What happened with Fedora - and Red Hat too

Usually the human is the weakest link in any security system.

It's very likely that the attacker gained access to a account using social engineering or by
bad ssh habits on the part of a Fedora developer.