Brave not updating/installing in Linux, Brave RPM packages not signed correctly - GPG check failed

Description of the issue:
I tried to update Brave browser. It works normally every time but today the update did not work, an error appears that GPG verification failed.

Steps to Reproduce (add as many as necessary):

  1. Run sudo dnf --refresh upgrade (or update through Gnome Software GUI) and confirm upgrade
  2. GPG check fails, Brave does not update (nor install)

Actual Result (gifs and screenshots are welcome!):
I tried using the Gnome Software GUI but that did not work since the upgrade would automatically cancel.

So with the Terminal I ran:

[user@host ~]$ sudo dnf --refresh upgrade
Copr repo for mat2 owned by atenart              15 kB/s | 1.5 kB     00:00    
created by dnf config-manager from https://brav  37 kB/s | 3.3 kB     00:00    
Fedora 38 - x86_64                              117 kB/s |  24 kB     00:00    
Fedora 38 openh264 (From Cisco) - x86_64        4.1 kB/s | 989  B     00:00    
Fedora Modular 38 - x86_64                      127 kB/s |  24 kB     00:00    
Fedora 38 - x86_64 - Updates                    114 kB/s |  24 kB     00:00    
Fedora Modular 38 - x86_64 - Updates            134 kB/s |  23 kB     00:00    
Dependencies resolved.
================================================================================
 Package Arch   Version    Repository                                      Size
================================================================================
Upgrading:
 brave-browser
         x86_64 1.52.129-1 brave-browser-rpm-release.s3.brave.com_x86_64_ 106 M
 brave-keyring
         noarch 1.13-1     brave-browser-rpm-release.s3.brave.com_x86_64_  15 k

Transaction Summary
================================================================================
Upgrade  2 Packages

Total download size: 106 M
Is this ok [y/N]: y
Downloading Packages:
(1/2): brave-keyring-1.13-1.noarch.rpm          119 kB/s |  15 kB     00:00    
(2/2): brave-browser-1.52.129-1.x86_64.rpm       15 MB/s | 106 MB     00:06    
--------------------------------------------------------------------------------
Total                                            15 MB/s | 106 MB     00:06     
Public key for brave-keyring-1.13-1.noarch.rpm is not installed
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: GPG check FAILED

Then I ran:

[user@host ~]$ sudo dnf clean packages
2 files removed

That made no difference so I checked the GPG keys:

[user@host ~]$ rpm -q gpg-pubkey --qf '%{NAME}-%{VERSION}-%{RELEASE}\t%{SUMMARY}\n'
gpg-pubkey-9867c58f-601c49ca	Fedora (35) <[email protected]> public key
gpg-pubkey-87c4f1a9-5b1ff953	atenart_mat2 (None) <atenart#[email protected]> public key
gpg-pubkey-38ab71f4-60242b08	Fedora (36) <[email protected]> public key
gpg-pubkey-c2d4e821-6285304f	Brave Software <[email protected]> public key
gpg-pubkey-5323552a-6112bcdc	Fedora (37) <[email protected]> public key
gpg-pubkey-dd79b481-62fe7502	Zoom Video Communications, Inc. <[email protected]> public key
gpg-pubkey-eb10b464-6202d9c6	Fedora (38) <[email protected]> public key

And I removed the older Brave Software key and imported the new key:

[user@host ~]$ sudo rpm -e gpg-pubkey-c2d4e821-6285304f
[user@host ~]$ sudo rpm --import https://brave-browser-rpm-release.s3.brave.com/brave-core.asc

That made no difference so I tried re-running the official installation guide:

  1. sudo dnf install dnf-plugins-core (already installed)
  2. sudo dnf config-manager --add-repo https://brave-browser-rpm-release.s3.brave.com/brave-browser.repo
  3. sudo rpm --import https://brave-browser-rpm-release.s3.brave.com/brave-core.asc
  4. sudo dnf install brave-browser brave-keyring, from which I got:
[user@host ~]$ sudo dnf install brave-browser brave-keyring
Brave Browser                                    46 kB/s | 7.3 kB     00:00    
Package brave-browser-1.52.126-1.x86_64 is already installed.
Package brave-keyring-1.11-1.noarch is already installed.
Dependencies resolved.
Nothing to do.
Complete!

I tried updating:

[user@host ~]$ sudo dnf --refresh upgrade
Copr repo for mat2 owned by atenart             7.0 kB/s | 1.5 kB     00:00    
Brave Browser                                    33 kB/s | 3.3 kB     00:00    
created by dnf config-manager from https://brav  48 kB/s | 3.3 kB     00:00    
Fedora 38 - x86_64                              104 kB/s |  24 kB     00:00    
Fedora 38 openh264 (From Cisco) - x86_64        3.8 kB/s | 989  B     00:00    
Fedora Modular 38 - x86_64                      147 kB/s |  24 kB     00:00    
Fedora 38 - x86_64 - Updates                     77 kB/s |  24 kB     00:00    
Fedora Modular 38 - x86_64 - Updates            148 kB/s |  23 kB     00:00    
Dependencies resolved.
================================================================================
 Package             Architecture Version             Repository           Size
================================================================================
Upgrading:
 brave-browser       x86_64       1.52.129-1          brave-browser       106 M
 brave-keyring       noarch       1.13-1              brave-browser        15 k

Transaction Summary
================================================================================
Upgrade  2 Packages

Total download size: 106 M
Is this ok [y/N]: y
Downloading Packages:
(1/2): brave-keyring-1.13-1.noarch.rpm          209 kB/s |  15 kB     00:00    
(2/2): brave-browser-1.52.129-1.x86_64.rpm       13 MB/s | 106 MB     00:08    
--------------------------------------------------------------------------------
Total                                            13 MB/s | 106 MB     00:08     
Public key for brave-keyring-1.13-1.noarch.rpm is not installed
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: GPG check FAILED

So the new Brave Browser repository shows up, but the repo link is the same as the older one. Regardless of disabling the older one or not, it still shows the same result as before.

I ended up uninstalling Brave but now I can’t install it since it shows the very same GPG failed error.

Expected result:
Update Brave

Reproduces how often:
All the time since trying to update from Brave browser version 1.52.126-1 to 1.52.129-1, Brave keyring from 1.11-1 to 1.13-1.

Operating System and Brave Version (See the About Brave page in the main menu):

Operating system: Fedora Linux 38 (virtual machine)
Brave browser: Brave 1.52.126-1 (Official Build) (64-bit) - can’t check Chromium version since I can’t reinstall Brave

Additional Information:
I don’t know if this makes any difference, but about a month ago I changed a setting in my computer which makes me automatically login without having to enter my user password so I could login faster.

As a consequence, Brave would ask me to enter my password every time I opened it, saying the keyring had not been unlocked. Once I would enter it, it wouldn’t ask me again for the whole user session, until I rebooted/logged out and back in.

*Note that updates still worked OK during this time

3 Likes

I am also having this issue, trying to install Brave for the first time on Nobara 38 (Fedora 38).

I follow the instructions to install the dnf repo for Fedora, and I get a gpg check error.

Even if I override the gpg check for brave-keyring, a reinstall of brave-keyring still fails due to gpg error.

2 Likes

Thanks @rone

I just signed up to report the same thing both brave-browser and brave-keyring packages have not been signed correctly. I’m also using Fedora 38 but as a Workstation.

I haven’t made any changes like those you have, my system is mostly defaults and still requires a password to login etc.

I also tried to re-import the current GPG key but it didn’t resolve the problem.

I’d report this on github, only my experience is that they’re too busy to notice many bug reports there (I have reported something minor which hasn’t even been categorised yet, after a month).

PS: Might be worth adding the “desktop support” tag to your post also @rone

2 Likes

I don’t think this is an issue with Fedora 38 at all. (of course)
I have reproduced the issue with EL8 and EL9.

Current workaround while waiting for brave to fix the repo is to install the brave flatpak. At least that is what I did since I can’t go a day without brave and I’m installing on new systems.

2 Likes

@rone could you please update the subject of this thread to be something like “Brave RPM packages are not signed correctly - GPG check failed”.
Here’s hoping we can get some attention to this problem by someone who can fix it. Thanks!

1 Like

Update. After doing more reading and more thinking, I’ve removed the brave flatpak because it is community supported and not brave supported and I’ve switched to official brave-beta. I didn’t know the beta version had a cool blue icon before. If it seems to run pretty stable, (which it probably will for me) then I think I’ll have to keep it just for that blue icon. lol :slight_smile:

For others needing brave right away, the beta works, the snap probably works. And the flatpak did work, I only removed it because I want my browser officially signed by brave.

2 Likes

Another datapoint:
The latest version of the brave-browser (1.52.129) and brave-keyring (1.16) deb packages install on Ubuntu with GPG checks passing.

Friends don’t let friends use snap packages!

1 Like

Same issue here, tried to update, remove the old package, update the keys, didn´t help.

1 Like

Same issue here. Really shouldn’t happen.

1 Like

Same issue here, any solution ??

1 Like

Hello everyone

there issue with the keyring as everyone notice that only work arround to upgrade with no gpgcheck which i do not recommend for long time useage

sudo dnf upgrade --nogpgcheck

@fmarier could you help us here

and have a nice day everyone :slight_smile:

2 Likes

I’m with the same issue on Fedora 38.

1 Like

Happening here too. You don’t need to switch to the beta. You only need this command from the beta installation directions and then the upgrade will complete.

sudo rpm --import https://brave-browser-rpm-beta.s3.brave.com/brave-core-nightly.asc

1 Like

either there issue with new asc file we import or the keyring package or maybe both

the only way to by pass it to install or upgrade/update using the --nogpgcheck flag

someone open an issue on github

1 Like

Can you try again?
We rolled out a fix about an hour ago, and we’d like to make sure it’s working for you too.

4 Likes

working fine thanks @fmarier and have a nice day :slight_smile:

1 Like

I’m so sorry but noway, same thing and it doesn’t work

1 Like

@gerzal Can you describe what you’re trying to do that’s not working? Is it a new install? An existing install that you’re trying to upgrade?

If you can paste the commands you typed and the error message you saw, that would be very helpful. Thanks!

2 Likes

You need to remove the old repository first, and then install it again according to the official guide.

sudo rm /etc/yum.repos.d/brave-browser-rpm-release.s3.brave.com_x86_64_.repo
sudo dnf config-manager --add-repo https://brave-browser-rpm-release.s3.brave.com/brave-browser.repo
sudo rpm --import https://brave-browser-rpm-release.s3.brave.com/brave-core.asc
2 Likes

Yep, working just fine now. Thanks! Do you know what caused this issue?

1 Like