On Tue, Jun 30, 2026 at 05:56:42PM +0100, Aoife Moloney via devel-announce wrote: > Wiki - https://fedoraproject.org/wiki/Changes/DisableVendorChangeByDefault > Discussion thread - > https://discussion.fedoraproject.org/t/f45-change-proposal-disable-vendor-change-by-default-system-wide/195269
> == Detailed Description == > By default, ''libdnf5'' allows packages to switch vendors if a > repository provides a different version or release of a package with a > different <code>VENDOR</code> tag that satisfies a transaction. While > this can sometimes resolve dependencies automatically, it can lead to > unexpected behavior in multi-vendor setups (e.g., mixing packages > between official Fedora Project, RPM Fusion, Copr, or third-party > corporate repositories). > > For instance, an essential multimedia package or a proprietary driver > supplied by a specific vendor could be silently overwritten or > downgraded by a package from another vendor during system updates or > dependency resolution, potentially breaking user setups. > > By introducing <code>allow_vendor_change = false</code> into Fedora's > default distribution configuration for DNF5, Fedora will achieve > strict vendor isolation by default. A package will only be modified if > the replacement package originates from the same vendor as the > currently installed package, ensuring predictable behavior across all > package operations. I see this change appears to be careful not to use to the word "security", but preventing vendor transitions is effectively acting as a security measure. If a 3rd party repo gets compromised, it purports to prevent that repo from distributing a malicious package that "upgrades" a standard Fedora package. I'm curious whether that is actually the case though? The change suggests this protection relies on the "VENDOR" tag in the RPM, but AFAIK nothing stops anyone from building their RPM with the "VENDOR" tag set to "Fedora Project". Does this vendor protection only work when we have co-operating repository vendors who promise not to step on each others' "VENDOR" tags ? It would be nice if the "VENDOR" tag was tied to the RPM signing keys, so that there is a cryptographic block on spoofing the vendor identifier. I'm still in support of this change proposal, just wondering about the limits of the protection it offers and possibility for future improvement. With regards, Daniel -- |: https://berrange.com ~~ https://hachyderm.io/@berrange :| |: https://libvirt.org ~~ https://entangle-photo.org :| |: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :| -- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
