Mozilla replaces Firefox GPG key after private key leak

On Monday Mozilla issued a replacement GPG signing subkey used for some Firefox and Thunderbird artifacts after an unencrypted private signing key was accidentally committed to a private GitHub repository.

The exposed key had been used to sign Linux tarballs, RPM packages and checksum files. Mozilla revoked the old subkey and published a new one for release verification.

The unencrypted private key was stored in a repository set to private and accessible only to a small group of developers who already had other access to the key. Mozilla reviewed available audit records and found no evidence of unauthorized access while the key was present in the repository. In a statement Mozilla wrote: “Our review of available audit records found no evidence that the key was accessed by an unauthorized party while it was present in the repository.”

If an attacker obtains a release signing key, they could create valid signatures on malicious files, which creates a software supply chain risk. For a forged release to reach users an attacker would still need a way to deliver the signed files, for example via a compromised mirror, an alternate download path or targeted social engineering. Mozilla said several factors in this case reduced the likelihood of such an attack and chose to rotate the key to remove any remaining risk.

Most Firefox and Thunderbird users do not need to take action. People who manually verify GPG signatures must import Mozilla’s new signing key and the revocation for the old key. Users who install Firefox via RPM packages may need to follow Mozilla’s published instructions to update the key used by their package manager and to trust the new signature.

Mozilla has put additional protections in place to reduce the chance of a similar accidental exposure in future and has published guidance for affected users and maintainers.