Mozilla has rotated and revoked a GPG signing subkey used for selected Firefox and Thunderbird release artifacts after an unencrypted copy of the previous key was inadvertently committed to a private GitHub repository.
In an August 10 advisory, Ben Hearsum said Mozilla’s review of available audit records found no evidence that an unauthorized party accessed the key while it was stored in the repository.
Access was restricted to a small group of Mozilla personnel who already had authorized access to the signing key through other channels. Despite no evidence of misuse, Mozilla revoked the previous key as a precaution and introduced safeguards to prevent a repeat incident.
Mozilla Revokes Firefox and Thunderbird GPG Signing Key
The company has moved to a new signing subkey for Linux tarballs, RPM packages, and checksum files associated with Firefox and Thunderbird releases.
The incident highlights a persistent supply-chain risk: signing infrastructure is a high-value target because a compromised release-signing key could allow an attacker to create artifacts that appear legitimate to users, package managers, and automated deployment systems.
A private repository reduces exposure, but it does not eliminate the risk posed by accidentally committed secrets, particularly when repository access, audit coverage, backups, clones, or log retention are involved.
For most Firefox and Thunderbird users, Mozilla said no action is required. Standard browser updates are not expected to be disrupted. The operational impact is primarily limited to users who manually validate GPG signatures and Linux users consuming Firefox RPM packages from Mozilla’s repository.
Users who independently verify release signatures must import Mozilla’s new public signing key and the revocation certificate for the previous key. Mozilla cautioned that, after importing the revocation, releases signed with the old key will no longer validate.
This is expected behavior in OpenPGP workflows: revocation signals that a key should no longer be trusted for future verification, even if historical artifacts were legitimately signed before the incident.
The new Mozilla release-signing primary key fingerprint is:
14F2 6682 D091 6CDD 81E3 7B6D 61B7 B526 D98F 0353
Its new signing subkey fingerprint is:
827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3
Mozilla said the new signing subkey expires on August 5, 2028. Fedora 43 and newer systems should automatically retrieve the updated key during the next update, but users should confirm that the displayed fingerprint matches the new subkey before accepting the import.
Older RPM-based Linux distributions require manual remediation because their package management tools cannot automatically replace the existing key. This includes Fedora 42 and older releases, as well as RHEL, Rocky Linux, AlmaLinux, openSUSE, and SUSE-based systems.
Affected users may encounter errors such as “Import of the key didn’t help, wrong key?”, “The GPG keys listed for the mozilla repository are already installed but they are not correct for this package,” “Signature verification failed,” or “NOKEY.”
Mozilla instructed users to first remove the old RPM key, then import the updated signing key:
sudo rpm -e --allmatches gpg-pubkey-14f26682d0916cdd81e37b6d61b7b526d98f0353
sudo rpm --import https://packages.mozilla.org/rpm/firefox/signing-key.gpgFedora, RHEL, Rocky Linux, and AlmaLinux users should then run sudo dnf clean all, while openSUSE and SUSE users should run sudo zypper refresh.
Mozilla stressed that importing the replacement key before removing the old one may appear successful while leaving the outdated key installed.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
