Firefox

Mozilla Revokes GPG Signing Key After Accidental Upload to Private GitHub Repository

Mozilla has replaced the GPG key used to sign certain Firefox and Thunderbird builds following an accidental exposure of the unencrypted secret key in a private GitHub repository. The key was intended for signing Linux archives, RPM packages, and checksum files, raising theoretical risks of supply-chain attacks through forged installers. Company audits found no evidence of external misuse, as repository access was limited to a small group of employees who already held legitimate access to the key. Most users require no action, though those manually verifying GPG signatures must import the new key along with revocation data for the old one. Linux administrators installing Firefox via RPM packages on distributions such as Fedora, RHEL, Rocky Linux, AlmaLinux, openSUSE, and SUSE may need to manually update the key to avoid installation failures. Thunderbird users are unaffected by the RPM issue since no official RPM packages are released for the email client. The new key remains valid until August 5, 2028, with public details available in updated KEY files and on keys.openpgp.org.