Mozilla replaces Firefox and Thunderbird Linux release-signing subkey

Mozilla has revoked and replaced a GPG subkey used for specified Firefox and Thunderbird Linux release artifacts after an unencrypted copy was inadvertently committed to a private GitHub repository. The Mozilla Firefox Linux signing key change is largely automatic for ordinary users, but it creates manual work for people who verify signatures themselves and for Firefox RPM users on several distributions.

The affected subkey signed Linux tarballs, RPM packages and checksum files for Firefox and Thunderbird, Mozilla said. It was not a blanket change to signing across every Firefox platform or distribution channel.

Mozilla said access to the repository was restricted to a small internal group whose members already had authorized access to the key through other means. Its review of available audit records found no evidence that an unauthorized party accessed the key while it was in the repository. Mozilla also said it had added safeguards intended to prevent a similar incident.

The company did not disclose how the unencrypted copy was committed or how long it remained in the repository. Those omissions limit what can be concluded beyond Mozilla's audit-record finding.

Which Linux users need to replace Mozilla's Firefox RPM signing key?

Most Firefox and Thunderbird users do not need to take action, according to Mozilla. A signing key lets users and package-management systems check that a software package came from its stated publisher and has not been altered after signing.

• People who manually validate Mozilla GPG signatures must import the new signing key and the revocation for the prior key.
• Fedora 43 and later users should receive the updated key during their next Firefox update through DNF. Mozilla says they should confirm the import only after checking the displayed subkey fingerprint.
• Firefox RPM users on Fedora 42 or earlier, RHEL, Rocky Linux, AlmaLinux, openSUSE and SUSE must remove the old key and manually import the replacement. Mozilla says the relevant package tools do not replace the prior key automatically.
• Thunderbird has no official Mozilla RPM packages, so Thunderbird users have no RPM-specific step to take.

There is a trade-off for people who check historical downloads: once the old subkey's revocation is imported, releases signed with that key will no longer verify normally. Teams that retain old release artifacts or validate software in controlled build environments should account for that before rotating their local trust material.

What fingerprint should users check?

Mozilla lists the new public-key fingerprint as 14F2 6682 D091 6CDD 81E3 7B6D 61B7 B526 D98F 0353. The new signing-subkey fingerprint is 827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3, and Mozilla says the subkey expires on 2028-08-05.

For release engineering and security teams, the incident is a narrow but consequential reminder that private source control is not an appropriate resting place for unencrypted release credentials. The practical issue now is not browser operation for most users, but updating trust configuration where package managers and manual verification workflows retain the previous key.

This story draws on original reporting from The Register.