Mozilla revokes Firefox signing key after GitHub exposure — users must update verification

Mozilla has issued a new GPG signing subkey for Firefox and Thunderbird artifacts after the previous key was accidentally exposed in a GitHub repository. The organization revoked the compromised key and added extra protections to prevent similar incidents going forward.

The exposure created a potential supply chain attack risk: an attacker with access to the private signing key could generate valid signatures for malicious files. This would allow distributing modified versions of the software that appear authentic. However, a successful attack would still require a way to deliver the signed files to users, such as through a compromised mirror or social engineering.

In Mozilla's case, several factors limited the potential impact. The key was used to sign Linux tarballs, RPM packages, and checksum files. An unencrypted copy of the key was inadvertently committed to a private GitHub repository, accessible only to a small group of Mozilla developers who already had access to the key through other means.

"Our review of available audit records found no evidence that the key was accessed by an unauthorized party while it was present in the repository," Mozilla said. Still, the organization decided not to take any chances and revoked the key.

Most users do not need to take any action. Those who manually verify GPG signatures will need to import the new key and the revocation for the old one. Users of Firefox RPM packages may also need to take some steps — Mozilla has shared detailed instructions for them.

Mozilla's decision reflects a broader trend: amid the well-documented surge in software supply chain attacks over the past year, organizations are increasingly rotating signing keys at the first sign of potential exposure.