Google Chrome is not in the Fedora repositories. Google ships it from its own RPM repo, and Fedora Workstation already carries a disabled copy of that repo definition. On Fedora 45 that repo path is still the right way in. What changed is the signature handling around it: rpm now refuses an unsigned or unknown-key package outright, and the Chrome install script trips over a lock while it tries to import the Google key. This guide covers the repo install, the downloaded RPM, the Fedora 44 behaviour and the leftovers after removal. Every command below was run with Chrome 154 on a Fedora 45 Workstation and a Fedora 44 Cloud machine.
Check whether the Google repo is already on
Fedora Workstation installs fedora-workstation-repositories by default. That package owns the Google Chrome repo file. Whether the repo is enabled depends on one switch in GNOME Initial Setup: the third-party repositories toggle on the first-boot screen. Check the packages first:
rpm -q fedora-workstation-repositories fedora-third-party google-chrome-stableOn the test box the package was present and Chrome was not:
fedora-workstation-repositories-45-1.fc45.x86_64
fedora-third-party-0.10-21.fc45.noarch
package google-chrome-stable is not installedThen ask the helper whether third-party repos are on:
fedora-third-party queryThe first-boot toggle had been switched on:
Third-party repositories are enabled.With the toggle off, the same repo is listed but disabled. This is the check:
dnf repolist --all | grep -i -E "google|chrome"And this is the disabled state:
google-chrome google-chrome disabledIn that state dnf cannot see Chrome at all. The repo file itself is plain:
cat /etc/yum.repos.d/google-chrome.repoNote skip_if_unavailable=True, which keeps a Google outage from breaking a system update:
[google-chrome]
name=google-chrome
baseurl=https://dl.google.com/linux/chrome/rpm/stable/x86_64
skip_if_unavailable=True
gpgcheck=1
gpgkey=https://dl.google.com/linux/linux_signing_key.pub
enabled=1The Fedora 44 Cloud image did not have this package installed. The Fedora 44 repo carries an older build of it:
dnf repoquery --qf "%{name} %{version}-%{release} %{repoid}\n" fedora-workstation-repositoriesThe query output:
Updating and loading repositories:
Repositories loaded.
fedora-workstation-repositories 38-9.fc44 fedoraEnable only the Chrome repo
There are two switches. fedora-third-party enable turns on every third-party source at once: Google Chrome, the RPM Fusion NVIDIA and Steam repos, and the Flathub remote. If you only want Chrome, flip that one repo:
sudo dnf config-manager setopt google-chrome.enabled=1On Fedora 45 this does not edit the repo file. dnf5 writes the change to an override file instead:
cat /etc/dnf/repos.override.d/99-config_manager.repoThe override holds just the one key:
# Generated by libdnf5.
# Do not modify this file manually, use dnf5 config-manager instead.
[google-chrome]
enabled=1Remember that file. It comes back in the troubleshooting section.
The bulk switch also explains a warning you will see on Fedora 45. The Workstation config still lists a PyCharm COPR repo the package no longer ships, so both enable and disable print a warning about it:
sudo fedora-third-party disableThe warning:
fedora-third-party disable:WARNING: DNF repository [copr:copr.fedorainfracloud.org:phracek:PyCharm] not found.The warning is harmless. The bulk switch has a side effect worth knowing: fedora-third-party disable turns off Flathub too, not just the dnf repos. Check the remotes:
flatpak remotes --show-disabled --columns=name,optionsFlathub shows as disabled:
fedora system,oci
fedora-testing system,disabled,oci
flathub system,disabled,filteredInstall Google Chrome
One command. We wrapped it in time on the test box:
time sudo dnf install -y google-chrome-stableOn the Fedora 45 Workstation it pulled Chrome and one font package. dnf fetched the Google signing key from the gpgkey= URL, imported it, then verified the package against it:
Updating and loading repositories:
google-chrome 100% | 7.3 KiB/s | 1.3 KiB | 00m00s
Repositories loaded.
Package Arch Version Repository Size
Installing:
google-chrome-stable x86_64 0:154.0.8037.97-1 google-chrome 435.8 MiB
Installing dependencies:
liberation-fonts-all noarch 1:2.1.5-16.fc45 fedora 0.0 B
Transaction Summary:
Installing: 2 packages
Total size of inbound packages is 139 MiB. Need to download 139 MiB.
After this operation, 436 MiB extra will be used (install 436 MiB, remove 0 B).
Warning: A pending offline transaction initiated by the following command will be invalidated: dnf5daemon-server
[1/2] liberation-fonts-all-1:2.1.5-16.f 100% | 112.5 KiB/s | 7.3 KiB | 00m00s
[2/2] google-chrome-stable-0:154.0.8037 100% | 13.5 MiB/s | 138.6 MiB | 00m10s
--------------------------------------------------------------------------------
[2/2] Total 100% | 11.4 MiB/s | 138.6 MiB | 00m12s
Running transaction
[3/3] https://dl.google.com/linux/linux 100% | 84.5 KiB/s | 19.2 KiB | 00m00s
--------------------------------------------------------------------------------
[3/3] Total 100% | 11.4 MiB/s | 138.6 MiB | 00m12s
Importing OpenPGP key 0xD38B4796:
UserID : "Google Inc. (Linux Packages Signing Authority) <[email protected]>"
Fingerprint: EB4C1BFD4F042F6DDDCCEC917721F63BD38B4796
From : https://dl.google.com/linux/linux_signing_key.pub
The key was successfully imported.
[1/4] Verify package files 100% | 1.0 B/s | 2.0 B | 00m01s
[2/4] Prepare transaction 100% | 14.0 B/s | 2.0 B | 00m00s
[3/4] Installing liberation-fonts-all-1 100% | 1.8 KiB/s | 124.0 B | 00m00s
[4/4] Installing google-chrome-stable-0 100% | 43.8 MiB/s | 435.8 MiB | 00m10s
>>> Running %post scriptlet: google-chrome-stable-0:154.0.8037.97-1.x86_64
>>> Finished %post scriptlet: google-chrome-stable-0:154.0.8037.97-1.x86_64
>>> Scriptlet output:
>>> error: can't create keyring lock on /usr/lib/sysimage/rpm/.keyring.lock (Resource temporarily unavailable)
>>> error: /tmp/google.sig.xmXMsU: key 1 import failed.
>>>
Warning: Pending offline transaction has been invalidated.
To reschedule, run: dnf5daemon-server
Complete!
real 0m29.036s
user 0m13.998s
sys 0m2.652sTwo things in that output look alarming and are not. The offline transaction warning means an update was queued through dnf5daemon-server, the backend GNOME Software uses; dnf invalidated it, and the output says how to reschedule it. The %post error is the Chrome install script trying to import the same Google key with rpm --import while dnf still holds the rpm database. On Fedora 45 it fails on the keyring lock. On Fedora 44 it fails on the transaction lock instead. In both cases dnf had already imported the key. List the keys to confirm:
rpm -qa gpg-pubkey --qf "%{version}-%{release} %{summary}\n"The Google key is there next to the Fedora key:
4f50a6114cd5c6976a7f1179655a4b02f577861e-6888bc98 Fedora (45) <[email protected]> public key
eb4c1bfd4f042f6dddccec917721f63bd38b4796-570c8cd3 Google Inc. (Linux Packages Signing Authority) <[email protected]> public keyCheck which key signed the package:
rpm -qi google-chrome-stable | sed -n "/^Signature/,/^Source/p"It is subkey FD533C07C264648F:
Signature :
RSA/SHA512, Thu 01 Oct 2026 07:06:24 AM EAT, Key ID fd533c07c264648f
Source RPM : google-chrome-stable-154.0.8037.97-1.src.rpmThat subkey is one of three still valid in the Google certificate. Five older ones have expired. This lists them all:
curl -sS https://dl.google.com/linux/linux_signing_key.pub | gpg --show-keys --keyid-format long 2>/dev/null | grep -E "^(pub|sub)"The signing subkey runs to 2028:
pub rsa4096/7721F63BD38B4796 2016-04-12 [SC]
sub rsa4096/1397BC53640DB551 2016-04-12 [S] [expired: 2019-04-12]
sub rsa4096/6494C6D6997C215E 2017-01-24 [S] [expired: 2020-01-24]
sub rsa4096/78BD65473CB3BD13 2019-07-22 [S] [expired: 2022-07-21]
sub rsa4096/4EB27DB2A3B88B8B 2021-10-26 [S] [expired: 2024-10-25]
sub rsa4096/E88979FB9B30ACF2 2023-02-15 [S] [expired: 2026-02-14]
sub rsa4096/32EE5355A6BC6E42 2024-01-30 [S] [expires: 2027-01-29]
sub rsa4096/FD533C07C264648F 2025-01-07 [S] [expires: 2028-01-07]
sub rsa4096/1D09C015006FEAB8 2026-03-10 [S] [expires: 2029-03-09]Confirm the binary:
google-chrome --versionThe version matched the repo build:
Google Chrome 154.0.8037.97 What the install script changes
The Chrome %post script does more than import a key. It installs a daily cron job and rewrites the repo file. Verify the package that owns that file:
rpm -V fedora-workstation-repositoriesOn the Workstation box the file Fedora shipped is flagged as modified (size and checksum):
S.5....T. c /etc/yum.repos.d/google-chrome.repo
.......T. c /etc/yum.repos.d/rpmfusion-nonfree-nvidia-driver.repo
.......T. c /etc/yum.repos.d/rpmfusion-nonfree-steam.repoRead it again:
cat /etc/yum.repos.d/google-chrome.repoThe rewritten file lost its skip_if_unavailable=True line:
[google-chrome]
name=google-chrome
baseurl=https://dl.google.com/linux/chrome/rpm/stable/x86_64
enabled=1
gpgcheck=1
gpgkey=https://dl.google.com/linux/linux_signing_key.pubThe key list, the modified repo file and the new contents together:
That is cosmetic for most desktops. It does mean a Google outage now fails a full dnf upgrade on this repo instead of skipping it. The cron job is /etc/cron.daily/google-chrome, the Google repo maintenance script.
Install the downloaded RPM instead
Some people download google-chrome-stable_current_x86_64.rpm from google.com/chrome and install that file. On Fedora 45 the tool you pick decides what happens. Both runs below started from the same clean Fedora 45 Workstation, with no Google key and no Liberation fonts installed:
rpm -q liberation-fonts-all google-chrome-stable; rpmkeys --listThe starting state:
package liberation-fonts-all is not installed
package google-chrome-stable is not installed
4f50a6114cd5c6976a7f1179655a4b02f577861e Fedora (45) <[email protected]> public keydnf install of the file skips the signature check
Fetch the file and hand it to dnf in one line:
curl -sSLO https://dl.google.com/linux/direct/google-chrome-stable_current_x86_64.rpm && sudo dnf install -y ./google-chrome-stable_current_x86_64.rpmdnf resolved the font dependency from the Fedora repo, installed Chrome from @commandline and said plainly that it skipped the OpenPGP check. The Chrome script then failed its key import on the lock, as before:
Updating and loading repositories:
Repositories loaded.
Package Arch Version Repository Size
Installing:
google-chrome-stable x86_64 0:154.0.8037.97-1 @commandline 435.8 MiB
Installing dependencies:
liberation-fonts-all noarch 1:2.1.5-16.fc45 fedora 0.0 B
Transaction Summary:
Installing: 2 packages
Total size of inbound packages is 139 MiB. Need to download 7 KiB.
After this operation, 436 MiB extra will be used (install 436 MiB, remove 0 B).
Warning: A pending offline transaction initiated by the following command will be invalidated: dnf5daemon-server
[1/1] liberation-fonts-all-1:2.1.5-16.f 100% | 42.3 KiB/s | 7.3 KiB | 00m00s
--------------------------------------------------------------------------------
[1/1] Total 100% | 4.5 KiB/s | 7.3 KiB | 00m02s
Running transaction
[1/4] Verify package files 100% | 1.0 B/s | 2.0 B | 00m01s
[2/4] Prepare transaction 100% | 13.0 B/s | 2.0 B | 00m00s
[3/4] Installing liberation-fonts-all-1 100% | 175.0 B/s | 124.0 B | 00m01s
[4/4] Installing google-chrome-stable-0 100% | 31.3 MiB/s | 435.8 MiB | 00m14s
>>> Running %post scriptlet: google-chrome-stable-0:154.0.8037.97-1.x86_64
>>> Finished %post scriptlet: google-chrome-stable-0:154.0.8037.97-1.x86_64
>>> Scriptlet output:
>>> error: can't create keyring lock on /usr/lib/sysimage/rpm/.keyring.lock (Resource temporarily unavailable)
>>> error: /tmp/google.sig.FZ8E3t: key 1 import failed.
>>>
Warning: skipped OpenPGP checks for 1 package from repository: @commandline
Warning: Pending offline transaction has been invalidated.
To reschedule, run: dnf5daemon-server
Complete!So Fedora 45 dnf still does not verify local packages by default (localpkg_gpgcheck is off), the same as Fedora 44. Check the keys and the package:
rpmkeys --list; rpm -q google-chrome-stableThe system ended up with Chrome and no Google key:
4f50a6114cd5c6976a7f1179655a4b02f577861e Fedora (45) <[email protected]> public key
google-chrome-stable-154.0.8037.97-1.x86_64The Fedora 44 Cloud machine did the same with the URL form:
sudo dnf install -y https://dl.google.com/linux/direct/google-chrome-stable_current_x86_64.rpmOn a Cloud image that is a large transaction, because Chrome pulls in the whole GTK desktop stack:
Transaction Summary:
Installing: 252 packages
Total size of inbound packages is 325 MiB. Need to download 187 MiB.
After this operation, 1 GiB extra will be used (install 1 GiB, remove 0 B).Check the keys afterwards:
rpm -qa gpg-pubkey --qf "%{version}-%{release} %{summary}\n"Only the Fedora key was present:
36f612dcf27f7d1a48a835e4dbfcf71c6d9f90a6-6786af3b Fedora (44) <[email protected]> public keyThe key gets imported the first time dnf installs a Chrome package from the repo itself. A reinstall forced it here:
sudo dnf -y reinstall google-chrome-stableThen the key list again:
rpm -qa gpg-pubkey --qf "%{version}-%{release} %{summary}\n"The Google key had arrived:
36f612dcf27f7d1a48a835e4dbfcf71c6d9f90a6-6786af3b Fedora (44) <[email protected]> public key
eb4c1bfd4f042f6dddccec917721f63bd38b4796-570c8cd3 Google Inc. (Linux Packages Signing Authority) <[email protected]> public keyOn a desktop that means the first Chrome update from the repo asks to import the key. Answer yes, or install from the repo in the first place.
rpm -i refuses the package without the key
Plain rpm is stricter. On the second clean run, download the file and check the signature first:
curl -sSLO https://dl.google.com/linux/direct/google-chrome-stable_current_x86_64.rpm
rpm -K google-chrome-stable_current_x86_64.rpm; echo "exit=$?"Without the Google key in the rpm keyring, the check fails:
google-chrome-stable_current_x86_64.rpm: digests SIGNATURES NOT OK
exit=1rpm does not resolve dependencies, so the first attempt stops on the missing fonts before the signature matters:
sudo rpm -ivh google-chrome-stable_current_x86_64.rpm; echo "exit=$?"The output:
warning: google-chrome-stable_current_x86_64.rpm: Header OpenPGP V4 RSA/SHA512 signature, key ID fd533c07c264648f: NOKEY
error: Failed dependencies:
liberation-fonts is needed by google-chrome-stable-154.0.8037.97-1.x86_64
exit=1Install the fonts from the Fedora repo:
sudo dnf install -y liberation-fonts 2>&1 | grep -E "^ liberation|Complete"One package:
liberation-fonts-all noarch 1:2.1.5-16.fc45 fedora 0.0 B
Complete!Run the same rpm command again:
sudo rpm -ivh google-chrome-stable_current_x86_64.rpm; echo "exit=$?"Now rpm reaches the signature and refuses. Fedora 44 only warned about a missing key; Fedora 45 stops:
warning: google-chrome-stable_current_x86_64.rpm: Header OpenPGP V4 RSA/SHA512 signature, key ID fd533c07c264648f: NOKEY
Verifying... ########################################
Preparing... ########################################
package google-chrome-stable-154.0.8037.97-1.x86_64 does not verify: Header OpenPGP V4 RSA/SHA512 signature, key ID fd533c07c264648f: NOKEY
exit=1The fix is to import the key before the package:
sudo rpmkeys --import https://dl.google.com/linux/linux_signing_key.pub; echo "exit=$?"rpm lists the five expired subkeys and imports the certificate anyway:
warning: Certificate 7721F63BD38B4796:
Subkey 4EB27DB2A3B88B8B is expired: The subkey is not live, because Expired on 2024-10-25T14:11:43Z
Subkey 1397BC53640DB551 is expired: The subkey is not live, because Expired on 2019-04-12T05:55:20Z
Subkey 78BD65473CB3BD13 is expired: The subkey is not live, because Expired on 2022-07-21T18:13:02Z
Subkey 6494C6D6997C215E is expired: The subkey is not live, because Expired on 2020-01-24T02:45:32Z
Subkey E88979FB9B30ACF2 is expired: The subkey is not live, because Expired on 2026-02-14T15:25:12Z
exit=0Check the file again:
rpm -K google-chrome-stable_current_x86_64.rpmNow the signature verifies:
google-chrome-stable_current_x86_64.rpm: digests signatures OKThe refusal, the import and the clean check from the first test run on the same box:
Install it again with rpm:
sudo rpm -ivh google-chrome-stable_current_x86_64.rpm; echo "exit=$?"It installs, and the same lock error from the install script shows up here too:
Verifying... ########################################
Preparing... ########################################
Updating / installing...
google-chrome-stable-154.0.8037.97-1 ########################################
error: can't create keyring lock on /usr/lib/sysimage/rpm/.keyring.lock (Resource temporarily unavailable)
error: /tmp/google.sig.KfiCgR: key 1 import failed.
exit=0The guide to NOKEY and signature errors on Fedora 45 covers this rpm change in depth, including how to turn on signature checks for local dnf installs.
First launch
Start Chrome from the Activities overview. On the first run the test box showed, in order, the Google additional terms of service, a keyring prompt, and the welcome dialog.
The keyring prompt appears on machines that log in automatically. Chrome stores its saved passwords in the desktop keyring, and that keyring is locked until it gets your password. On Fedora 45 the secret service is the new oo7 daemon, not gnome-keyring. Check it:
rpm -q oo7-daemon gnome-keyring; busctl --user status org.freedesktop.secrets | grep -E "^(Comm|Exe)="The bus name belongs to oo7-daemon:
oo7-daemon-0.7.0~beta-1.fc45.x86_64
gnome-keyring-51.1-1.fc45.x86_64
Comm=oo7-daemon
Exe=/usr/libexec/oo7-daemonThe prompt looks like this:
Type your login password once to unlock it for the session.
The welcome dialog sets Chrome as the default browser and opts you into usage statistics. Untick the second box if you do not want crash reports sent to Google.
Chrome runs as a native Wayland client on GNOME. chrome://version shows the Wayland Ozone backend on the command line:
Set Chrome as the default browser
The welcome checkbox is enough. From a terminal, check it with xdg-settings:
xdg-settings get default-web-browserIt pointed to Chrome after the welcome dialog:
google-chrome.desktopThe handler for HTTPS links agrees:
xdg-mime query default x-scheme-handler/httpsSame desktop file:
google-chrome.desktopGNOME Settings shows the same thing under Apps, Default Apps:
Beta, Dev and Canary channels
The same repo carries all four channels. Each one is a separate package with its own binary and its own profile under ~/.config, so they install side by side:
dnf repoquery --qf "%{name} %{version}\n" "google-chrome*"The channel versions on the test day:
Updating and loading repositories:
Repositories loaded.
google-chrome-beta 156.0.8078.4
google-chrome-canary 157.0.8084.0
google-chrome-stable 154.0.8037.97
google-chrome-unstable 157.0.8081.0Install Beta next to Stable with sudo dnf install google-chrome-beta.
Chromium and the Flatpak
Fedora builds Chromium itself. Query it:
dnf repoquery --qf "%{name} %{version} %{repoid}\n" chromiumThe Fedora 45 repos carry it at the same major version:
Updating and loading repositories:
Repositories loaded.
chromium 154.0.8037.57 fedora
chromium 154.0.8037.92 updates-testingChromium has no Google account sync. Flathub also lists com.google.Chrome. It is a community wrapper that downloads the Google binary, not a Google build. It needs Flathub enabled; the Flatpak and Flathub guide for Fedora covers that. With Flathub on:
flatpak remote-info flathub com.google.Chrome | grep -E "ID|Version|Download|Installed"The listing:
ID: com.google.Chrome
Version: 154.0.8037.97-1
Download Size: 9.8 MB
Installed Size: 23.1 MBThe other Chromium browsers install the same way as Chrome, from a vendor repo: see Brave on Fedora and Vivaldi on Fedora. For codecs in the other apps on the system, including Firefox, follow the RPM Fusion and codecs guide.
Keep Chrome updated
Chrome updates arrive with every dnf upgrade. Check one package without applying anything:
dnf check-upgrade google-chrome-stableExit code 0 means nothing is waiting. Exit code 100 means an update is available.
Uninstall Google Chrome
Removing the package leaves three things behind: the repo, the Google key and your profile. On the test box:
sudo dnf remove -y google-chrome-stableThen check what is left:
ls /etc/yum.repos.d/ /etc/cron.daily/; dnf repolist | grep googleThe cron job went with the package. The repo stayed:
/etc/cron.daily/:
/etc/yum.repos.d/:
google-chrome.repo
rpmfusion-nonfree-nvidia-driver.repo
rpmfusion-nonfree-steam.repo
google-chrome google-chromeThe key is still trusted:
rpm -q gpg-pubkey --qf "%{version} %{summary}\n" | grep -i googleHere it is:
eb4c1bfd4f042f6dddccec917721f63bd38b4796 Google Inc. (Linux Packages Signing Authority) <[email protected]> public keyAnd the profile stayed in the home directory:
du -sh ~/.config/google-chrome ~/.cache/google-chromeIts size:
77M /home/josphat/.config/google-chrome
820K /home/josphat/.cache/google-chromeClean up all three if you want Chrome gone for good:
sudo dnf config-manager setopt google-chrome.enabled=0
sudo rpmkeys --delete eb4c1bfd4f042f6dddccec917721f63bd38b4796
rm -rf ~/.config/google-chrome ~/.cache/google-chromeThe last line deletes bookmarks, history and saved passwords. Keep that directory if you plan to come back.
The key deletion worked on both test machines. On Fedora 44 it returned 0; listing the keys afterwards:
rpmkeys --listOnly the Fedora key remained:
36f612dcf27f7d1a48a835e4dbfcf71c6d9f90a6 Fedora (44) <[email protected]> public keyTroubleshooting
“does not verify: … NOKEY” from rpm -i
Fedora 45 rpm refuses packages whose key is not in the keyring. Import the Google key with rpmkeys --import as shown above, or install from the repo with dnf.
Chrome repo is enabled in the file but dnf ignores it
This one catches people out. The Chrome install script writes enabled=1 into /etc/yum.repos.d/google-chrome.repo. If you ever ran config-manager setopt google-chrome.enabled=0, the override file still says 0, and it wins. On the test box the repo file said enabled and dnf did not list the repo:
cat /etc/yum.repos.d/google-chrome.repo; dnf repolist | grep googleThe file and the empty repolist:
[google-chrome]
name=google-chrome
baseurl=https://dl.google.com/linux/chrome/rpm/stable/x86_64
enabled=1
gpgcheck=1
gpgkey=https://dl.google.com/linux/linux_signing_key.pubRead the override:
cat /etc/dnf/repos.override.d/99-config_manager.repoIt was the cause:
# Generated by libdnf5.
# Do not modify this file manually, use dnf5 config-manager instead.
[google-chrome]
enabled=0Drop the override and the repo comes back:
sudo dnf config-manager unsetopt google-chrome.enabled
dnf repolist | grep googleThe repo was listed again:
google-chrome google-chrome“can’t create keyring lock” during install
The Chrome %post key import collides with the dnf lock. It is harmless when you install from the repo, because dnf already imported the key. After a dnf install of the downloaded file or its URL, the key is missing until the first repo install, so expect a key import prompt on the first update.
“Failed to download metadata” for google-chrome
The Google repo is not tied to the Fedora release number, so it does not break on a new Fedora version the way some vendor repos do. If dnf fails on it, the Google server is unreachable. The third-party repo 404 guide for Fedora 45 covers the vendors that do break. For everything else on a new install, see the Fedora 45 post-install checklist.
Or just install Trivalent which is telemetry-free, hardened version of Chrome
Good shout. Trivalent is a solid option if you want hardened Chromium with the Google telemetry stripped, just keep in mind it is a separate fork and not Chrome itself. On Fedora you grab it from the secureblue COPR: dnf copr enable secureblue/trivalent then dnf install trivalent-chromium.