gnome-initial-setup prompts to enable third-party repos but does not actually enable it. This is evident from `fedora-third-party query` and by opening Software (I get prompted again). This happened on x86_64 fresh install of "Fedora 44 Branched 20260311.n.0 nightly compose nominated for testing" on bare metal as well as an ARM VM. Reproducible: Always Steps to Reproduce: 1. Install Fedora Workstation 2. Enable third-party repos in gnome-initial-setup 3. `fedora-third-party query` or open Software Actual Results: $ fedora-third-party query Third-party repositories are disabled (no selection has been made). Expected Results: Selection has been made. Additional Information: # System Details Report --- ## Report details - **Date generated:** 2026-03-11 22:31:59 ## Hardware Information: - **Hardware Model:** QEMU QEMU Virtual Machine - **Memory:** 4.0 GiB - **Processor:** - **Graphics:** Software Rendering - **Disk Capacity:** 68.7 GB ## Software Information: - **Firmware Version:** 0.0.0 - **OS Name:** Fedora Linux 44 (Workstation Edition Prerelease) - **OS Build:** (null) - **OS Type:** 64-bit - **GNOME Version:** 50 - **Windowing System:** Wayland - **Kernel Version:** Linux 6.19.6-300.fc44.aarch64
Upstream bug report: https://gitlab.gnome.org/GNOME/gnome-initial-setup/-/issues/242 Note: cannot reproduce in F43
I almost proposed this as an F44 final blocker, because it definitely violates a release criterion: "If an initial setup utility is run or intended to be run after the first boot of the installed system, then it must start successfully and each page or panel of the initial setup utility should withstand a basic functionality test." However, it seems silly to block a Fedora release over a fairly minor bug. The third-party software sources page in gnome-initial-setup is totally broken and cannot plausibly be said to pass a basic functionality test, but the consequence of this is the user receives one extra dialog prompt the first time they run GNOME Software. I think life goes on. Anyway, the AVC is: Mar 11 15:22:45 fedora audit[9196]: AVC avc: denied { entrypoint } for pid=9196 comm="(fedora-third-)" path="/usr/bin/fedora-third-party" dev="vda3" ino=9494 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fedoratp_exec_t:s0 tclass=file permissive=0 More journal output: Mar 11 15:22:45 fedora audit[8871]: AUDIT1100 pid=8871 uid=1000 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication grantors=pam_unix acct="mcatanzaro" exe="/usr/lib/polkit-1/polkit-agent-helper-1" hostname=? addr=? terminal=? res=success' Mar 11 15:22:45 fedora audit[8871]: AUDIT1101 pid=8871 uid=1000 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_unix acct="mcatanzaro" exe="/usr/lib/polkit-1/polkit-agent-helper-1" hostname=? addr=? terminal=? res=success' Mar 11 15:22:45 fedora systemd[1]: Starting run-p8841-i8842.service - [run0] /usr/bin/fedora-third-party enable... Mar 11 15:22:45 fedora audit[9196]: AUDIT1101 pid=9196 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:accounting grantors=pam_unix acct="root" exe="/usr/lib/systemd/systemd-executor" hostname=fedora addr=? terminal=pts/1 res=success' Mar 11 15:22:45 fedora audit[9196]: AUDIT1103 pid=9196 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:setcred grantors=? acct="root" exe="/usr/lib/systemd/systemd-executor" hostname=fedora addr=? terminal=pts/1 res=failed' Mar 11 15:22:45 fedora audit[9196]: AUDIT2300 pid=9196 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=pam_selinux default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/lib/systemd/systemd-executor" hostname=fedora addr=? terminal=pts/1 res=success' Mar 11 15:22:45 fedora systemd[1]: Created slice user-0.slice - User Slice of UID 0. Mar 11 15:22:45 fedora systemd[1]: Starting user-runtime-dir - User Runtime Directory /run/user/0... Mar 11 15:22:45 fedora systemd-logind[1204]: New session '4' of user 'root' with class 'background-light' and type 'unspecified'. Mar 11 15:22:45 fedora systemd[1]: Finished user-runtime-dir - User Runtime Directory /run/user/0. Mar 11 15:22:45 fedora audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=user-runtime-dir@0 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' Mar 11 15:22:45 fedora systemd[1]: Started session-4.scope - Session 4 of User root. Mar 11 15:22:45 fedora (fedora-third-party)[9196]: pam_unix(systemd-run0:session): session opened for user root(uid=0) by root(uid=0) Mar 11 15:22:45 fedora audit[9196]: AUDIT1105 pid=9196 uid=0 auid=0 ses=4 subj=system_u:system_r:init_t:s0 msg='op=PAM:session_open grantors=pam_selinux,pam_selinux,pam_loginuid,pam_keyinit,pam_namespace,pam_systemd_home,pam_umask,pam_systemd,pam_unix acct="root" exe="/usr/lib/systemd/systemd-executor" hostname=fedora addr=? terminal=pts/1 res=success' Mar 11 15:22:45 fedora audit[9196]: AVC avc: denied { entrypoint } for pid=9196 comm="(fedora-third-)" path="/usr/bin/fedora-third-party" dev="vda3" ino=9494 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fedoratp_exec_t:s0 tclass=file permissive=0 Mar 11 15:22:45 fedora (fedora-third-party)[9196]: run-p8841-i8842.service: Failed to execute /usr/bin/fedora-third-party: Permission denied Mar 11 15:22:45 fedora (fedora-third-party)[9196]: run-p8841-i8842.service: Failed at step EXEC spawning /usr/bin/fedora-third-party: Permission denied Mar 11 15:22:45 fedora systemd[1]: run-p8841-i8842.service: Main process exited, code=exited, status=203/EXEC Mar 11 15:22:45 fedora systemd[1]: run-p8841-i8842.service: Failed with result 'exit-code'. Mar 11 15:22:45 fedora systemd[1]: Failed to start run-p8841-i8842.service - [run0] /usr/bin/fedora-third-party enable. Mar 11 15:22:45 fedora audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=run-p8841-i8842 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed' Mar 11 15:22:45 fedora systemd-logind[1204]: Session 4 logged out. Waiting for processes to exit. Mar 11 15:22:45 fedora (sd-pam)[9208]: pam_unix(systemd-run0:session): session closed for user root Mar 11 15:22:45 fedora audit[9208]: AUDIT1106 pid=9208 uid=0 auid=0 ses=4 subj=system_u:system_r:init_t:s0 msg='op=PAM:session_close grantors=pam_selinux,pam_selinux,pam_loginuid,pam_keyinit,pam_namespace,pam_systemd_home,pam_umask,pam_systemd,pam_unix acct="root" exe="/usr/lib/systemd/systemd-executor" hostname=fedora addr=? terminal=pts/1 res=success' Mar 11 15:22:45 fedora audit[9208]: AUDIT1104 pid=9208 uid=0 auid=0 ses=4 subj=system_u:system_r:init_t:s0 msg='op=PAM:setcred grantors=? acct="root" exe="/usr/lib/systemd/systemd-executor" hostname=fedora addr=? terminal=pts/1 res=failed' Mar 11 15:22:45 fedora systemd[1]: session-4.scope: Deactivated successfully. Mar 11 15:22:45 fedora systemd-logind[1204]: Removed session 4. Fedora 43, which doesn't have this problem, used pkexec rather than run0. That was changed in https://gitlab.gnome.org/GNOME/gnome-initial-setup/-/merge_requests/294. Not sure if that's relevant or not.
We could just do what Silverblue does and skip this page: https://github.com/fedora-silverblue/issue-tracker/issues/650#issuecomment-3427268620
Proposed as a Freeze Exception for 44-final by Fedora user asciiwolf using the blocker tracking app because: The Third-Party Repositories dialog in GNOME Initial Setup is broken on F44, clicking "Enable Third-Party Repositories" does nothing. It is a regression since it worked fine on F43. This dialog is an important part of the Fedora Workstation user experience and as such should work correctly in the Final release.
Let's discuss a blocker status as well, marking as such.
(In reply to Michael Catanzaro from comment #2) > Fedora 43, which doesn't have this problem, used pkexec rather than run0. > That was changed in > https://gitlab.gnome.org/GNOME/gnome-initial-setup/-/merge_requests/294. Not > sure if that's relevant or not. From SELinux PoV this is a significant change. Why it appears as a bug now, is this a fresh new feature? Or has it not been tested until now? Or nobody noticed?
Plainly nobody noticed and decided to report a bug until now. That's not very surprising. Fedora 44 beta is out, so now is bug reporting season for upcoming stable release. The earliest somebody would be likely to notice would have been February.
I've created a ticket to have it covered by automated tests next time: https://forge.fedoraproject.org/quality/os-autoinst-distri-fedora/issues/506
FEDORA-2026-8df8468f82 (selinux-policy-43.2-1.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-8df8468f82
FEDORA-2026-8df8468f82 has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-8df8468f82` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-8df8468f82 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
Accepted as a freeze exception in: https://pagure.io/fedora-qa/blocker-review/issue/2080
AGREED AcceptedFinalBlocker Discussed at the 2026-03-23 (blocker / freeze exception) review meeting: This is a violation of "each page or panel of the initial setup utility should withstand a basic functionality test" criterion. https://meetbot-raw.fedoraproject.org//blocker-review_matrix_fedoraproject-org/2026-03-23/f44-blocker-review.2026-03-23-16.00.log.txt
FEDORA-2026-f603de4628 has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-f603de4628` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-f603de4628 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-f603de4628 (selinux-policy-43.3-1.fc44) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report.
Reopening and reassigning to gnome-initial-setup. The selinux-policy update fixed the selinux issue, but the feature is still broken. See https://gitlab.gnome.org/GNOME/gnome-initial-setup/-/issues/242.
FEDORA-2026-1b515008be (gnome-initial-setup-50.0-3.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-1b515008be
FEDORA-2026-1b515008be has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-1b515008be` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-1b515008be See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
Tested, fix confirmed. I installed a live image built with this version of g-i-s, booted, clicked the button to enable third-party repos in g-i-s, then checked Software after reaching a desktop, and they were enabled. `dnf search nvidia` shows packages from the third-party repos.
This doesn't need to be listed as both an FE and a blocker.