Post #3394873
2026-06-25 00:18 UTC
This is a fair question to ask given recent events.
I don't run Fedora currently, so others could probably give a much more exact answer, but from what I understand of it:
Bazzite is built on top of Fedora with uBlue.
To compromise one of the packages, the attacker would have to bypass the Fedora enterprise team who are rage filled roid-driven experts who don't take kindly to that sort of thing.
They heavily secure their stuff.
Even if an attack was successful, it would have little lasting effect because of immutability and having access to easy rollbacks.
It's not impossible (like somehow stealing Bazzite's keys), but it's incredibly unlikely.
AUR/NPM package sketchiness is not anywhere on the same level as compromising Fedora's keys.
Replies (2)
-
@dogs0n@sh.itjust.works 2026-06-25 00:29
Thanks for your answer. I have a lot of trust with Fedora, I guess I am more worried specifically about bazzites build process potentially being exploited. Sounding like I am being extra paranoid with Bazzite for maybe no reason
-
@novafunc@discuss.tchncs.de 2026-06-25 00:36
You’re forgetting that Universal Blue doesn’t just ship Fedora stuff. They include stuff from Homebrew and Flathub out of the box. Homebrew shipped the backdoored xz library while (by luck) Fedora stable didn’t.