Mozilla has issued a new GPG signing subkey for Firefox and Thunderbird after discovering that an unencrypted copy of the previous key had been accidentally committed to a GitHub repository. The organization announced the rotation on Monday and said it has revoked the exposed key while adding new safeguards to prevent similar mistakes.
The affected key was used to sign a subset of release artifacts, including Linux tarballs, RPM packages, and checksum files. If a private signing key like this falls into the wrong hands, an attacker could theoretically use it to sign malicious or tampered software so that it appears to be a legitimate release. Actually distributing such files to victims would still require a separate delivery mechanism, such as a compromised mirror, an alternate download source, or a social engineering campaign.
Mozilla said the exposure occurred in a private repository accessible only to a small group of developers who already had legitimate access to the key through other channels. “Our review of available audit records found no evidence that the key was accessed by an unauthorized party while it was present in the repository,” the company stated.
Precautionary Response
Despite finding no evidence of misuse, Mozilla opted to revoke the exposed key outright and issue a replacement, treating the incident with the same urgency it would apply to a confirmed compromise. The company also said it has implemented additional protections to reduce the risk of a similar accidental exposure happening again.
For most Firefox and Thunderbird users, no action is required. However, users who manually verify GPG signatures on downloads will need to import the new signing key and the revocation certificate for the old one. Mozilla has also published specific instructions for users of Firefox RPM packages, who may need to take additional steps to continue verifying package authenticity.
Part of a Broader Trend
The decision to rotate the key at the first sign of potential exposure, rather than waiting for confirmed evidence of abuse, reflects a broader shift in how software vendors are handling key management. With software supply chain attacks having surged over the past year, organizations are increasingly treating any credential exposure, confirmed or not, as reason enough to rotate keys and tighten controls around code signing infrastructure.