Zero Day Exploit

Introduction

Fedora Linux 44 has arrived, bringing a fresh set of updates for Atomic Desktop variants like Silverblue, Kinoite, Sway Atomic, Budgie Atomic, and COSMIC Atomic. If you're using one of these immutable distributions, this guide will walk you through the most important changes and how to prepare your system. Whether you're upgrading from Fedora 43 or installing fresh, understanding these shifts will ensure a smooth experience. We’ll cover everything from the new issue tracker location to the removal of older libraries and tools. By following the steps below, you can address potential pitfalls before they become problems.

What You Need

• A running Fedora Atomic Desktop system (any variant listed above)
• An internet connection to download updates and documentation
• Basic familiarity with the terminal and rpm-ostree commands
• Administrative (sudo) privileges for package installations
• Optional: a backup of important data, especially Plasma Vaults

Step-by-Step Guide

Step 1: Understand the New Issue Tracker

The cross-variant issue tracker has moved to the new Fedora Forge. This is now the central place to report or check issues affecting all Atomic Desktops. If your problem is specific to a single desktop environment (e.g., only Kinoite), respective SIG trackers are still used — those links are in the README of the atomic-desktops organization.

• Action: Bookmark the new tracker at https://forge.…/atomic-desktops (exact URL will be in the official release notes). Before filing a bug, verify it isn’t already reported.
• Why it matters: Consolidating reports helps developers triage faster. If you’re not sure where to file, start here.

Step 2: Access the Unified Documentation

All Atomic Desktop variants now share a single documentation hub, also hosted on the new Forge. The previous separated docs have been merged, making it easier to find answers. However, translations were not carried over — if you contributed translations before, you’ll need to re-translate once the system is ready.

• Action: Visit the new documentation site (link in the release notes or tracking issue atomic-desktops#10). Browse the sections relevant to your variant.
• Action: If you’re a translator, watch for announcements about the translation setup and volunteer to help.
• Tip: The old docs might still be accessible but will no longer be updated. Always rely on the unified version.

Step 3: Prepare for FUSE 2 Removal

Fedora 44 removes the deprecated FUSE 2 libraries from all Atomic Desktop images. This affects two main areas: AppImages and Plasma Vaults. Take these actions before or immediately after upgrading.

3a. Check and Fix AppImages

AppImages that still bundle an old runtime depending on FUSE 2 will break. To identify them:

1. Download the AppImage and inspect its runtime version by running strings <appimage> | grep -i runtime. Look for references to FUSE version 2.
2. If the AppImage fails to launch after upgrading, check the format. You can also use the Fedora Discussion thread for troubleshooting.

Recommended solutions:

• Search Flathub for a Flatpak version of the same application. Many developers now provide Flatpaks, which work seamlessly on Atomic Desktops.
• Report the issue to the AppImage's upstream developer. Encourage them to switch to a newer runtime that bundles FUSE 3.
• As a temporary workaround (not recommended for daily use), you can layer the FUSE 2 library using rpm-ostree install fuse2. Remember to remove it later.

3b. Migrate Plasma Vault Backends

KDE no longer supports the EncFS and CryFS backends for Plasma Vaults because they depend on FUSE 2. If you have vaults using either backend, you must migrate to gocryptfs, the only maintained backend.

1. Before upgrading to Fedora 44: Create a new vault using gocryptfs and copy your data from the old vault manually. Then delete the old vault.
2. If you already upgraded: Temporarily reinstall the needed packages: rpm-ostree install cryfs fuse-encfs, then reboot. Migrate your data as above, then run rpm-ostree reset to remove those layered packages.
3. Ensure both old and new vaults are accessible during migration. Use the Dolphin file manager or command line.

Step 4: Address Legacy Polkit Rules

Support for the pkla format of Polkit rules has been dropped. This is a low-level change, but if you have custom .pkla files (e.g., from third-party applications or your own configuration), they will no longer be read.

• Action: Check your system for any .pkla files: find /etc/polkit-1 /var/lib/polkit-1 -name "*.pkla" 2>/dev/null.
• Action: Convert them to the newer JavaScript format. Refer to the Polkit documentation for syntax.
• Action: If you don’t have any .pkla files, no action needed — this is an internal change that won’t affect you.

Tips for a Smooth Transition

• Back up your data before any major upgrade, especially if you rely on Plasma Vaults or custom Polkit rules.
• Use Flatpak whenever possible to avoid dependency issues with AppImages or other legacy packaging formats.
• Monitor the Fedora Discussion forums for workarounds and community solutions.
• Help with translations once the new documentation setup is ready — it’s a great way to contribute.
• Test your workflows in a disposable VM or on a secondary machine before upgrading your main system.
• Remember that Atomic Desktops use ostree layering; keep layered packages minimal for cleaner updates.