📢 Alert: install brave web browser on fedora

Brave installs on Fedora 45 from its own RPM repository in about 30 seconds, and unlike Google Chrome, its key handling survives the stricter rpm on Fedora 45 without a single error line. The repository imports three signing keys on first install, the keyring package adds three more for the beta and nightly channels, and nothing in the transaction trips over the rpm lock. The numbers below were measured on Brave 1.96 on a Fedora 45 Workstation test box and a Fedora 44 Cloud machine.

Original content from computingforgeeks.com - post 45687

Step 1: Add the Brave repository

dnf5 on Fedora 45 and 44 adds a vendor repo file with config-manager addrepo. The dnf5-plugins package that provides it is already present on Workstation and was also present on the Fedora 44 Cloud image; on a minimal install without it, run sudo dnf install dnf5-plugins first:

sudo dnf config-manager addrepo --from-repofile=https://brave-browser-rpm-release.s3.brave.com/brave-browser.repo

The command downloads a 190-byte file into /etc/yum.repos.d:

cat /etc/yum.repos.d/brave-browser.repo

The file:

[brave-browser]
name=Brave Browser
enabled=1
gpgcheck=1
gpgkey=https://brave-browser-rpm-release.s3.brave.com/brave-core.asc
baseurl=https://brave-browser-rpm-release.s3.brave.com/$basearch

The baseurl uses only $basearch, not $releasever. The same repository serves every Fedora release, so a new Fedora version never breaks it with a 404. It is also a long archive. Count the brave-browser builds it lists:

dnf repoquery --repo=brave-browser --qf "%{name}-%{version}\n" brave-browser 2>/dev/null | wc -l

The repo lists 406 builds back to the 0.55 series:

Two other packages sit next to the browser. Their metadata:

dnf info --repo=brave-browser brave-origin brave-keyring 2>/dev/null | grep -E "^(Name|Version|Size|Summary)"

They are the keyring package and Brave Origin, a separate edition:

Name           : brave-keyring
Version        : 1.19
Summary        : Brave Browser keyring and repository files
Name           : brave-origin
Version        : 1.96.61
Summary        : Brave Origin

Step 2: Install Brave

The install pulls the browser and the brave-keyring package from the same repository, and time records the wall clock for the whole transaction:

time sudo dnf install -y brave-browser

The transaction was three packages, 144 MiB downloaded and 465 MiB installed, completed in 30.2 seconds of wall time on the test box. dnf imported three release keys from the single brave-core.asc file before verifying the packages:

Updating and loading repositories:
 Brave Browser                          100% | 670.3 KiB/s |  67.0 KiB |  00m00s
Repositories loaded.
Package               Arch   Version         Repository         Size
Installing:
 brave-browser        x86_64 0:1.96.61-1     brave-browser 465.4 MiB
Installing dependencies:
 brave-keyring        noarch 0:1.19-1        brave-browser  16.4 KiB
 liberation-fonts-all noarch 1:2.1.5-16.fc45 fedora          0.0   B

Transaction Summary:
 Installing:         3 packages

Total size of inbound packages is 144 MiB. Need to download 144 MiB.
After this operation, 465 MiB extra will be used (install 465 MiB, remove 0 B).
Warning: A pending offline transaction initiated by the following command will be invalidated: dnf5daemon-server
[1/3] brave-keyring-0:1.19-1.noarch     100% | 844.4 KiB/s |  16.0 KiB |  00m00s
[2/3] liberation-fonts-all-1:2.1.5-16.f 100% |  91.4 KiB/s |   7.3 KiB |  00m00s
[3/3] brave-browser-0:1.96.61-1.x86_64  100% |  17.0 MiB/s | 144.1 MiB |  00m08s
--------------------------------------------------------------------------------
[3/3] Total                             100% |  14.1 MiB/s | 144.2 MiB |  00m10s
Running transaction
[4/4] https://brave-browser-rpm-release 100% | 375.1 KiB/s |   5.3 KiB |  00m00s
--------------------------------------------------------------------------------
[4/4] Total                             100% |  14.1 MiB/s | 144.2 MiB |  00m10s
Importing OpenPGP key 0xE4B0DCA0:
 UserID     : "Brave Linux Release (Brave Linux Release) <[email protected]>"
 Fingerprint: B2A3DCA350E67256740DF904DE4EC67BE4B0DCA0
 From       : https://brave-browser-rpm-release.s3.brave.com/brave-core.asc
The key was successfully imported.
Importing OpenPGP key 0x6A73CD96:
 UserID     : "Brave Linux Release (Brave Linux Release) <[email protected]>"
 Fingerprint: 47D32A74E9A9E013A4B4926C68D513D36A73CD96
 From       : https://brave-browser-rpm-release.s3.brave.com/brave-core.asc
The key was successfully imported.
Importing OpenPGP key 0x20038257:
 UserID     : "Brave Linux Release (Brave Linux Release) <[email protected]>"
 Fingerprint: DBF1A116C220B8C7164F98230686B78420038257
 From       : https://brave-browser-rpm-release.s3.brave.com/brave-core.asc
The key was successfully imported.
[1/5] Verify package files              100% |   2.0   B/s |   3.0   B |  00m01s
[2/5] Prepare transaction               100% |  17.0   B/s |   3.0   B |  00m00s
[3/5] Installing brave-keyring-0:1.19-1 100% | 540.5 KiB/s |  17.3 KiB |  00m00s
[4/5] Installing liberation-fonts-all-1 100% |   3.2 KiB/s | 124.0   B |  00m00s
[5/5] Installing brave-browser-0:1.96.6 100% |  35.0 MiB/s | 465.4 MiB |  00m13s
Warning: Pending offline transaction has been invalidated.
To reschedule, run: dnf5daemon-server
Complete!

real	0m30.237s
user	0m14.678s
sys	0m2.458s

Why no rpm lock error appears

Google Chrome on the same box printed a keyring lock error from its install script, because that script runs rpm --import while dnf still holds the rpm database (the Chrome on Fedora guide shows that output). Brave avoids the collision. The brave-keyring scriptlet (read here on the Fedora 44 machine) pushes the key import into the background and retries every two seconds for up to ten minutes, until the lock is free:

rpm -q --scripts brave-keyring

The scriptlet:

postinstall scriptlet (using /bin/sh):
timeout 10m sh -c "while ! sh /usr/libexec/brave-key-updater >/dev/null 2>&1; do sleep 2; done" &

The updater script removes an old expiring key and imports every key file the package ships:

grep -n -E "rpm (-e|--import)" /usr/libexec/brave-key-updater

The two lines that matter:

7:        rpm -e "$key" # Remove expiring key
12:    rpm --import "$key"

List the files the keyring package ships:

rpm -ql brave-keyring

Those key files cover the release, beta and nightly channels:

/etc/pki/rpm-gpg/RPM-GPG-KEY-brave
/etc/pki/rpm-gpg/RPM-GPG-KEY-brave-beta
/etc/pki/rpm-gpg/RPM-GPG-KEY-brave-nightly
/usr/lib/sysctl.d/53-brave.conf
/usr/libexec/brave-key-updater

After the background job finished, list the rpm keyring:

rpmkeys --list

It held six Brave keys and the Fedora 45 key:

dbf1a116c220b8c7164f98230686b78420038257 Brave Linux Release (Brave Linux Release) <[email protected]> public key
8c1f16ab24df8f75c1cf56595929a141e0e87f1f Brave Linux Pre Release (Brave Linux Pre Release) <[email protected]> public key
4f50a6114cd5c6976a7f1179655a4b02f577861e Fedora (45) <[email protected]> public key
47d32a74e9a9e013a4b4926c68d513d36a73cd96 Brave Linux Release (Brave Linux Release) <[email protected]> public key
56f49901ab19baf099a95a76c3de1dd4f661cdcb Brave Linux Pre Release (Brave Linux Pre Release) <[email protected]> public key
b721e073b7ef8e56acc6b23ecbc67d2399225ccf Brave Linux Pre Release (Brave Linux Pre Release) <[email protected]> public key
b2a3dca350e67256740df904de4ec67be4b0dca0 Brave Linux Release (Brave Linux Release) <[email protected]> public key

The scriptlet and the updater lines, on the Fedora 44 machine:

brave-keyring background key import scriptlet and the key updater rpm commands on Fedora 44

Query the signature on both installed packages:

rpm -q --qf "%{name} %{RSAHEADER:pgpsig}\n" brave-browser brave-keyring

Both are signed by the release key 0686B78420038257:

brave-browser RSA/SHA512, Fri 02 Oct 2026 11:30:51 PM EAT, Key ID 0686b78420038257
brave-keyring RSA/SHA512, Wed 06 Aug 2025 02:54:12 PM EAT, Key ID 0686b78420038257

The keyring package also drops /usr/lib/sysctl.d/53-brave.conf. Read it:

cat /usr/lib/sysctl.d/53-brave.conf

On the test box it contained only a commented-out line, so it changes nothing:

# Recommended kernel settings for the Chromium sandbox (see chrome://sandbox)
#kernel.yama.ptrace_scope = 1

Step 3: Verify the version

The launcher wrapper in /usr/bin reports the build that dnf installed:

brave-browser --version

The version string carries the Chromium major version first, then the Brave version:

Brave Browser 154.1.96.61

Step 4: Use the official install script instead

Brave also publishes a shell installer at dl.brave.com/install.sh. Read it before piping it into a shell; the copy fetched on the Fedora 44 machine was 147 lines long, and its hash pins the exact revision under test:

curl -fsSo install.sh https://dl.brave.com/install.sh && wc -l install.sh && sha256sum install.sh

The hash only identifies the exact revision tested here. It does not prove where the file came from:

147 install.sh
ded2ae4aaa21a4c71a7fc03a4003b790549bd6c27413b4643f7bc4f1129faf64  install.sh

Brave signs the script, and brave.com/linux gives the official check. Download the script with its signature:

curl -fsSLO "https://dl.brave.com/install.sh{,.asc}" && ls -l install.sh install.sh.asc

Both files arrived:

-rw-r--r--. 1 klinsmann klinsmann 6781 Oct  5 09:48 install.sh
-rw-r--r--. 1 klinsmann klinsmann  833 Oct  5 09:48 install.sh.asc

Fetch the signing key by the fingerprint Brave publishes:

gpg --keyserver hkps://keys.openpgp.org --recv-keys D16166072CACDF2C9429CBF11BF41E37D039F691

The key belongs to the One Line Installer identity:

gpg: directory '/home/klinsmann/.gnupg' created
gpg: /home/klinsmann/.gnupg/trustdb.gpg: trustdb created
gpg: key 1BF41E37D039F691: public key "One Line Installer for Brave (One Line Installer for Brave) <[email protected]>" imported
gpg: Total number processed: 1
gpg:               imported: 1

Then verify:

gpg --verify install.sh.asc install.sh

The signature is good. The trust warning only means the key has not been certified locally; the fingerprint line is what to compare against brave.com/linux:

gpg: Signature made Tue 14 Apr 2026 06:00:31 PM UTC
gpg:                using RSA key D16166072CACDF2C9429CBF11BF41E37D039F691
gpg: Good signature from "One Line Installer for Brave (One Line Installer for Brave) <[email protected]>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: D161 6607 2CAC DF2C 9429  CBF1 1BF4 1E37 D039 F691

On a dnf5 system the script runs the same two commands as Steps 1 and 2, with --overwrite added to the repo step:

grep -n -E "dnf|rpm|yum" install.sh | head -20

The dnf branch of the script:

73:    elif available dnf; then
74:        if dnf --version|grep -q dnf5; then
75:            show $sudo dnf config-manager addrepo --overwrite --from-repofile="https://brave-browser-rpm-$CHANNEL.s3.brave.com/brave-browser$dashCHANNEL.repo"
77:            show $sudo dnf install -y 'dnf-command(config-manager)'
78:            show $sudo dnf config-manager --add-repo "https://brave-browser-rpm-$CHANNEL.s3.brave.com/brave-browser$dashCHANNEL.repo"
80:        show $sudo dnf install -y "brave-$FLAVOR$dashCHANNEL"
102:        show $sudo zypper --non-interactive addrepo --gpgcheck --repo "https://brave-browser-rpm-$CHANNEL.s3.brave.com/brave-browser$dashCHANNEL.repo"
106:    elif available yum; then
107:        available yum-config-manager || show $sudo yum install yum-utils -y
108:        show $sudo yum-config-manager -y --add-repo "https://brave-browser-rpm-$CHANNEL.s3.brave.com/brave-browser$dashCHANNEL.repo"
109:        show $sudo yum install "brave-$FLAVOR$dashCHANNEL" -y
111:    elif available rpm-ostree; then
113:        show $curl "https://brave-browser-rpm-$CHANNEL.s3.brave.com/brave-browser$dashCHANNEL.repo"|\
114:            show $sudo install -DTm644 /dev/stdin "/etc/yum.repos.d/brave-browser$dashCHANNEL.repo"
115:        show $sudo rpm-ostree install -y --idempotent "brave-$FLAVOR$dashCHANNEL"
118:        error "Could not find a supported package manager. Only apt/dnf/eopkg/pacman(+paru/pikaur/yay)/rpm-ostree/yum/zypper are supported." "" \

Run as root on the Fedora 44 Cloud image, the script printed each command to the terminal before it executed that command:

time sudo sh install.sh

Those commands, as the script echoed them:

Installing Brave Browser (release)
+ dnf config-manager addrepo --overwrite --from-repofile=https://brave-browser-rpm-release.s3.brave.com/brave-browser.repo
 https://brave-browser-rpm-release.s3.b 100% | 264.0   B/s | 190.0   B |  00m01s
+ dnf install -y brave-browser

A Cloud image has no desktop libraries, so the transaction grew to 253 packages and 1 GiB:

Transaction Summary:
 Installing:       253 packages

Total size of inbound packages is 331 MiB. Need to download 331 MiB.
After this operation, 1 GiB extra will be used (install 1 GiB, remove 0 B).

The complete run, from the repository download to the final message, took 55.8 seconds of wall time:

Complete!
Installation complete! Start Brave Browser by typing: brave-browser

real	0m55.783s

The result is identical to the manual method: the same repo file, the same build and the same six keys:

brave-browser --version; rpmkeys --list | grep -c -i brave; cat /etc/yum.repos.d/brave-browser.repo

The checks on the Fedora 44 machine:

Brave Browser 154.1.96.61 
6
[brave-browser]
name=Brave Browser
enabled=1
gpgcheck=1
gpgkey=https://brave-browser-rpm-release.s3.brave.com/brave-core.asc
baseurl=https://brave-browser-rpm-release.s3.brave.com/$basearch

Step 5: First launch

The onboarding flow has four screens. The first one offers to set Brave as the default browser:

Brave welcome screen on Fedora 45 offering to set Brave as the default browser

After the theme and Web Discovery screens, the last one has two telemetry boxes, both ticked by default:

Brave Help make Brave better screen on Fedora 45 with diagnostic reports and product insights ticked by default

Untick both boxes if no crash reports or usage data should leave the machine; the same choices remain editable later at brave://settings/privacy.

The new tab page shows the Shields counters and a Rewards card, and Rewards stays off unless the user turns it on explicitly:

Brave new tab page on Fedora 45 with Shields stats and the Brave Rewards card

The “Set Brave as default browser” button wrote the setting that xdg-settings reads:

xdg-settings get default-web-browser

The result:

brave-browser.desktop

Step 6: Measure Shields and memory

With default Shields settings, one load of the theverge.com front page blocked 17 trackers and ads:

Brave Shields panel on Fedora 45 showing 17 trackers and ads blocked on a news site

With that single tab open, Brave ran 12 processes, and summing their RSS counts every shared page once per process, which overstates the real footprint. The summed figure came from this:

pgrep -c -x brave; ps -C brave -o rss= | awk "{s+=\$1} END {printf \"%.0f MiB\n\", s/1024}"

Process count and summed RSS:

12
1733 MiB

Proportional set size divides each shared page among the processes that map it, so it is the number that matters for RAM planning. Sum it from smaps_rollup:

for p in $(pgrep -x brave); do grep ^Pss: /proc/$p/smaps_rollup; done | awk "{s+=\$2} END {printf \"PSS total: %.0f MiB\n\", s/1024}"

The total:

PSS total: 603 MiB

The secret service on Fedora 45 is oo7-daemon. The check:

secret-tool search --all application brave 2>&1 | head -3; busctl --user status org.freedesktop.secrets | grep -E "^Comm="

The owner of the bus name:

Comm=oo7-daemon

Step 7: Compare the Flatpak

Flathub carries com.brave.Browser at the same version as the RPM. Query it:

flatpak remote-info flathub com.brave.Browser | grep -E "ID|Version|Download|Installed|Runtime"

The listing:

            ID: com.brave.Browser
       Version: 1.96.61
 Download Size: 219.3 MB
Installed Size: 513.3 MB
       Runtime: org.freedesktop.Platform/x86_64/25.08

The 219.3 MB is the app alone; the Freedesktop runtime it lists downloads on top of that unless another app already pulled it. The RPM download was 144 MiB, about 151 MB. Install it with flatpak install flathub com.brave.Browser. It needs Flathub enabled; see the Flatpak and Flathub guide for Fedora. Brave itself recommends against it: brave.com/linux says the Flatpak “modifies Chromium sandboxing in ways which have not been vetted by the Brave or Chromium security teams” and recommends the official repositories for anyone who can use them.

Step 8: Update and uninstall

Brave updates arrive with sudo dnf upgrade. Removal takes the browser, the keyring package and the font dependency:

sudo dnf remove -y brave-browser brave-keyring

The transaction freed 465 MiB and removed three packages:

After this operation, 465 MiB will be freed (install 0 B, remove 465 MiB).
Warning: A pending offline transaction initiated by the following command will be invalidated: dnf5daemon-server
Running transaction
[1/4] Prepare transaction               100% |   5.0   B/s |   3.0   B |  00m01s
[2/4] Removing brave-browser-0:1.96.61- 100% |   2.8 KiB/s | 253.0   B |  00m00s
[3/4] Removing brave-keyring-0:1.19-1.n 100% | 555.0   B/s |   5.0   B |  00m00s
[4/4] Removing liberation-fonts-all-1:2 100% | 180.0   B/s | 100.0   B |  00m01s

Check what remains:

ls /etc/yum.repos.d/; rpmkeys --list | grep -c -i brave; du -sh ~/.config/BraveSoftware

Three things: the repo file, all six Brave keys, and a 115 MiB profile:

brave-browser.repo
google-chrome.repo
rpmfusion-nonfree-nvidia-driver.repo
rpmfusion-nonfree-steam.repo
6
115M	/home/klinsmann/.config/BraveSoftware

Delete them explicitly for a clean system:

sudo rm /etc/yum.repos.d/brave-browser.repo
rpmkeys --list | grep -i brave
rm -rf ~/.config/BraveSoftware

The second command prints the fingerprints. Remove each one with sudo rpmkeys --delete <fingerprint>.

Results

Measurement	Fedora 45 Workstation	Fedora 44 Cloud
Install method	config-manager + dnf	install.sh
Packages installed	3	253
Installed size	465 MiB	1 GiB
Wall time	30.2 s	55.8 s
Keys imported by dnf	3	3
Brave keys in rpm keyring after install	6	6
Script errors	none	none
Processes with one tab	12	not measured
Memory, summed RSS / PSS	1733 / 603 MiB	not measured
Trackers blocked on theverge.com	17	not measured

Brave is not the only Chromium option on Fedora. Vivaldi on Fedora uses a similar vendor repo. For signature errors on local RPM files, see the NOKEY guide for Fedora 45. Codecs for the rest of the system are covered in the RPM Fusion codecs guide, and the remaining desktop setup in the Fedora 45 post-install checklist.