcon as the default virtual terminal. The switch brings better Unicode rendering and keyboard layout handling, and removes console rendering from the kernel. Most users won’t notice. The ones who do will notice it’s better.
How to Upgrade
sudo dnf upgrade --refresh -y
sudo dnf system-upgrade download --releasever=45
sudo dnf system-upgrade rebootIf you hit dependency conflicts, add --allowerasing to the download step. Fresh ISO downloads are at getfedora.org. The full Fedora 45 changeset covers everything that didn’t make this post.
The two delays were frustrating. The release is worth it — not for GNOME 51 or the kernel bump, but because Fedora just demonstrated that a mainstream Linux distribution can hold itself to a reproducibility standard. That matters more than any individual feature, and it’s eventually coming to RHEL.
