Trivalent is a Chromium build for desktop Linux that carries the hardening patches from Vanadium, the browser GrapheneOS ships on hardened Android. You can install Trivalent on Fedora from one RPM repository. Once it’s in, the risky defaults are already flipped: the JavaScript JIT is off, WebGL and extensions are blocked, and content filtering runs inside the engine before you open a single settings page.
This guide covers Fedora 45 and 44 Workstation and spins. It also answers the question most people hit right after the Fedora 45 upgrade: there’s no Fedora 45 build of Trivalent yet, but the Fedora 44 build installs and runs cleanly on 45, and the output below shows why. Every command here was run on a fresh Fedora 45 VM with SELinux enforcing in November 2026, with Trivalent 156 from the secureblue repository.
What Trivalent changes
Trivalent is a security browser, not a privacy browser, and the project is blunt about the difference. Anything that trades security for “privacy” is out of scope, which is why it won’t bring back the old Manifest V2 extension API. What you get instead is a Chromium with a smaller attack surface and defaults chosen by people who assume the web is hostile.
These are the changes you’ll notice on day one:
- Vanadium desktop patches applied to the Chromium engine
- Content filtering through the built-in Chromium subresource filter
- Password manager and search suggestions made opt-in
- Metrics and data collection switched off at build time
- A Hardening block in
chrome://settings/securitythat stock Chromium doesn’t have
None of it needs configuration. Install the package and the hardened defaults are live, so the rest of this guide is about getting the package in cleanly and knowing which toggles you might want to change.
Prerequisites
Trivalent is packaged for Fedora only, and the project calls the repo install “unsupported”, meaning secureblue is the system it’s tested against. In practice the Fedora route works fine, as the lab output below shows. You need:
- Fedora 45 or 44 (Workstation, KDE or another dnf-based spin)
- x86_64 or aarch64 hardware
- A user account with
sudo
secureblue only publishes this Fedora RPM repository, so there’s nothing to install on Debian, Ubuntu or Kali, no Flatpak build to fall back on, and Rocky Linux and AlmaLinux are out too. Off Fedora, the closest you’ll get is plain Chromium with your own policy file. If you’re still on Fedora 44, you can install Trivalent now and keep it through the upgrade to Fedora 45, because the package comes from the same repo on both releases.
Skip the Trivalent COPR
Many guides tell you to run dnf copr enable secureblue/trivalent and then install trivalent-chromium. That COPR exists, but it only carries build inputs, the cleaned Chromium source tarball. We enabled it on the Fedora 45 VM to check, and this is everything it offers:
dnf repoquery --repo="copr:copr.fedorainfracloud.org:secureblue:trivalent" --availableEvery row is trivalent-chromium-clean-source, and the install those guides suggest fails because no browser package exists in the COPR:
Failed to resolve the transaction:
No match for argument: trivalent-chromium
You can try to add to command line:
--skip-unavailable to skip unavailable packagesThe screenshot below is the full COPR session from our Fedora 45 VM, from the repoquery to the failed install.
If you already enabled it, remove it with sudo dnf copr remove secureblue/trivalent so it does not add a useless metadata download to every dnf run. The real package lives in the secureblue RPM repository.
Add the secureblue repository
Download the repo file into /etc/yum.repos.d/ and import the signing key. The repo has both gpgcheck and repo_gpgcheck enabled, so dnf checks the signature on the metadata as well as on each package:
sudo curl -fsSL https://repo.secureblue.dev/secureblue.repo -o /etc/yum.repos.d/secureblue.repo
sudo rpm --import https://repo.secureblue.dev/secureblue.gpgIt’s a flat repository: the baseurl has no $releasever, so Fedora 44 and 45 read the same metadata and get the same RPM. Check that the browser resolves, and run the check with sudo (the next section explains why):
sudo dnf list --available trivalentOn the first run dnf shows the key with fingerprint 26B4463ED8F313BC7E3FBDF9D9223AF0F47B3E41 and asks you to accept it. Answer y and the package list appears:
Importing OpenPGP key 0xF47B3E41:
UserID : "secureblueadmin <[email protected]>"
Fingerprint: 26B4463ED8F313BC7E3FBDF9D9223AF0F47B3E41
From : https://repo.secureblue.dev/secureblue.gpg
Is this ok [y/N]: The key was successfully imported.
Repositories loaded.
Available packages
trivalent.x86_64 156.0.8078.79-448333 secureblue
trivalent.aarch64 156.0.8078.79-448346 secureblueBefore you accept, check that your prompt shows 26B4 463E D8F3 13BC 7E3F BDF9 D922 3AF0 F47B 3E41, the fingerprint of the key served from repo.secureblue.dev. That key signs everything you’ll install from this repo, so it’s the one moment in the setup where your judgment matters. The screenshot below shows the same exchange, piped through echo y in the lab:
With the key accepted and both architectures listed, the repository is ready and the install itself is one command.
repomd.xml GPG signature verification error: Signing key not found
Run the same dnf list as your normal user and dnf5 on Fedora 45 refuses the repo, even though rpm --import already put the key in the RPM database. As a normal user the key import never completes, and dnf reports a failed metadata signature check:
Is this ok [y/N]: secureblue 100% | 554.0 B/s | 1.8 KiB | 00m03s
>>> repomd.xml GPG signature verification error: Signing key not found
Repositories loaded.
No matches found.“No matches found” makes it look like the package is gone, which is why the error sends people off looking for a Fedora 45 build that doesn’t need to exist. We hit it in the lab right after rpm --import, and again after dnf running as root had accepted the key, so the unprivileged run never recovers on its own:
The fix is to query the repo with sudo, as shown above. Running as root, dnf imports the metadata key once you accept it, and every later install, upgrade and sudo dnf list works. Do not set repo_gpgcheck=0 to silence the error, because that throws away the metadata signature check the repo was built around.
Install Trivalent on Fedora 45
Install the browser with dnf. Trivalent bundles its own Chromium runtime instead of linking the system one, so the package alone is about 634 MiB installed:
sudo dnf install trivalentOur VM started from the Fedora Cloud image, so dnf also pulled in the desktop libraries a Workstation install already has. Expect a much shorter dependency list on a real desktop than this one:
Installing:
trivalent x86_64 0:156.0.8078.79-448333 secureblue 633.6 MiB
Transaction Summary:
Installing: 218 packages
Total size of inbound packages is 301 MiB. Need to download 301 MiB.
After this operation, 1 GiB extra will be used (install 1 GiB, remove 0 B).Among the weak dependencies dnf also pulls in trivalent-selinux, a separate SELinux policy package that lagged the browser in this run (152 against 156), so you do not need to install it yourself. SELinux stayed enforcing for the whole run, and we never had to relabel anything or switch to permissive mode to get the browser started.
Once it finishes, confirm the version and check where the build came from. The --version output carries a build note that rpm does not show, and it is the quickest way to see which Fedora release the binary was compiled for.
rpm -q trivalent
trivalent --versionThe second line answers the Fedora 45 question directly:
trivalent-156.0.8078.79-448333.x86_64
Trivalent 156.0.8078.79 Built from source for Fedora release 44 (Forty Four)That’s the Fedora 44 build, running on a box that reports Fedora release 45 (Forty Five) with kernel 7.2.15. Because the RPM ships its own Chromium and only asks for common libraries like glibc, GTK, ALSA and bubblewrap, the Fedora 45 repos satisfy every dependency. You do not need a workaround or a pinned $releasever, and when secureblue starts building on 45 the change will arrive as a normal update:
On KDE Plasma or another Qt desktop, add the Qt integration package for native dialogs and theming. It’s 43 KiB on its own and pulled 27 packages on the Cloud-based VM:
sudo dnf install trivalent-qt6-uiGNOME needs only the base package. Launch Trivalent from the Activities overview or with the trivalent command.
Pick a search engine on first launch
The first window opens with a “Choose your search engine” dialog, and Trivalent will not load the page behind it until you choose. The list is shown in random order, and it includes DuckDuckGo, Startpage, Brave and a “Google (No AI)” entry next to plain Google:
Pick one and click Set as default. You can change it later under Settings, Search engine. Search suggestions stay off whatever you pick, so typing in the address bar does not send each keystroke to the provider. After that it looks like any other Chromium:
Open chrome://version if you want the build details in the browser itself. The top line repeats what trivalent --version printed, and the profile lives under ~/.config/trivalent, which is the directory to back up or delete:
So far it behaves like any Chromium build, because what makes it different sits one settings page deeper. Before you start browsing for real, spend a few minutes on the two pages in the next sections.
Review the hardening settings
Open chrome://settings/security and scroll past Secure connections. Secure DNS is on, and “Always use secure connections” warns for private sites as well as public ones. The JIT control sits under Security, and the Hardening block below it holds Block 3D APIs, the WebRTC policy, Network Service Sandbox and Block Extensions. These are the ones that change how sites behave:
- Manage JavaScript JIT: off by default, with per-site exceptions
- Block 3D APIs: on, so WebGL is unavailable to pages
- Block Extensions: on, and changing it needs a restart
The JIT setting is the one you’ll feel. With the V8 optimizing compiler off, heavy web apps run slower. In exchange, a whole class of JIT memory-corruption bugs has nothing to attack, and the description in Trivalent itself says enabling it makes the browser “slightly less resistant to attacks”. Leave it off and click the arrow on that row instead: the JavaScript JIT page has an “Always allowed to use JavaScript JIT” list with an Add button, so the two or three web apps you can’t live without get the JIT while every other site stays on the slower, safer path.
Block Extensions is newer than most Trivalent guides and catches people out: on a fresh profile no extension installs until you turn it off and restart. That’s deliberate, since an extension with access to every page is a bigger risk than most of what it blocks, and the built-in content filter already covers ad and tracker blocking. The same block sets the WebRTC policy to “Disable Non-Proxied UDP” so a site can’t learn your local address through WebRTC, and keeps Network Service Sandbox off, because the secureblue FAQ notes it can clear cookies on exit.
Under chrome://settings/appearance there’s also a “Website dark mode” toggle, off by default, that forces dark rendering on pages that don’t offer it.
Turn on the stricter flags
A second layer of hardening lives in chrome://flags, where the description of each Trivalent flag includes “provided by Trivalent” or “exposed by Trivalent”. Two of the three below ship off because they can break sites, so turn them on one at a time and browse for a day before adding the next:
- Show punycode for IDN domains (
#show-punycode-domains): set to Enabled - Clear cross-origin referrers (
#clear-cross-origin-referrers): set to Enabled - Strict Popup Blocking (
#strict-popup-blocking): already Enabled
The punycode flag is the one we’d turn on first. It shows internationalized domains as raw xn-- names, which kills the phishing trick where a lookalike Unicode letter impersonates the domain of your bank. Clearing cross-origin referrers means sites learn less about where you came from, though a few login flows and payment pages that check the referrer may break. Strict Popup Blocking works the other way round: it’s already on, and if it gets in the way of a site you trust, set it to Disabled instead of fighting individual pages.
Filtering out unsafe flag on the command line
Command-line switches behave differently from chrome://flags. The trivalent launcher is a shell wrapper that only passes an allowlist of flags (profile and cache directories, --incognito, --ozone-platform, logging and a few others) and quietly drops everything else. We found this while scripting the screenshots for this guide, and raising the log level of the wrapper shows it happening.
BROWSER_LOG_LEVEL=1 trivalent --remote-debugging-port=9222 https://secureblue.devThe browser starts, but without the remote debugging port:
So if a desktop launcher or script passes a switch to Trivalent and nothing changes, this is why. The filter is part of the hardening, because it stops another program from starting the browser with a debugging port or a weakened sandbox. System-wide settings belong in /etc/trivalent/trivalent.conf.d/, which the comments in /etc/trivalent/trivalent.conf name as the place for your own config files.
Keep Trivalent updated
Trivalent follows the Chromium release train closely, and most Chromium releases are security fixes, so a hardened browser you do not update stops being hardened within weeks. On Fedora it upgrades with the rest of the system, or on its own.
sudo dnf upgrade --refresh trivalentOn the lab VM this printed “Nothing to do.” because the installed build was only four days old (built October 30, tested November 3), which tells you how closely the repo tracks upstream. The RPM version matches the tag on the project GitHub releases page, so rpm -q trivalent is enough to confirm you’re on the build with the latest Chromium patches.
We did not test Fedora Silverblue or Kinoite for this guide. The atomic images from secureblue ship Trivalent preinstalled, and that is the setup the project supports. On a dnf-based Fedora 45 or 44 desktop, the signed repo and one package are all it takes, and the settings and flags pages above are worth ten minutes of your time. Add it next to the rest of your Fedora 45 post-install steps, pair it with a hardened base system and keep SELinux enforcing, and you’ve got a browser whose secure choice is also its default one. If you need a mainstream Chromium for the sites that break, keep Brave or Google Chrome next to it as the exception browser.
