Mozilla Rotates Firefox and Thunderbird GPG Signing Key After Accidental GitHub Exposure

Overview

Mozilla has rotated the GPG signing subkey it uses to authenticate certain Firefox and Thunderbird release artifacts after discovering that an unencrypted copy of the previous subkey had been accidentally exposed. In a Mozilla security blog post, the organization said “an unencrypted copy of the previous subkey was inadvertently committed to a private GitHub repository.”

What We Know

• The exposed subkey was used to sign “certain Firefox and Thunderbird artifacts (namely Linux tarballs, RPM packages, checksums files),” according to Mozilla’s blog post.
• Mozilla said “our review of available audit records found no evidence that the key was accessed by an unauthorized party while it was present in the repository,” per the blog post.
• According to BleepingComputer, Mozilla assessed the supply-chain-attack risk as low because access to the private repository was limited to a small group within the organization, all of whom already had authorized access to the key through other channels.
• The new GPG fingerprint is 14F2 6682 D091 6CDD 81E3 7B6D 61B7 B526 D98F 0353, with a signing subkey fingerprint of 827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3, according to Mozilla. The new subkey expires August 5, 2028.
• Mozilla revoked the previous signing key after discovering the exposure and said it has “implemented safeguards to prevent similar incidents,” per the blog post.
• Most users do not need to take any action, but according to BleepingComputer, people who manually verify GPG signatures must import the new signing key and the revocation certificate for the old one.
• Linux users installing Firefox via RPM packages may need manual steps depending on their distribution: Fedora 43 and later requires no special action beyond a dnf key-confirmation prompt, while Fedora 42 and older, RHEL/Rocky/Almalinux, and openSUSE/SUSE-based systems require manually removing the old key before importing the new one, per BleepingComputer.
• Thunderbird users are exempt from the RPM-specific steps because, as BleepingComputer reported, “Thunderbird does not provide official RPM packages.”
• The new public key and the revocation certificate for the old one are available through Firefox Nightly archives and keys.openpgp.org, according to Mozilla.

What We Don’t Know

Mozilla has not disclosed how long the unencrypted subkey sat in the private GitHub repository before it was discovered, nor the exact process that surfaced the exposure. The organization’s audit review found no evidence of unauthorized access, but neither source specifies the scope or duration of that audit.

Analysis

The incident illustrates a recurring risk in open-source release engineering: cryptographic material meant to guarantee the integrity of a software supply chain can itself become a supply-chain liability if mishandled during development workflows. Mozilla’s response — swift revocation, a same-week key rotation, and public disclosure with specific remediation steps for affected Linux distributions — reflects standard incident-response practice for signing-key exposures, even where, as here, the organization found no evidence the leaked material was ever exploited.