Mozilla Rotates GPG Signing Key After GitHub Exposure

Mozilla has rotated the GPG signing key used for Firefox and Thunderbird releases after an unencrypted copy of the key was accidentally committed to a private GitHub repository. The company downplayed the risk of a supply chain attack, noting that access to the repo was tightly restricted.

The Accidental Exposure

In a Monday blog post, Mozilla revealed that the previous GPG signing subkey had been inadvertently pushed to a private GitHub repository. The key is used to sign Linux tarballs, RPM packages, and checksum files for both Firefox and Thunderbird.

Mozilla stated that only a limited number of individuals had access to that repository, which is why the risk of malicious actors obtaining and abusing the key remains low. The company also said it has not found evidence that the key was accessed by unauthorized parties during the time it was exposed.

Limited Exposure, Low Risk

The exposure was limited to a small group within Mozilla, all of whom already had authorized access to the key through other means. This reduces the likelihood that an external threat actor could have intercepted the key and used it to sign malicious installers.

Despite the low risk, Mozilla chose to act quickly. It revoked the compromised key and replaced it with a new signing subkey, a standard precautionary measure to prevent potential abuse.

Immediate Response and Revocation

Upon discovering the incident, Mozilla revoked the key used to sign Linux tarballs, RPM packages, and checksum files. The organization has also taken measures to prevent similar issues in the future, though the specifics of those measures were not detailed in the announcement.

The new signing subkey is now in use for signing artifacts, and the revocation for the old key has been issued.

What Users Need to Do

Most users will not need to take any action. However, Mozilla advises that users who manually verify GPG signatures must import the new signing key and the revocation for the old key.

Linux users who install Firefox via RPM packages may need to manually update their systems. Mozilla shared detailed instructions for systems running Fedora 43 and later, Fedora 42 and older, RHEL/Rocky/Almalinux, and openSUSE/SUSE-based distributions to ensure they continue receiving the latest Firefox updates.

Thunderbird Users Unaffected

Thunderbird does not provide official RPM packages, so Thunderbird users do not need to take RPM-specific actions. This distinction simplifies the update process for those who rely on Thunderbird for email.

Key Details and Expiry

The new signing subkey expires on August 5, 2028. The new public key and the revocation for the previous key are available through the latest Firefox Nightly KEY files and on keys.openpgp.org.

Why It Matters

This incident underscores the importance of safeguarding signing keys, even when exposure appears limited. A compromised signing key could allow attackers to distribute malware disguised as legitimate software, undermining trust in the update mechanism.

For security-conscious users, manually verifying GPG signatures is a good practice, and this event highlights the need to stay vigilant about key updates. Mozilla's prompt response and transparency serve as a reminder that even major organizations can face key management challenges, and that proactive measures are essential to mitigate potential risks.