Change: Disable Vendor Change by Default

amoloney commented

2026-07-14 11:31:11 +00:00

Owner

Change the default configuration of DNF5/libdnf5 by setting allow_vendor_change=False via the distribution defaults file /usr/share/dnf5/libdnf.conf.d/20-fedora-defaults.conf. This prevents libdnf5 from automatically replacing an installed package from one vendor with a package from another vendor during any transaction (such as upgrades, downgrades, or dependency resolution), unless explicitly requested by the user or allowed by VendorChangeManager rules.

Owners, do not implement this work until the FESCo vote has explicitly ended.
When a FESCo member has marked this ticket as APPROVED, you may proceed with the implementation. See the FESCo ticket policy and the Changes policy for more information.
If no decision has been rendered after 7 days from the filing of this ticket and no indication (such as a -1 vote) that this will be taken up at a FESCo meeting, please feel free to ping for a status update.

REMINDER: This ticket is for FESCo members to vote on the proposal. Further discussion should happen in the Discourse discussion linked above. Additional discussion may happen on the Fedora Devel mailing list.

Change the default configuration of DNF5/libdnf5 by setting allow_vendor_change=False via the distribution defaults file /usr/share/dnf5/libdnf.conf.d/20-fedora-defaults.conf. This prevents libdnf5 from automatically replacing an installed package from one vendor with a package from another vendor during any transaction (such as upgrades, downgrades, or dependency resolution), unless explicitly requested by the user or allowed by VendorChangeManager rules. * [Change proposal](https://fedoraproject.org/wiki/Changes/DisableVendorChangeByDefault) * [devel post](https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/OTJ4KQJ43GAZBL5ZQWSVECPW4RRES5RV/) * [Discourse discussion](https://discussion.fedoraproject.org/t/f45-change-proposal-disable-vendor-change-by-default-system-wide/195269) * Owners: @jrohel **Owners, do not implement this work until the FESCo vote has explicitly ended.** When a FESCo member has marked this ticket as APPROVED, you may proceed with the implementation. See the [FESCo ticket policy](https://docs.fedoraproject.org/en-US/fesco/#_ticket_policy) and the [Changes policy](https://docs.fedoraproject.org/en-US/program_management/changes_policy/) for more information. If no decision has been rendered after 7 days from the filing of this ticket and no indication (such as a -1 vote) that this will be taken up at a FESCo meeting, please feel free to ping for a status update. **REMINDER**: This ticket is for FESCo members to vote on the proposal. Further discussion should happen in the Discourse discussion linked above. Additional discussion may happen on the [Fedora Devel](https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/) mailing list.

amoloney added this to the Fedora Linux 45 milestone

2026-07-14 11:31:11 +00:00

amoloney added the

system wide change

label

2026-07-14 11:31:11 +00:00

ngompa commented

2026-07-14 11:40:57 +00:00

Owner

+1

zbyszek commented

2026-07-14 12:30:20 +00:00

Owner

+1

I think that there are some corner cases which might require some custom handling, but they should be figured out during implementation.

+1 I think that there are some corner cases which might require some custom handling, but they should be figured out during implementation.

gotmax23 commented

2026-07-14 13:52:27 +00:00

Owner

I think it would be better to exempt all Copr packages from this and allow individual projects that are shipping alternative content (e.g., Asahi Remix) to ship their own overrides, either via a configuration file override include in a foo-release package or a Copr setting that gets handled by dnf5 copr (if that gets implemented). It sounds like many people would find it surprising to get stuck forever on a Copr version, since Coprs are very often used for testing purposes.

I think it would be better to exempt all Copr packages from this and allow individual projects that are shipping alternative content (e.g., Asahi Remix) to ship their own overrides, either via a configuration file override include in a `foo-release` package or a Copr setting that gets handled by `dnf5 copr` (if that gets implemented). It sounds like many people would find it surprising to get stuck forever on a Copr version, since Coprs are very often used for testing purposes.

gotmax23 added the

vote-in-progress

label

2026-07-14 14:16:15 +00:00

ngompa commented

2026-07-14 14:58:12 +00:00

Owner

Such a default would break Fedora Asahi Remix, who currently configures DNF with sticky vendors by default and has since its inception. I think it would make more sense for the Copr plugin to create such configuration on demand when a copr is being enabled if the Copr is configured for this (maybe make it a new default so people can switch it back off).