Mozilla has rotated a GPG signing subkey used to authenticate release artifacts for Firefox and Thunderbird after an unencrypted copy of the previous subkey was unintentionally committed to a private GitHub repository.
The affected signing infrastructure includes selected release files, such as Linux tarballs, RPM packages, and checksum files. Mozilla’s investigation into available audit logs found no evidence that an unauthorized party accessed the exposed key material while it was in the repository.
Mozilla Firefox and Thunderbird GPG Signing Key
Access to the repository was limited to a small internal group, all of whom already had authorized access to the signing key through other means.
Nevertheless, as a precautionary measure to enhance supply-chain security, Mozilla revoked the previous signing key and deployed a new subkey.
“For most users, no action is required,” Mozilla stated. However, administrators who manually verify GPG signatures and users installing Firefox through Mozilla’s RPM repository may need to update their local key material.
New Key Details
Mozilla has identified the new GPG key fingerprint as follows:
Fingerprint:
14F2 6682 D091 6CDD 81E3 7B6D 61B7 B526 D98F 0353The newly deployed signing subkey fingerprint is:
Fingerprint:
827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3The new signing subkey will expire on August 5, 2028. Users of Fedora 43 and later systems should automatically retrieve the updated key during their next package update.
Users should verify that the displayed fingerprint matches 827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3 before accepting the import prompt.
This incident highlights a recurring risk in software release pipelines: private repositories are not a secure boundary for plaintext private signing material.
Even if access is limited and no compromise is identified, exposure of a signing key can undermine confidence in the artifact’s authenticity, necessitating revocation.
Manual RPM Remediation
Older Fedora versions (including Fedora 42 and earlier), as well as RHEL, Rocky Linux, AlmaLinux, and SUSE-based distributions, require manual removal of the old RPM key. Mozilla has warned that DNF and Zypper on these platforms may not automatically replace an existing revoked key.
Affected users should execute the following commands:
sudo rpm -e --allmatches gpg-pubkey-14f26682d0916cdd81e37b6d61b7b526d98f0353
sudo rpm --import https://packages.mozilla.org/rpm/firefox/signing-key.gpgFor Fedora, RHEL, Rocky Linux, and AlmaLinux users, the next step is to run:
sudo dnf clean allFor openSUSE and SUSE systems, users should refresh their repositories with:
sudo zypper refreshMozilla cautioned that administrators must remove the previous key before importing the replacement key. Importing the new key first may yield a success message while leaving the outdated key installed, potentially causing future updates to fail due to signature validation errors.
Thunderbird users do not require RPM-specific remediation, as Mozilla does not distribute official Thunderbird RPM packages. Manual signature verifiers can obtain the new public key and revocation information from Firefox Nightly KEY files or the keys.openpgp.org service.
Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world
