AIBRIEF
Mozilla revoked the code signing key that authenticates Firefox updates after an unencrypted copy surfaced on a private GitHub repo; most users can ignore it, but users on older Linux distributions must remove the old key before installing the new
A code-signing key is the cryptographic stamp that says "this Firefox update genuinely came from Mozilla, run it." On August 10, Mozilla disclosed that an unencrypted copy of the key used to sign Firefox and Thunderbird Linux tarballs, RPM packages, and checksum files had been committed to a private GitHub repository.
The repo was private, and access was limited to a small Mozilla group, all of whom already had the key through other channels. A review of audit logs found no evidence an unauthorized party viewed it. The exposure was the credential sitting on a system that should not have held it. The Register and SecurityWeek covered the disclosure on August 11.
Mozilla revoked the old key and issued a new signing subkey with fingerprint 827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3, valid through August 5, 2028. The new public key is published on keys.openpgp.org and in the blog post.
Users who manually verify GPG signatures must import the new key plus the revocation certificate. RPM users on Fedora 42 or older, RHEL, Rocky, AlmaLinux, and openSUSE/SUSE must remove the old key (gpg-pubkey-14f26682d0916cdd81e37b6d61b7b526d98f0353) before installing the new one, or their next update will fail.
With the private key, an attacker could sign malicious binaries that Firefox would treat as genuine and ship them through a compromised mirror. Distribution would still need a second break, but the signing credential is the part of the chain that, once leaked, cannot be recalled quietly.