Mozilla updates and revokes GPG keys for Firefox and Thunderbird following GitHub leak
Mozilla urgently updates and revokes the GPG keys used for digital signatures in Firefox and Thunderbird after they were accidentally uploaded to GitHub.
Mozilla has announced an update and revocation of the GPG subkeys used for signing software installers for Firefox and Thunderbird, specifically affecting Linux tarballs, RPM packages, and checksum files, following an incident where the keys were accidentally exposed in a private GitHub repository.
According to Mozilla's preliminary investigation, there is currently no evidence that the keys were accessed by unauthorized external parties. Furthermore, individuals with access to the repository are internal developers who already have legitimate access to these keys through standard channels, keeping the risk of misuse relatively low.
For general users, most will not be affected and do not need to take any action. However, advanced users who manually verify GPG signatures, as well as those installing Firefox via RPM packages, may need to manually update their keys following Mozilla's official instructions for maximum security.
Although general users are not directly affected, this incident highlights the importance of code repository security management, and some Linux users may need to manually update their installation keys.