Mozilla Replaces Firefox GPG Key After Accidental GitHub Exposure

Mozilla has announced the revocation and replacement of a GPG signing subkey crucial for verifying the authenticity of Firefox and Thunderbird software artifacts. The decision stems from the accidental exposure of the subkey in a private GitHub repository, a move taken to preempt any potential supply chain risks.

While the exposed key was a private subkey, its presence in a repository accessible to a limited group of developers necessitated immediate action. The primary concern with exposed GPG keys is the potential for attackers to sign malicious files, making them appear as legitimate software releases. This could enable sophisticated supply chain attacks, where compromised download mirrors or social engineering tactics could deliver malware disguised as authentic updates.

Fortunately, Mozilla's internal review found no evidence that the exposed key was accessed by unauthorized parties during its brief presence in the repository. The key was primarily used for signing artifacts such as Linux tarballs, RPM packages, and checksum files, meaning the potential impact was somewhat contained. However, the organization opted for a precautionary approach, emphasizing its commitment to software supply chain security.

To mitigate any residual risk and bolster future security, Mozilla has not only revoked the compromised key and issued a new one but has also implemented enhanced protections to prevent similar incidents. These measures aim to strengthen the security posture around key management and code signing processes.

Most end-users of Firefox and Thunderbird are unlikely to be affected by this change and do not need to take any specific action. The browser and email client's update mechanisms are designed to handle key rotations seamlessly. However, users who manually verify GPG signatures for downloaded artifacts will need to import the new key and acknowledge the revocation of the old one.

Specific instructions have been provided for users who rely on Firefox RPM packages, as these may require manual intervention to ensure continued verification of software integrity. Mozilla's detailed guidance aims to assist these users in navigating the transition to the new GPG key.

The incident underscores the increasing vigilance required in software development and distribution, particularly in light of the escalating number of supply chain attacks observed globally. Organizations are increasingly adopting a zero-trust approach to key management, rotating signing keys proactively at the first indication of potential compromise.

By taking swift action, Mozilla demonstrates a commitment to maintaining user trust and safeguarding the integrity of its widely used open-source software. The replacement of the GPG key, coupled with strengthened internal controls, reinforces the security of the Firefox and Thunderbird ecosystems.

The Register article provides additional details regarding the exposure, noting that the GPG private subkey was committed to a private GitHub repository accessible only to a limited number of authorized Mozilla employees. While Mozilla stated there was no evidence of unauthorized access, the publication highlights that the exact duration and method of the key's presence in GitHub remain unclear, as Mozilla did not respond to specific inquiries on these points. Furthermore, the article elaborates on the specific impact for users of RPM-based distributions, detailing the manual steps required to update keys on various Linux versions.

The revocation reason code specified by Mozilla was 'key material has been compromised' (reason code 2), indicating a higher level of concern than a simple rotation. This specific reason code means that all signatures produced by the compromised key are now considered suspect, not just those made after the compromise. The revoked subkey, 09BE ED63 F346 2A2D FFAB 3B87 5ECB 6497 C1A2 0256, was originally announced in April 2025 and had an expected validity until March 2027, making this revocation approximately seven months ahead of schedule.

The incident involved an unencrypted GPG signing subkey for Linux artifacts being accidentally committed to a private GitHub repository. While Mozilla states there is no evidence of misuse and most users are unaffected, administrators on specific Linux distributions like older Fedora, RHEL, Rocky Linux, AlmaLinux, openSUSE, and SUSE systems must manually update the signing key to ensure package integrity and prevent validation failures. Mozilla has provided specific instructions and new key fingerprints for affected users and administrators.