Mozilla Rotates Firefox and Thunderbird GPG Key After Private GitHub Exposure
Mozilla has replaced a GPG signing subkey used for some Firefox and Thunderbird release files after an unencrypted copy was accidentally committed to a private GitHub repository.
The good news is there’s no evidence anyone unauthorized got to it, but the small group of Linux users who do need to act should not ignore the fine print.
➜ The real story: This is less a Firefox breach than a reminder that a private repo and a safe home for a plaintext signing key are two very different things.
For everyday Firefox and Thunderbird users, this is mostly a behind-the-scenes security cleanup.
The people who should pay attention are administrators who verify GPG signatures manually and Firefox users on certain RPM-based Linux distributions.
What Happened to the Mozilla Firefox and Thunderbird GPG Signing Key?
The old signing subkey was used to authenticate specific Firefox and Thunderbird release artifacts, including Linux tarballs, RPM packages and checksum files.
An unencrypted copy of that private subkey was mistakenly committed to a private GitHub repository.
Available audit records showed no evidence of unauthorized access, and access to the repository was limited to a small internal group that already had legitimate access to the key.
Still, once private signing material lands somewhere it should not be, revoking it and rotating to a new key is the clean move.
Which Firefox and Linux Users Need to Update the Mozilla GPG Key?
For most Firefox and Thunderbird users, there’s nothing to do.
Fedora 43 and newer should retrieve the updated key during the next DNF update, with users asked to confirm the new signing subkey fingerprint: 827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3. Fedora 42 and older, RHEL, Rocky Linux, AlmaLinux, openSUSE and SUSE-based systems may need the old RPM key removed before the replacement is imported, otherwise future package updates can fail signature checks.
Thunderbird does not ship official RPM packages, so there’s no RPM-specific fix required for Thunderbird itself.
Why the Firefox GPG Key Rotation Matters for Software Supply-Chain Security
GPG signatures are one of the trust checks that help confirm a software package really came from the expected publisher and was not modified along the way.
That makes a release-signing private key unusually sensitive, even when the accidental exposure happens inside a private repository instead of out in public.
The bigger lesson is pretty simple: secrets that can validate software releases should live in purpose-built secret or key-management systems, not plaintext files tucked into source control.
The response here is the reassuring part: revoke the questionable key, replace it, tighten the process and keep the blast radius small.
FAQs
Do Firefox Users Need to Do Anything After the Mozilla GPG Key Rotation?
Most users do not. Manual GPG verifiers and some Firefox RPM users may need to update their local signing key.
Which Linux Distributions May Need a Manual Firefox GPG Key Update?
Fedora 42 and older, RHEL, Rocky Linux, AlmaLinux, openSUSE and SUSE-based systems may require manual key replacement.
Was the Mozilla Firefox Signing Key Stolen or Used by Attackers?
There’s no evidence of unauthorized access or misuse in the available audit records. The old key was revoked as a precaution.
