Overview
- Mozilla revoked the exposed signing subkey and published a replacement on Monday with fingerprint 827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3 and a validity that runs until August 5, 2028.
- The private subkey was accidentally committed in an unencrypted form to a private GitHub repository and Mozilla's audit of available logs found no evidence that an unauthorized party accessed the file while it was present.
- Release signing keys let users and package managers check that downloads come from Mozilla, and the published revocation uses OpenPGP reason code 2 for 'key material has been compromised,' which makes signatures from the old subkey suspect and can break verification of older files.
- Most users do not need to act but people who verify GPG signatures by hand and some Linux users who get Firefox from Mozilla RPM packages must import the new key and the revocation and may need to remove the old key or run manual repository-key commands to restore updates.
- Mozilla said it rotated the subkey about seven months earlier than planned, added protections to prevent repeat incidents, and took the step as part of wider caution after recent supply-chain attacks that have raised sensitivity to signing-key exposure.