Summary
- Fedora 45 delayed to Nov 3 due to four blockers, including compromised eMudhra certs.
- eMudhra issued trivially factorable private keys; Fedora must update intermediates before release.
- Other blockers: LVM autoactivation, Plasma Discover serving outdated RPMs, Stratis encrypted pool boot failure.
If you haven’t heard the news already, there was a major security concern with website certificates. The issuer, eMudhra, had distributed very easy-to-crack private keys, with the worst offender simply being the number “4.” Well, it seems this issue has convinced the Fedora community to hold off on the release of version 45, as it was one of four reasons why the release is now a No-Go until November.
Fedora 45’s release is delayed until November, partially due to the eMudhra issue
Three other problems were standing in its way
As spotted by Phoronix, the Fedora community has opted to delay the release of Fedora 45 until November. Whenever a new major version of Fedora is on the horizon, the community can vote to put up what it calls “blockers.” These are concerns or issues the people have with releasing the new version of Fedora. If there are enough blockers deemed worthy of concern, the release is delayed until the blockers are cleared.
At the time of writing, there are four blockers in place, and one of them directly mentions the recent eMudhra problem:
“You probably heard of the compromised eMudhra certificates which had very easy to factor private keys.
I think this can be serious for some users, a quick update would be beneficial for all the users of Fedora. I did not see any updates in Bodhi yet.”
The blocker documentation points to the website eMudhra We Have A Problem, which tells you if your computer accepts the compromised intermediates. The documentation claims that Fedora currently accepts them, and that has to be fixed before 45 can be rolled out.
Of course, that’s just one of four active blockers. The other three include LVM autoactivation failing after the Fedora 45 upgrade, Plasma Discover grabbing outdated RPMs for Fedora 44, and the Stratis encrypted pool failing to boot. The release has been pushed to November 3rd to give the community time to fix all the problems.