A different kind of NO-GO

At Thursday's Go/No-Go meeting, release lead Aoife Moloney declared Fedora 45 Final RC-1.2 a NO-GO. The mailing-list verdict was blunt: "Due to outstanding blocker bugs, F45 Final RC-1.2 was declared NO-GO in today's Go/No-Go meeting." The project now aims at "target date #2," Tuesday, November 3, with the next gate on Thursday, October 29.

On October 15, there was no candidate to judge at all, so the release failed by default, as covered in the first NO-GO, when Fedora 45 slipped to October 27. The distinction matters: nothing to grade is a scheduling problem; a candidate blocked by a live security issue is a quality gate doing its job.

The certificate problem, in plain terms

The decisive blocker is bug 2556376, barely a Fedora bug at all: eight eMudhra intermediate certificates had private keys that were, in practical terms, not secret. These P-384 keys should be random numbers roughly 116 digits long; the compromised ones were tiny integers below 256, one literally the number 4, recovered from the public certificates in under a second.

An intermediate key is not one website's credential: whoever holds it can mint a valid certificate for any domain, and every trusting system will report it as legitimate. An actual impersonation still requires intercepting a victim's traffic, and no fraudulent issuance has been confirmed, but that is cold comfort: the keys are public, so the trust they anchored is gone.

The industry moved fast once the report landed. Mozilla blocked all eight through OneCRL on October 17, within about three hours, then shipped Firefox 158.0.1 on October 20 with the block baked in for users whose settings blocked the automatic update. NSS 3.131.1 removes the eMudhra root outright. Chrome blocked them via CRLSet the same day, Apple on October 19, Microsoft on October 20; Go, Node.js, and Python shipped fixes too. If you run anything with its own trust store, the Caddy setup that ended 3 a.m. certificate alerts is a reminder of why that store deserves monitoring, not assumptions.

Why Fedora cannot just ship it anyway

Revocation lists protect software that fetches them, but a release image freezes its trust store at build time. A fresh Fedora 45 install would carry the compromised intermediates until its first ca-certificates update, so every machine installed in that window would start life trusting keys the industry already disowned.

Fedora's answer is the only honest one: an updated ca-certificates package in a new RC-3, verified by QA, judged at the October 29 gate. Shipping around the problem, or shipping and patching on day one, would trade credibility for a date on a calendar. The delay is not the process failing; it is the process refusing a bad trade.

The rest of the blocker list

The eMudhra fix is the long pole, not the only item. Accepted blockers also include the Fedora Server 45 AArch64 image exceeding its maximum size, LVM autoactivation failing after an upgrade on a LUKS-backed volume, and Plasma Discover installing outdated RPMs from the Fedora 44 repository. Proposed blockers include a Stratis encrypted pool failing to boot, an encrypted Stratis root dropping to emergency mode, and no network interface via the ip= kernel parameter during installation. Some may clear before Thursday; the certificate fix depends on a new compose and a QA verdict.

What to do while you wait

On Fedora 44, nothing changes: keep applying updates and treat November 3 as a target, not an appointment. On Fedora 43, the date that actually matters is still early December 2026, when 43 reaches end of life, so use the extra weeks to plan the upgrade, not rush it. The Ubuntu 26.10 upgrade checklist is a decent template for that discipline: backups first, third-party repos second, upgrade last.

For everyone else, Fedora or not, this week is a trust-store audit week: update ca-certificates on your servers, your browsers, and your runtimes. Go, Node.js, and Python all shipped eMudhra fixes, and anything that vendors its own certificate bundle, from containers to toolchains, needs its own update; the OS package alone will not cover it. The OpenSSL 4.1 upgrade playbook covers the same class of chore: boring, staged, and far cheaper than the incident it prevents.

November 3 is a target, not a promise

If RC-3 lands with the updated certificates and QA signs off on October 29, Fedora 45 ships November 3. If the gate fails again, it slips again, and that is still the right call. A distribution that refuses to ship a compromised trust store is one you can trust with the next release too. Watch Thursday, not the calendar.

Sources: Phoronix — Fedora 45 Hits A Second NO-GO: Not Releasing Until November · Linux Compatible — Fedora Linux 45 Final NO-GO: Release Delayed to November 3, 2026 · Mozilla Security Blog — Protecting Firefox users following the compromise of eMudhra intermediate certificates · Fedora Project Wiki — Fedora Release Life Cycle