Mozilla rotates Firefox and Thunderbird signing key after GitHub exposure

Mozilla has replaced a GPG subkey used to sign some Firefox and Thunderbird releases after an unencrypted copy of the previous key was accidentally committed to a private GitHub repository.

The organization says its audit records show no evidence that an unauthorized person accessed the key.

Mozilla engineer Ben Hearsum disclosed the incident on August 10, explaining that the affected subkey was used to sign Linux tarballs, Firefox RPM packages, and checksum files distributed with Firefox and Thunderbird releases.

According to Mozilla, access to the private repository was restricted to a small group of employees who were already authorized to access the signing key through other means. Despite finding no signs of misuse, Mozilla revoked the exposed subkey, moved release signing to a new one, and introduced additional safeguards intended to prevent a similar exposure.

Mozilla develops Firefox and oversees the Mozilla Foundation's broader open-web ecosystem, while Thunderbird is an independently operated email client that originated as a Mozilla project. Cryptographic signing keys are an important part of their software distribution process because they allow users and package managers to verify that downloaded files are authentic and have not been modified.

For most Firefox and Thunderbird users, no action is necessary. Users who manually verify Mozilla's GPG signatures will need to import the updated public key and the revocation certificate for the previous signing key.

Firefox users installing RPM packages may also need to intervene, depending on their Linux distribution.

Fedora 43 and later should automatically download the new key during the next update. Users will be asked to approve the import and should verify that the displayed signing subkey fingerprint is:

827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3

On Fedora 42 and earlier releases, as well as RHEL, Rocky Linux, and AlmaLinux, DNF cannot automatically replace the existing key. Mozilla recommends removing the old key before importing the replacement:

sudo rpm -e --allmatches gpg-pubkey-14f26682d0916cdd81e37b6d61b7b526d98f0353
sudo rpm --import https://packages.mozilla.org/rpm/firefox/signing-key.gpg
sudo dnf clean all

The same limitation affects openSUSE and SUSE-based distributions. Users on those systems should remove the existing key, import the replacement, and refresh Zypper:

sudo rpm -e --allmatches gpg-pubkey-14f26682d0916cdd81e37b6d61b7b526d98f0353
sudo rpm --import https://packages.mozilla.org/rpm/firefox/signing-key.gpg
sudo zypper refresh

Mozilla warns that importing the replacement without first removing the previous key can misleadingly report success while leaving the old key installed.

The primary GPG key retains fingerprint 14F2 6682 D091 6CDD 81E3 7B6D 61B7 B526 D98F 0353, while the new signing subkey uses fingerprint 827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3 and expires on August 5, 2028.

Mozilla is distributing the updated public key and the revocation of the previous subkey via Firefox Nightly KEY files and keys.openpgp.org. Users who rely on manual signature verification should update their local keyring, while everyone else can continue using Firefox and Thunderbird normally unless their RPM package manager reports a signing-key error.