Mozilla has revoked a cryptographic key used to sign releases of its Firefox browser and Thunderbird email client after an unencrypted copy of the private key was inadvertently committed to a GitHub repository. The company confirmed the incident on Monday, stating that the GPG private subkey was placed in a private GitHub repository accessible to a limited number of Mozilla employees, all of whom already had authorized access to the key through other established channels.
Despite the restricted access, Mozilla deemed the exposure of an unencrypted private signing key in source control to be a security risk and subsequently revoked and replaced the compromised subkey. The affected key was specifically used for signing Linux tarballs, RPM packages, and checksum files associated with Firefox and Thunderbird releases. These digital signatures are crucial for users and package managers to verify the authenticity and integrity of software originating from Mozilla.
Mozilla's internal review of available audit records revealed no evidence that the key was accessed by any unauthorized party during its presence in the repository. The company has implemented additional safeguards to prevent similar incidents in the future, although it has not publicly disclosed how the unencrypted key ended up in GitHub or the duration of its exposure.
For the majority of Firefox and Thunderbird users, this key replacement is not expected to require any direct action. However, individuals who manually verify Mozilla's GPG signatures will need to import the new signing key and the revocation for the old one.
Users who installed Firefox via Mozilla's official RPM repository face a slightly more involved process. On Fedora 43 and later versions, the DNF package manager should automatically download the updated key during the next Firefox update, prompting users to approve its import. For users running Fedora 42 or earlier, as well as those on RHEL, Rocky Linux, AlmaLinux, openSUSE, or SUSE, manual intervention is required to remove the old key and import its replacement.
An additional consideration for those verifying older releases is that after importing the revocation, standard signature verification processes will reject any releases signed with the now-revoked subkey. Thunderbird users are not affected by the RPM-specific instructions, as Mozilla does not provide official RPM packages for the email client.
