Mozilla has recently revoked a GPG signing subkey used for certain Firefox and Thunderbird release artifacts. This action was taken after an unencrypted copy of the subkey was inadvertently committed to a private GitHub repository. The affected key was responsible for signing Linux tarballs, RPM packages, and checksum files.
Upon discovering the exposure, Mozilla conducted a thorough review of audit logs and determined that access to the private repository was limited to a small internal group. Importantly, all individuals with access to this repository were already authorized to handle the signing key through other approved channels. As a precautionary measure, Mozilla revoked the compromised subkey and implemented additional safeguards to prevent similar incidents in the future.
GPG signing keys are essential for software supply-chain security, enabling users and administrators to verify the authenticity of downloaded files. A leaked private signing subkey could potentially allow malicious actors to create counterfeit packages that appear legitimate. Although there is no evidence of misuse in this case, revoking the exposed subkey ensures it cannot be used to sign future releases.
For most Firefox and Thunderbird users, no action is required. Standard installations and updates are expected to proceed without disruption. However, users who manually validate Mozilla release signatures with GPG will need to import the newly published signing key and the revocation certificate for the previous key. It’s important to note that releases signed with the revoked key may no longer validate after the revocation is imported, which is standard GPG behavior.
Users of Firefox RPM packages may need to take additional steps, depending on their Linux distribution. Systems running Fedora 43 and later should automatically download the updated signing key during the next update. Users should verify that the subkey fingerprint matches 827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3 before accepting the import. Older Fedora releases, as well as RHEL, Rocky Linux, AlmaLinux, openSUSE, and SUSE systems, cannot automatically replace the old key. On these systems, package updates may fail with messages indicating issues with the GPG key. Administrators will need to manually remove the old RPM signing key, import Mozilla’s replacement key, and refresh package metadata.
Mozilla has identified the new primary GPG key fingerprint as 14F2 6682 D091 6CDD 81E3 7B6D 61B7 B526 D98F 0353, with the new signing subkey set to expire on August 5, 2028. The public key and revocation certificate for the old key are available through Firefox Nightly KEY files, keys.openpgp.org, and Mozilla’s published key material.
This incident underscores the critical importance of secure key management in maintaining software supply-chain integrity. Even limited exposure of private cryptographic material can pose significant risks. Mozilla’s prompt response—including auditing access, revoking the compromised subkey, rotating credentials, and providing clear guidance to users—demonstrates a commitment to preserving trust in its signed software releases.
